Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 21:34
Static task
static1
Behavioral task
behavioral1
Sample
086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe
Resource
win7-20220901-en
General
-
Target
086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe
-
Size
237KB
-
MD5
2455a617024d49ae68c435985d7dbf9b
-
SHA1
856d528bf21a7f9b6f20813a9a333797f9c13922
-
SHA256
086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa
-
SHA512
baecf84889f4a68ca1bcd1210161e183a93b21bb43088de9c4e93d89747922f1ab10d0b06b98115b41f38b1de4692efed86e62447b8398fd8fee791ddaa4e608
-
SSDEEP
6144:pZP85RoqMMk5AM6r6wKn5kXWkn2zXXtHD84NzHv7CdNc3KR7Dtn+IU3:pEQvSm5xkcHGgzONc3KR7Dtn+IU3
Malware Config
Extracted
xloader
2.3
idir
c-creator.com
freeladoc.com
toluar.com
pathwaysnorman.com
saveme.xyz
espadanabours.com
turnthathitup.net
markdfoto.com
thebeverlywoodweekly.com
truonglocphat.com
fullyphantom.life
snippopotamus.com
snakby.com
atualizaaideia.com
zotbxtaxon.xyz
hombresalfa.com
veterinaryneurologue.com
thesynapsextinfo.com
elroyalebet10.xyz
supperbazaars.com
bitemybritches.com
twistedbinehops.com
wm-ks.com
hunliqn.com
rieplslaw.com
hash-3.com
ruianhuaan.com
blackholehobby.com
wagnercontractingllc.com
kimamayuru.com
lintglobal.com
sistemahorpend.com
ownlineshops.com
tgy100.com
faszinationwetter.com
thysatis.com
thebesthikingstoreblog.com
mini-conventions.com
vantopsglobal.com
amazoncereer.com
calicomed.com
powermindcoaching.com
afirecma.com
drbindalhomeocare.com
steelwolf.net
hall-on.com
cnwarton.com
mouhsinefruits.com
voilalab.com
wholelifehealthcoach.com
mimesademezclas.com
epoxmarket.com
gyoutendojo.com
worldsome.com
italodiscovideo.com
privatemarketmaker.com
racevx.xyz
gofastnv.com
goal123news.com
sioosi.com
realtruthrealtalk.com
htmachinetoos.com
naturalhazardsconsulting.com
ourlook.net
mediasupernova.com
Signatures
-
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1824-135-0x000000000041D020-mapping.dmp xloader behavioral2/memory/1824-134-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/1824-142-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/5008-146-0x00000000003F0000-0x0000000000418000-memory.dmp xloader behavioral2/memory/5008-149-0x00000000003F0000-0x0000000000418000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exesvchost.exewlanext.exedescription pid process target process PID 3228 set thread context of 1824 3228 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 1824 set thread context of 2740 1824 svchost.exe Explorer.EXE PID 5008 set thread context of 2740 5008 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
svchost.exewlanext.exepid process 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe 5008 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2740 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
svchost.exewlanext.exepid process 1824 svchost.exe 1824 svchost.exe 1824 svchost.exe 5008 wlanext.exe 5008 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exewlanext.exedescription pid process Token: SeDebugPrivilege 1824 svchost.exe Token: SeDebugPrivilege 5008 wlanext.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exeExplorer.EXEwlanext.exedescription pid process target process PID 3228 wrote to memory of 1824 3228 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 3228 wrote to memory of 1824 3228 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 3228 wrote to memory of 1824 3228 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 3228 wrote to memory of 1824 3228 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 3228 wrote to memory of 1824 3228 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 3228 wrote to memory of 1824 3228 086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe svchost.exe PID 2740 wrote to memory of 5008 2740 Explorer.EXE wlanext.exe PID 2740 wrote to memory of 5008 2740 Explorer.EXE wlanext.exe PID 2740 wrote to memory of 5008 2740 Explorer.EXE wlanext.exe PID 5008 wrote to memory of 3468 5008 wlanext.exe cmd.exe PID 5008 wrote to memory of 3468 5008 wlanext.exe cmd.exe PID 5008 wrote to memory of 3468 5008 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe"C:\Users\Admin\AppData\Local\Temp\086bcd47c9a569afd16d8b8879a163949453443226f1630cba466cafed77acaa.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\svchost.exe"C:\\Windows\\SysWow64\\svchost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWow64\svchost.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1824-135-0x000000000041D020-mapping.dmp
-
memory/1824-134-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1824-137-0x0000000001000000-0x000000000134A000-memory.dmpFilesize
3.3MB
-
memory/1824-139-0x0000000000CB0000-0x0000000000CC0000-memory.dmpFilesize
64KB
-
memory/1824-142-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2740-148-0x0000000008670000-0x000000000879D000-memory.dmpFilesize
1.2MB
-
memory/2740-140-0x0000000003660000-0x000000000379D000-memory.dmpFilesize
1.2MB
-
memory/2740-150-0x0000000008670000-0x000000000879D000-memory.dmpFilesize
1.2MB
-
memory/3228-133-0x00007FFF39CB0000-0x00007FFF3A771000-memory.dmpFilesize
10.8MB
-
memory/3228-136-0x00007FFF39CB0000-0x00007FFF3A771000-memory.dmpFilesize
10.8MB
-
memory/3228-132-0x00000000009C0000-0x0000000000A02000-memory.dmpFilesize
264KB
-
memory/3468-143-0x0000000000000000-mapping.dmp
-
memory/5008-141-0x0000000000000000-mapping.dmp
-
memory/5008-146-0x00000000003F0000-0x0000000000418000-memory.dmpFilesize
160KB
-
memory/5008-147-0x0000000000B50000-0x0000000000BDF000-memory.dmpFilesize
572KB
-
memory/5008-144-0x0000000000490000-0x00000000004A7000-memory.dmpFilesize
92KB
-
memory/5008-149-0x00000000003F0000-0x0000000000418000-memory.dmpFilesize
160KB
-
memory/5008-145-0x0000000000FA0000-0x00000000012EA000-memory.dmpFilesize
3.3MB