Resubmissions
23-05-2023 15:26
230523-svdgjsfh53 10Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2023 15:26
Static task
static1
Behavioral task
behavioral1
Sample
IMG-78293792.exe
Resource
win7-20230220-en
General
-
Target
IMG-78293792.exe
-
Size
356KB
-
MD5
cb94f8bf4453d77ed35b4cccad18260c
-
SHA1
aeacb009addb2152c05a34537f565e66b32b25d2
-
SHA256
a39d6226eed5913f2f1d77991f011a386453d095689f85eb0ca14aac1d983466
-
SHA512
7fb17a554481d5ff6c28edd4ee43b9306a8e59ac9f992a2b6d243b2d88eb9daa997bbf5be962f331c6ec282b15e4e67107c233691a6b05d317957072754f4135
-
SSDEEP
6144:lZwkVnw0KesTf8DZgu2OuQ15Mgkv0StJXgBivzsXjpY/i0un1IC1ewYrbOhpRRRY:lZ7Laf8DqOrRk8+JXUMzeYRun19ewskC
Malware Config
Extracted
xloader
2.5
c6si
tristateinc.construction
americanscaregroundstexas.com
kanimisoshiru.com
wihling.com
fishcheekstosa.com
parentsfuid.com
greenstandmarket.com
fc8fla8kzq.com
gametwist-83.club
jobsncvs.com
directrealtysells.com
avida2015.com
conceptasite.net
arkaneattire.com
indev-mobility.info
2160centurypark412.com
valefloor.com
septembership.com
stackflix.com
jimc0sales.net
socialviralup.com
lastra41.com
juliaepaulovaocasar.com
jurisagora.com
drawandgrow.online
rebekahlouise.com
herport-fr.com
iphone13.webcam
appz-one.net
inpost-pl.net
promocion360fitness.com
global-forbes.biz
diamondtrade.net
albertcantos.com
gtgits.com
travel-ai.online
busipe6.com
mualikesubvn.com
niftyhandy.com
docprops.com
lido88.bet
baywoodphotography.com
cargosouq.info
newsnowlive.online
floridafishingoverboard.com
missnikissalsa.net
walletvalidate.space
kissimmeeinternationalcup.com
charterhome.school
gurujupiter.com
entertainmentwitchy.com
jokeaou.com
sugarmountainfirearms.com
iss-sa.com
smittyssierra.com
freedomoff.com
giftoin.com
realitystararmwrestling.com
salsalunch-equallyage.com
ladouba.com
thepropertygoat.com
bestofmerrick.guide
4the.top
regioinversiones.com
129qihu.com
Signatures
-
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4772-140-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4772-146-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4772-170-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4700-172-0x0000000000770000-0x0000000000799000-memory.dmp xloader behavioral2/memory/4700-174-0x0000000000770000-0x0000000000799000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
IMG-78293792.exeIMG-78293792.execontrol.exedescription pid process target process PID 4348 set thread context of 4772 4348 IMG-78293792.exe IMG-78293792.exe PID 4772 set thread context of 3168 4772 IMG-78293792.exe Explorer.EXE PID 4772 set thread context of 3168 4772 IMG-78293792.exe Explorer.EXE PID 4700 set thread context of 3168 4700 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
IMG-78293792.execontrol.exepid process 4772 IMG-78293792.exe 4772 IMG-78293792.exe 4772 IMG-78293792.exe 4772 IMG-78293792.exe 4772 IMG-78293792.exe 4772 IMG-78293792.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe 4700 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3168 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
IMG-78293792.execontrol.exepid process 4772 IMG-78293792.exe 4772 IMG-78293792.exe 4772 IMG-78293792.exe 4772 IMG-78293792.exe 4700 control.exe 4700 control.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
IMG-78293792.exeExplorer.EXEcontrol.exedescription pid process Token: SeDebugPrivilege 4772 IMG-78293792.exe Token: SeShutdownPrivilege 3168 Explorer.EXE Token: SeCreatePagefilePrivilege 3168 Explorer.EXE Token: SeShutdownPrivilege 3168 Explorer.EXE Token: SeCreatePagefilePrivilege 3168 Explorer.EXE Token: SeDebugPrivilege 4700 control.exe Token: SeShutdownPrivilege 3168 Explorer.EXE Token: SeCreatePagefilePrivilege 3168 Explorer.EXE Token: SeShutdownPrivilege 3168 Explorer.EXE Token: SeCreatePagefilePrivilege 3168 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
IMG-78293792.exeExplorer.EXEcontrol.exedescription pid process target process PID 4348 wrote to memory of 4772 4348 IMG-78293792.exe IMG-78293792.exe PID 4348 wrote to memory of 4772 4348 IMG-78293792.exe IMG-78293792.exe PID 4348 wrote to memory of 4772 4348 IMG-78293792.exe IMG-78293792.exe PID 4348 wrote to memory of 4772 4348 IMG-78293792.exe IMG-78293792.exe PID 4348 wrote to memory of 4772 4348 IMG-78293792.exe IMG-78293792.exe PID 4348 wrote to memory of 4772 4348 IMG-78293792.exe IMG-78293792.exe PID 3168 wrote to memory of 4700 3168 Explorer.EXE control.exe PID 3168 wrote to memory of 4700 3168 Explorer.EXE control.exe PID 3168 wrote to memory of 4700 3168 Explorer.EXE control.exe PID 4700 wrote to memory of 1612 4700 control.exe cmd.exe PID 4700 wrote to memory of 1612 4700 control.exe cmd.exe PID 4700 wrote to memory of 1612 4700 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG-78293792.exe"C:\Users\Admin\AppData\Local\Temp\IMG-78293792.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG-78293792.exe"C:\Users\Admin\AppData\Local\Temp\IMG-78293792.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IMG-78293792.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3168-193-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-145-0x0000000007490000-0x0000000007583000-memory.dmpFilesize
