Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 21:34
Static task
static1
Behavioral task
behavioral1
Sample
086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe
Resource
win7-20220901-en
General
-
Target
086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe
-
Size
237KB
-
MD5
2455a617024d49ae68c435985d7dbf9b
-
SHA1
856d528bf21a7f9b6f20813a9a333797f9c13922
-
SHA256
086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa
-
SHA512
baecf84889f4a68ca1bcd1210161e183a93b21bb43088de9c4e93d89747922f1ab10d0b06b98115b41f38b1de4692efed86e62447b8398fd8fee791ddaa4e608
-
SSDEEP
6144:pZP85RoqMMk5AM6r6wKn5kXWkn2zXXtHD84NzHv7CdNc3KR7Dtn+IU3:pEQvSm5xkcHGgzONc3KR7Dtn+IU3
Malware Config
Extracted
xloader
2.3
idir
c-creator.com
freeladoc.com
toluar.com
pathwaysnorman.com
saveme.xyz
espadanabours.com
turnthathitup.net
markdfoto.com
thebeverlywoodweekly.com
truonglocphat.com
fullyphantom.life
snippopotamus.com
snakby.com
atualizaaideia.com
zotbxtaxon.xyz
hombresalfa.com
veterinaryneurologue.com
thesynapsextinfo.com
elroyalebet10.xyz
supperbazaars.com
bitemybritches.com
twistedbinehops.com
wm-ks.com
hunliqn.com
rieplslaw.com
hash-3.com
ruianhuaan.com
blackholehobby.com
wagnercontractingllc.com
kimamayuru.com
lintglobal.com
sistemahorpend.com
ownlineshops.com
tgy100.com
faszinationwetter.com
thysatis.com
thebesthikingstoreblog.com
mini-conventions.com
vantopsglobal.com
amazoncereer.com
calicomed.com
powermindcoaching.com
afirecma.com
drbindalhomeocare.com
steelwolf.net
hall-on.com
cnwarton.com
mouhsinefruits.com
voilalab.com
wholelifehealthcoach.com
mimesademezclas.com
epoxmarket.com
gyoutendojo.com
worldsome.com
italodiscovideo.com
privatemarketmaker.com
racevx.xyz
gofastnv.com
goal123news.com
sioosi.com
realtruthrealtalk.com
htmachinetoos.com
naturalhazardsconsulting.com
ourlook.net
mediasupernova.com
Signatures
-
Xloader payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/848-55-0x0000000000550000-0x000000000058C000-memory.dmp xloader behavioral1/memory/848-56-0x0000000002080000-0x00000000020A8000-memory.dmp xloader behavioral1/memory/592-63-0x000000000041D020-mapping.dmp xloader behavioral1/memory/592-68-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/592-72-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1288-75-0x0000000000080000-0x00000000000A8000-memory.dmp xloader behavioral1/memory/1288-80-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exesvchost.execolorcpl.exedescription pid process target process PID 848 set thread context of 592 848 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 592 set thread context of 1208 592 svchost.exe Explorer.EXE PID 592 set thread context of 1208 592 svchost.exe Explorer.EXE PID 1288 set thread context of 1208 1288 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
svchost.execolorcpl.exepid process 592 svchost.exe 592 svchost.exe 592 svchost.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
svchost.execolorcpl.exepid process 592 svchost.exe 592 svchost.exe 592 svchost.exe 592 svchost.exe 1288 colorcpl.exe 1288 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.execolorcpl.exedescription pid process Token: SeDebugPrivilege 592 svchost.exe Token: SeDebugPrivilege 1288 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 848 wrote to memory of 592 848 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 848 wrote to memory of 592 848 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 848 wrote to memory of 592 848 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 848 wrote to memory of 592 848 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 848 wrote to memory of 592 848 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 848 wrote to memory of 592 848 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 848 wrote to memory of 592 848 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 1208 wrote to memory of 1288 1208 Explorer.EXE colorcpl.exe PID 1208 wrote to memory of 1288 1208 Explorer.EXE colorcpl.exe PID 1208 wrote to memory of 1288 1208 Explorer.EXE colorcpl.exe PID 1208 wrote to memory of 1288 1208 Explorer.EXE colorcpl.exe PID 1288 wrote to memory of 1644 1288 colorcpl.exe cmd.exe PID 1288 wrote to memory of 1644 1288 colorcpl.exe cmd.exe PID 1288 wrote to memory of 1644 1288 colorcpl.exe cmd.exe PID 1288 wrote to memory of 1644 1288 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe"C:\Users\Admin\AppData\Local\Temp\086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\svchost.exe"C:\\Windows\\SysWow64\\svchost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWow64\svchost.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/592-69-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/592-66-0x0000000000130000-0x0000000000140000-memory.dmpFilesize
64KB
-
memory/592-72-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/592-63-0x000000000041D020-mapping.dmp
-
memory/592-68-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/592-59-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/592-60-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/592-65-0x00000000006C0000-0x00000000009C3000-memory.dmpFilesize
3.0MB
-
memory/848-55-0x0000000000550000-0x000000000058C000-memory.dmpFilesize
240KB
-
memory/848-56-0x0000000002080000-0x00000000020A8000-memory.dmpFilesize
160KB
-
memory/848-58-0x0000000000590000-0x0000000000594000-memory.dmpFilesize
16KB
-
memory/848-57-0x0000000002080000-0x0000000002096000-memory.dmpFilesize
88KB
-
memory/848-54-0x000000013F1B0000-0x000000013F1F2000-memory.dmpFilesize
264KB
-
memory/1208-79-0x0000000004E10000-0x0000000004F0B000-memory.dmpFilesize
1004KB
-
memory/1208-67-0x0000000002BF0000-0x0000000002CF1000-memory.dmpFilesize
1.0MB
-
memory/1208-70-0x00000000064E0000-0x0000000006652000-memory.dmpFilesize
1.4MB
-
memory/1208-81-0x0000000004E10000-0x0000000004F0B000-memory.dmpFilesize
1004KB
-
memory/1288-71-0x0000000000000000-mapping.dmp
-
memory/1288-75-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/1288-77-0x0000000000B70000-0x0000000000E73000-memory.dmpFilesize
3.0MB
-
memory/1288-78-0x0000000000520000-0x00000000005AF000-memory.dmpFilesize
572KB
-
memory/1288-74-0x0000000000EB0000-0x0000000000EC8000-memory.dmpFilesize
96KB
-
memory/1288-80-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/1288-73-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/1644-76-0x0000000000000000-mapping.dmp