Analysis
-
max time kernel
214s -
max time network
266s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2023 21:33
Static task
static1
Behavioral task
behavioral1
Sample
7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe
Resource
win7-20220812-en
General
-
Target
7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe
-
Size
238KB
-
MD5
657dcb74c5bfebed6d30ed78a8816911
-
SHA1
f5b90f489e737c68183505f786f9655a71547c0a
-
SHA256
7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8
-
SHA512
c14b3f0beee603562b5f2f14430d53c99360110d515a4bf54c6d59a9c5e0f88d7b1510f01976377e04a0acf3e53e64ec5e09f5bc9dc0ed8d39c4dbc389df8c53
-
SSDEEP
6144:/rga6QGlwBVA35NW3g69+VQSL3FgwlfB2a:/r36H9Db69+P3FgwlfB2a
Malware Config
Extracted
xloader
2.3
seon
preventionunited.com
keipy.com
kiezt.com
nocapsshows.com
qrayti.com
metodosinergico.com
illume313.com
petarsandmay.com
yangift.com
commercialrealestate.care
meteeor.net
block-rock.com
iwriteasnikki.com
kokomoexpresslaundry.com
nailinspirationsbypat.com
lancedawn.com
iprotectil.com
meuhomenegocio.com
wldl168.com
excelwins.com
houstoncouplesexpert.com
malawimatrimony.com
thethingsiwoulddo.com
losamigoslaundry.com
icheaptvwdbuy.com
nowoczesneaplikacje.com
megami-online.com
aiofps.com
domentemenegi24.com
prophetmicheal.com
soarleaders.com
meghatony.com
divinogelati.com
vseokna-online.com
dynamicsspl.com
qianke.info
excelguitar.com
wzqp4.com
amazingseye.com
learninghealthnetwork.com
gibranm.com
aliarslies.com
hoachatchanhkhangthinh.com
somimibeauty.com
superthrivejc.com
necklacemasager.com
jstelecom.net
naveedesehar.com
contex3.info
soulagerhemorroides.com
dizifilmizlesen.com
tyhplang.com
lician-studio.com
minhavidademamae.com
cameraamministrativanocera.com
rajinination.com
5613a.com
revistaelnotario.com
jamwheel.com
socialdistancescreening.com
baidbu.club
capturedbykt.com
waxytech.com
hcxyh.net
pamsinteriors.com
Signatures
-
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4396-134-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4396-135-0x000000000041D080-mapping.dmp xloader behavioral2/memory/4396-142-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4836-144-0x0000000000D00000-0x0000000000D29000-memory.dmp xloader behavioral2/memory/4836-149-0x0000000000D00000-0x0000000000D29000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exesvchost.exeWWAHost.exedescription pid process target process PID 4532 set thread context of 4396 4532 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 4396 set thread context of 700 4396 svchost.exe Explorer.EXE PID 4836 set thread context of 700 4836 WWAHost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
svchost.exeWWAHost.exepid process 4396 svchost.exe 4396 svchost.exe 4396 svchost.exe 4396 svchost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe 4836 WWAHost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 700 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
svchost.exeWWAHost.exepid process 4396 svchost.exe 4396 svchost.exe 4396 svchost.exe 4836 WWAHost.exe 4836 WWAHost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
svchost.exeWWAHost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4396 svchost.exe Token: SeDebugPrivilege 4836 WWAHost.exe Token: SeShutdownPrivilege 700 Explorer.EXE Token: SeCreatePagefilePrivilege 700 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exeExplorer.EXEWWAHost.exedescription pid process target process PID 4532 wrote to memory of 4396 4532 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 4532 wrote to memory of 4396 4532 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 4532 wrote to memory of 4396 4532 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 4532 wrote to memory of 4396 4532 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 4532 wrote to memory of 4396 4532 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 4532 wrote to memory of 4396 4532 7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe svchost.exe PID 700 wrote to memory of 4836 700 Explorer.EXE WWAHost.exe PID 700 wrote to memory of 4836 700 Explorer.EXE WWAHost.exe PID 700 wrote to memory of 4836 700 Explorer.EXE WWAHost.exe PID 4836 wrote to memory of 220 4836 WWAHost.exe cmd.exe PID 4836 wrote to memory of 220 4836 WWAHost.exe cmd.exe PID 4836 wrote to memory of 220 4836 WWAHost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe"C:\Users\Admin\AppData\Local\Temp\7d99e80800868b21d88a5ab1a7e16f8cffe36b93bf3bb2cc07653df1081160e8.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWow64\svchost.exe"C:\\Windows\\SysWow64\\svchost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWow64\svchost.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/220-146-0x0000000000000000-mapping.dmp
-
memory/700-140-0x0000000002CD0000-0x0000000002DC8000-memory.dmpFilesize
992KB
-
memory/700-150-0x0000000003050000-0x00000000030EF000-memory.dmpFilesize
636KB
-
memory/700-148-0x0000000003050000-0x00000000030EF000-memory.dmpFilesize
636KB
-
memory/4396-134-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4396-135-0x000000000041D080-mapping.dmp
-
memory/4396-138-0x0000000001400000-0x000000000174A000-memory.dmpFilesize
3.3MB
-
memory/4396-139-0x0000000000BD0000-0x0000000000BE1000-memory.dmpFilesize
68KB
-
memory/4396-142-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4532-133-0x00007FFAF3290000-0x00007FFAF3D51000-memory.dmpFilesize
10.8MB
-
memory/4532-136-0x00007FFAF3290000-0x00007FFAF3D51000-memory.dmpFilesize
10.8MB
-
memory/4532-132-0x0000000000F00000-0x0000000000F42000-memory.dmpFilesize
264KB
-
memory/4836-141-0x0000000000000000-mapping.dmp
-
memory/4836-145-0x0000000001E30000-0x000000000217A000-memory.dmpFilesize
3.3MB
-
memory/4836-147-0x0000000001C80000-0x0000000001D10000-memory.dmpFilesize
576KB
-
memory/4836-144-0x0000000000D00000-0x0000000000D29000-memory.dmpFilesize
164KB
-
memory/4836-149-0x0000000000D00000-0x0000000000D29000-memory.dmpFilesize
164KB
-
memory/4836-143-0x00000000009F0000-0x0000000000ACC000-memory.dmpFilesize
880KB