972KB
-
memory/3168-211-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/3168-210-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/3168-209-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/3168-207-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/3168-206-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/3168-205-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/3168-204-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-203-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-202-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-201-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-147-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-148-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-149-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-150-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-151-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-152-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-153-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-154-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-155-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-156-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-157-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-158-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-159-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-160-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-161-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-162-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-200-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-199-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-165-0x0000000002600000-0x0000000002610000-memory.dmpFilesize
64KB
-
memory/3168-167-0x00000000075B0000-0x00000000075C0000-memory.dmpFilesize
64KB
-
memory/3168-166-0x00000000075B0000-0x00000000075C0000-memory.dmpFilesize
64KB
-
memory/3168-168-0x00000000075B0000-0x00000000075C0000-memory.dmpFilesize
64KB
-
memory/3168-164-0x0000000008490000-0x0000000008570000-memory.dmpFilesize
896KB
-
memory/3168-196-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-197-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-198-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-195-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-194-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-192-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-177-0x00000000075B0000-0x00000000075C0000-memory.dmpFilesize
64KB
-
memory/3168-178-0x00000000075B0000-0x00000000075C0000-memory.dmpFilesize
64KB
-
memory/3168-179-0x00000000075B0000-0x00000000075C0000-memory.dmpFilesize
64KB
-
memory/3168-180-0x00000000085E0000-0x000000000868B000-memory.dmpFilesize
684KB
-
memory/3168-181-0x00000000085E0000-0x000000000868B000-memory.dmpFilesize
684KB
-
memory/3168-183-0x00000000085E0000-0x000000000868B000-memory.dmpFilesize
684KB
-
memory/3168-188-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-189-0x00000000023E0000-0x00000000023F0000-memory.dmpFilesize
64KB
-
memory/3168-190-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/3168-191-0x0000000002570000-0x0000000002580000-memory.dmpFilesize
64KB
-
memory/4348-135-0x0000000005790000-0x0000000005822000-memory.dmpFilesize
584KB
-
memory/4348-136-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB
-
memory/4348-139-0x0000000008C40000-0x0000000008CDC000-memory.dmpFilesize
624KB
-
memory/4348-138-0x0000000005740000-0x0000000005750000-memory.dmpFilesize
64KB
-
memory/4348-133-0x0000000000D90000-0x0000000000DF0000-memory.dmpFilesize
384KB
-
memory/4348-134-0x0000000005E20000-0x00000000063C4000-memory.dmpFilesize
5.6MB
-
memory/4348-137-0x0000000005830000-0x000000000583A000-memory.dmpFilesize
40KB
-
memory/4700-172-0x0000000000770000-0x0000000000799000-memory.dmpFilesize
164KB
-
memory/4700-173-0x0000000002920000-0x0000000002C6A000-memory.dmpFilesize
3.3MB
-
memory/4700-171-0x0000000000860000-0x0000000000887000-memory.dmpFilesize
156KB
-
memory/4700-174-0x0000000000770000-0x0000000000799000-memory.dmpFilesize
164KB
-
memory/4700-169-0x0000000000860000-0x0000000000887000-memory.dmpFilesize
156KB
-
memory/4700-176-0x00000000026B0000-0x0000000002740000-memory.dmpFilesize
576KB
-
memory/4772-146-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4772-144-0x00000000012B0000-0x00000000012C1000-memory.dmpFilesize
68KB
-
memory/4772-143-0x00000000017C0000-0x0000000001B0A000-memory.dmpFilesize
3.3MB
-
memory/4772-140-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4772-163-0x0000000001320000-0x0000000001331000-memory.dmpFilesize
68KB
-
memory/4772-170-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB