Analysis
-
max time kernel
148s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
0e2f9d545ac87b4e9762ca50e2bf15ab.exe
Resource
win7-20231215-en
General
-
Target
0e2f9d545ac87b4e9762ca50e2bf15ab.exe
-
Size
1.3MB
-
MD5
0e2f9d545ac87b4e9762ca50e2bf15ab
-
SHA1
f4678bb9036c097dfe4bff4794de64eb39c369c4
-
SHA256
fabf4628b3813230d81f4c1a4991a0fe21550362177dd7b451e80c6a839b6814
-
SHA512
86cca0ab67312068c408aee261b372c933b71dc85d51df9e11e9eb5c398e1b0353d0f897e6ba8f72048783485421075805c25c64e767d49d00f26f99ad79c07c
-
SSDEEP
24576:a3yBmCmTOUd+L6k7XW7k5JBaEg3GIdjKCylHkGpE/pvbou8Aaj:a3mmCm6Ud+z7X/PaEboKCuNevbo
Malware Config
Extracted
xloader
2.3
q4kr
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
bodymoisturizer.online
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
resource yara_rule behavioral1/memory/2208-3-0x0000000000460000-0x0000000000472000-memory.dmp CustAttr -
Xloader payload 4 IoCs
resource yara_rule behavioral1/memory/2600-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2600-16-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2120-22-0x0000000000180000-0x00000000001A9000-memory.dmp xloader behavioral1/memory/2120-24-0x0000000000180000-0x00000000001A9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2208 set thread context of 2600 2208 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 30 PID 2600 set thread context of 1208 2600 RegSvcs.exe 16 PID 2120 set thread context of 1208 2120 cmd.exe 16 -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2600 RegSvcs.exe 2600 RegSvcs.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe 2120 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2600 RegSvcs.exe 2600 RegSvcs.exe 2600 RegSvcs.exe 2120 cmd.exe 2120 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2600 RegSvcs.exe Token: SeDebugPrivilege 2120 cmd.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2600 2208 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 30 PID 2208 wrote to memory of 2600 2208 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 30 PID 2208 wrote to memory of 2600 2208 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 30 PID 2208 wrote to memory of 2600 2208 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 30 PID 2208 wrote to memory of 2600 2208 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 30 PID 2208 wrote to memory of 2600 2208 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 30 PID 2208 wrote to memory of 2600 2208 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 30 PID 2208 wrote to memory of 2600 2208 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 30 PID 2208 wrote to memory of 2600 2208 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 30 PID 2208 wrote to memory of 2600 2208 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 30 PID 1208 wrote to memory of 2120 1208 Explorer.EXE 31 PID 1208 wrote to memory of 2120 1208 Explorer.EXE 31 PID 1208 wrote to memory of 2120 1208 Explorer.EXE 31 PID 1208 wrote to memory of 2120 1208 Explorer.EXE 31 PID 2120 wrote to memory of 732 2120 cmd.exe 32 PID 2120 wrote to memory of 732 2120 cmd.exe 32 PID 2120 wrote to memory of 732 2120 cmd.exe 32 PID 2120 wrote to memory of 732 2120 cmd.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\0e2f9d545ac87b4e9762ca50e2bf15ab.exe"C:\Users\Admin\AppData\Local\Temp\0e2f9d545ac87b4e9762ca50e2bf15ab.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:732
-
-