Analysis
-
max time kernel
155s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 19:39
Static task
static1
Behavioral task
behavioral1
Sample
0e2f9d545ac87b4e9762ca50e2bf15ab.exe
Resource
win7-20231215-en
General
-
Target
0e2f9d545ac87b4e9762ca50e2bf15ab.exe
-
Size
1.3MB
-
MD5
0e2f9d545ac87b4e9762ca50e2bf15ab
-
SHA1
f4678bb9036c097dfe4bff4794de64eb39c369c4
-
SHA256
fabf4628b3813230d81f4c1a4991a0fe21550362177dd7b451e80c6a839b6814
-
SHA512
86cca0ab67312068c408aee261b372c933b71dc85d51df9e11e9eb5c398e1b0353d0f897e6ba8f72048783485421075805c25c64e767d49d00f26f99ad79c07c
-
SSDEEP
24576:a3yBmCmTOUd+L6k7XW7k5JBaEg3GIdjKCylHkGpE/pvbou8Aaj:a3mmCm6Ud+z7X/PaEboKCuNevbo
Malware Config
Extracted
xloader
2.3
q4kr
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
bodymoisturizer.online
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
resource yara_rule behavioral2/memory/1884-8-0x0000000004E50000-0x0000000004E62000-memory.dmp CustAttr -
Xloader payload 4 IoCs
resource yara_rule behavioral2/memory/3904-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3904-18-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3928-23-0x0000000000D90000-0x0000000000DB9000-memory.dmp xloader behavioral2/memory/3928-25-0x0000000000D90000-0x0000000000DB9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1884 set thread context of 3904 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 107 PID 3904 set thread context of 3340 3904 RegSvcs.exe 34 PID 3928 set thread context of 3340 3928 colorcpl.exe 34 -
Suspicious behavior: EnumeratesProcesses 57 IoCs
pid Process 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 3904 RegSvcs.exe 3904 RegSvcs.exe 3904 RegSvcs.exe 3904 RegSvcs.exe 3904 RegSvcs.exe 3904 RegSvcs.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe 3928 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3904 RegSvcs.exe 3904 RegSvcs.exe 3904 RegSvcs.exe 3928 colorcpl.exe 3928 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe Token: SeDebugPrivilege 3904 RegSvcs.exe Token: SeDebugPrivilege 3928 colorcpl.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3340 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1884 wrote to memory of 1012 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 105 PID 1884 wrote to memory of 1012 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 105 PID 1884 wrote to memory of 1012 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 105 PID 1884 wrote to memory of 4284 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 106 PID 1884 wrote to memory of 4284 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 106 PID 1884 wrote to memory of 4284 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 106 PID 1884 wrote to memory of 3904 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 107 PID 1884 wrote to memory of 3904 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 107 PID 1884 wrote to memory of 3904 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 107 PID 1884 wrote to memory of 3904 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 107 PID 1884 wrote to memory of 3904 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 107 PID 1884 wrote to memory of 3904 1884 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 107 PID 3340 wrote to memory of 3928 3340 Explorer.EXE 108 PID 3340 wrote to memory of 3928 3340 Explorer.EXE 108 PID 3340 wrote to memory of 3928 3340 Explorer.EXE 108 PID 3928 wrote to memory of 3960 3928 colorcpl.exe 109 PID 3928 wrote to memory of 3960 3928 colorcpl.exe 109 PID 3928 wrote to memory of 3960 3928 colorcpl.exe 109
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\0e2f9d545ac87b4e9762ca50e2bf15ab.exe"C:\Users\Admin\AppData\Local\Temp\0e2f9d545ac87b4e9762ca50e2bf15ab.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:1012
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:4284
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:3960
-
-