Analysis
-
max time kernel
148s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 04:18
Static task
static1
Behavioral task
behavioral1
Sample
0e2f9d545ac87b4e9762ca50e2bf15ab.exe
Resource
win7-20231129-en
General
-
Target
0e2f9d545ac87b4e9762ca50e2bf15ab.exe
-
Size
1.3MB
-
MD5
0e2f9d545ac87b4e9762ca50e2bf15ab
-
SHA1
f4678bb9036c097dfe4bff4794de64eb39c369c4
-
SHA256
fabf4628b3813230d81f4c1a4991a0fe21550362177dd7b451e80c6a839b6814
-
SHA512
86cca0ab67312068c408aee261b372c933b71dc85d51df9e11e9eb5c398e1b0353d0f897e6ba8f72048783485421075805c25c64e767d49d00f26f99ad79c07c
-
SSDEEP
24576:a3yBmCmTOUd+L6k7XW7k5JBaEg3GIdjKCylHkGpE/pvbou8Aaj:a3mmCm6Ud+z7X/PaEboKCuNevbo
Malware Config
Extracted
xloader
2.3
q4kr
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
bodymoisturizer.online
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
resource yara_rule behavioral1/memory/1680-3-0x00000000004F0000-0x0000000000502000-memory.dmp CustAttr -
Xloader payload 5 IoCs
resource yara_rule behavioral1/memory/2564-14-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2564-19-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2564-24-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2960-29-0x00000000001D0000-0x00000000001F9000-memory.dmp xloader behavioral1/memory/2960-31-0x00000000001D0000-0x00000000001F9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1680 set thread context of 2564 1680 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 28 PID 2564 set thread context of 1356 2564 RegSvcs.exe 9 PID 2564 set thread context of 1356 2564 RegSvcs.exe 9 PID 2960 set thread context of 1356 2960 cmd.exe 9 -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2564 RegSvcs.exe 2564 RegSvcs.exe 2564 RegSvcs.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe 2960 cmd.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2564 RegSvcs.exe 2564 RegSvcs.exe 2564 RegSvcs.exe 2564 RegSvcs.exe 2960 cmd.exe 2960 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2564 RegSvcs.exe Token: SeDebugPrivilege 2960 cmd.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1680 wrote to memory of 2564 1680 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 28 PID 1680 wrote to memory of 2564 1680 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 28 PID 1680 wrote to memory of 2564 1680 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 28 PID 1680 wrote to memory of 2564 1680 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 28 PID 1680 wrote to memory of 2564 1680 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 28 PID 1680 wrote to memory of 2564 1680 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 28 PID 1680 wrote to memory of 2564 1680 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 28 PID 1680 wrote to memory of 2564 1680 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 28 PID 1680 wrote to memory of 2564 1680 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 28 PID 1680 wrote to memory of 2564 1680 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 28 PID 1356 wrote to memory of 2960 1356 Explorer.EXE 31 PID 1356 wrote to memory of 2960 1356 Explorer.EXE 31 PID 1356 wrote to memory of 2960 1356 Explorer.EXE 31 PID 1356 wrote to memory of 2960 1356 Explorer.EXE 31 PID 2960 wrote to memory of 2188 2960 cmd.exe 33 PID 2960 wrote to memory of 2188 2960 cmd.exe 33 PID 2960 wrote to memory of 2188 2960 cmd.exe 33 PID 2960 wrote to memory of 2188 2960 cmd.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\0e2f9d545ac87b4e9762ca50e2bf15ab.exe"C:\Users\Admin\AppData\Local\Temp\0e2f9d545ac87b4e9762ca50e2bf15ab.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2188
-
-