Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 21:33
Static task
static1
Behavioral task
behavioral1
Sample
7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe
Resource
win7-20220812-en
General
-
Target
7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe
-
Size
238KB
-
MD5
657dcb74c5bfebed6d30ed78a8816911
-
SHA1
f5b90f489e737c68183505f786f9655a71547c0a
-
SHA256
7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8
-
SHA512
c14b3f0beee603562b5f2f14430d53c99360110d515a4bf54c6d59a9c5e0f88d7b1510f01976377e04a0acf3e53e64ec5e09f5bc9dc0ed8d39c4dbc389df8c53
-
SSDEEP
6144:/rga6QGlwBVA35NW3g69+VQSL3FgwlfB2a:/r36H9Db69+P3FgwlfB2a
Malware Config
Extracted
xloader
2.3
seon
preventionunited.com
keipy.com
kiezt.com
nocapsshows.com
qrayti.com
metodosinergico.com
illume313.com
petarsandmay.com
yangift.com
commercialrealestate.care
meteeor.net
block-rock.com
iwriteasnikki.com
kokomoexpresslaundry.com
nailinspirationsbypat.com
lancedawn.com
iprotectil.com
meuhomenegocio.com
wldl168.com
excelwins.com
houstoncouplesexpert.com
malawimatrimony.com
thethingsiwoulddo.com
losamigoslaundry.com
icheaptvwdbuy.com
nowoczesneaplikacje.com
megami-online.com
aiofps.com
domentemenegi24.com
prophetmicheal.com
soarleaders.com
meghatony.com
divinogelati.com
vseokna-online.com
dynamicsspl.com
qianke.info
excelguitar.com
wzqp4.com
amazingseye.com
learninghealthnetwork.com
gibranm.com
aliarslies.com
hoachatchanhkhangthinh.com
somimibeauty.com
superthrivejc.com
necklacemasager.com
jstelecom.net
naveedesehar.com
contex3.info
soulagerhemorroides.com
dizifilmizlesen.com
tyhplang.com
lician-studio.com
minhavidademamae.com
cameraamministrativanocera.com
rajinination.com
5613a.com
revistaelnotario.com
jamwheel.com
socialdistancescreening.com
baidbu.club
capturedbykt.com
waxytech.com
hcxyh.net
pamsinteriors.com
Signatures
-
Xloader payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/368-55-0x0000000000550000-0x000000000058C000-memory.dmp xloader behavioral1/memory/368-56-0x00000000005A0000-0x00000000005C9000-memory.dmp xloader behavioral1/memory/1356-63-0x000000000041D080-mapping.dmp xloader behavioral1/memory/1356-65-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2040-72-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader behavioral1/memory/2040-76-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exesvchost.exewlanext.exedescription pid process target process PID 368 set thread context of 1356 368 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 1356 set thread context of 1384 1356 svchost.exe Explorer.EXE PID 2040 set thread context of 1384 2040 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
svchost.exewlanext.exepid process 1356 svchost.exe 1356 svchost.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe 2040 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
svchost.exewlanext.exepid process 1356 svchost.exe 1356 svchost.exe 1356 svchost.exe 2040 wlanext.exe 2040 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
svchost.exewlanext.exedescription pid process Token: SeDebugPrivilege 1356 svchost.exe Token: SeDebugPrivilege 2040 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exeExplorer.EXEwlanext.exedescription pid process target process PID 368 wrote to memory of 1356 368 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 368 wrote to memory of 1356 368 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 368 wrote to memory of 1356 368 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 368 wrote to memory of 1356 368 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 368 wrote to memory of 1356 368 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 368 wrote to memory of 1356 368 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 368 wrote to memory of 1356 368 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 1384 wrote to memory of 2040 1384 Explorer.EXE wlanext.exe PID 1384 wrote to memory of 2040 1384 Explorer.EXE wlanext.exe PID 1384 wrote to memory of 2040 1384 Explorer.EXE wlanext.exe PID 1384 wrote to memory of 2040 1384 Explorer.EXE wlanext.exe PID 2040 wrote to memory of 1956 2040 wlanext.exe cmd.exe PID 2040 wrote to memory of 1956 2040 wlanext.exe cmd.exe PID 2040 wrote to memory of 1956 2040 wlanext.exe cmd.exe PID 2040 wrote to memory of 1956 2040 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe"C:\Users\Admin\AppData\Local\Temp\7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\svchost.exe"C:\\Windows\\SysWow64\\svchost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWow64\svchost.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/368-54-0x000000013F8D0000-0x000000013F912000-memory.dmpFilesize
264KB
-
memory/368-55-0x0000000000550000-0x000000000058C000-memory.dmpFilesize
240KB
-
memory/368-56-0x00000000005A0000-0x00000000005C9000-memory.dmpFilesize
164KB
-
memory/368-57-0x00000000005A0000-0x00000000005B6000-memory.dmpFilesize
88KB
-
memory/368-58-0x00000000005C0000-0x00000000005C4000-memory.dmpFilesize
16KB
-
memory/1356-67-0x0000000000140000-0x0000000000151000-memory.dmpFilesize
68KB
-
memory/1356-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1356-63-0x000000000041D080-mapping.dmp
-
memory/1356-65-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1356-66-0x0000000000B70000-0x0000000000E73000-memory.dmpFilesize
3.0MB
-
memory/1356-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1384-75-0x00000000070A0000-0x00000000071FF000-memory.dmpFilesize
1.4MB
-
memory/1384-68-0x0000000006980000-0x0000000006AE5000-memory.dmpFilesize
1.4MB
-
memory/1384-77-0x00000000070A0000-0x00000000071FF000-memory.dmpFilesize
1.4MB
-
memory/1956-70-0x0000000000000000-mapping.dmp
-
memory/2040-69-0x0000000000000000-mapping.dmp
-
memory/2040-71-0x0000000000670000-0x0000000000686000-memory.dmpFilesize
88KB
-
memory/2040-72-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/2040-73-0x0000000001EF0000-0x00000000021F3000-memory.dmpFilesize
3.0MB
-
memory/2040-74-0x0000000001CB0000-0x0000000001D40000-memory.dmpFilesize
576KB
-
memory/2040-76-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/2040-78-0x0000000076401000-0x0000000076403000-memory.dmpFilesize
8KB