Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 04:18
Static task
static1
Behavioral task
behavioral1
Sample
0e2f9d545ac87b4e9762ca50e2bf15ab.exe
Resource
win7-20231129-en
General
-
Target
0e2f9d545ac87b4e9762ca50e2bf15ab.exe
-
Size
1.3MB
-
MD5
0e2f9d545ac87b4e9762ca50e2bf15ab
-
SHA1
f4678bb9036c097dfe4bff4794de64eb39c369c4
-
SHA256
fabf4628b3813230d81f4c1a4991a0fe21550362177dd7b451e80c6a839b6814
-
SHA512
86cca0ab67312068c408aee261b372c933b71dc85d51df9e11e9eb5c398e1b0353d0f897e6ba8f72048783485421075805c25c64e767d49d00f26f99ad79c07c
-
SSDEEP
24576:a3yBmCmTOUd+L6k7XW7k5JBaEg3GIdjKCylHkGpE/pvbou8Aaj:a3mmCm6Ud+z7X/PaEboKCuNevbo
Malware Config
Extracted
xloader
2.3
q4kr
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
bodymoisturizer.online
Signatures
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
resource yara_rule behavioral2/memory/2252-8-0x0000000003370000-0x0000000003382000-memory.dmp CustAttr -
Xloader payload 4 IoCs
resource yara_rule behavioral2/memory/2168-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2168-18-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4824-24-0x0000000000C50000-0x0000000000C79000-memory.dmp xloader behavioral2/memory/4824-26-0x0000000000C50000-0x0000000000C79000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2252 set thread context of 2168 2252 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 102 PID 2168 set thread context of 3488 2168 RegSvcs.exe 26 PID 4824 set thread context of 3488 4824 rundll32.exe 26 -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 2252 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 2252 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 2168 RegSvcs.exe 2168 RegSvcs.exe 2168 RegSvcs.exe 2168 RegSvcs.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe 4824 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2168 RegSvcs.exe 2168 RegSvcs.exe 2168 RegSvcs.exe 4824 rundll32.exe 4824 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2252 0e2f9d545ac87b4e9762ca50e2bf15ab.exe Token: SeDebugPrivilege 2168 RegSvcs.exe Token: SeDebugPrivilege 4824 rundll32.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3488 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2168 2252 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 102 PID 2252 wrote to memory of 2168 2252 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 102 PID 2252 wrote to memory of 2168 2252 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 102 PID 2252 wrote to memory of 2168 2252 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 102 PID 2252 wrote to memory of 2168 2252 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 102 PID 2252 wrote to memory of 2168 2252 0e2f9d545ac87b4e9762ca50e2bf15ab.exe 102 PID 3488 wrote to memory of 4824 3488 Explorer.EXE 103 PID 3488 wrote to memory of 4824 3488 Explorer.EXE 103 PID 3488 wrote to memory of 4824 3488 Explorer.EXE 103 PID 4824 wrote to memory of 2344 4824 rundll32.exe 105 PID 4824 wrote to memory of 2344 4824 rundll32.exe 105 PID 4824 wrote to memory of 2344 4824 rundll32.exe 105
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\0e2f9d545ac87b4e9762ca50e2bf15ab.exe"C:\Users\Admin\AppData\Local\Temp\0e2f9d545ac87b4e9762ca50e2bf15ab.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2168
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵PID:2344
-
-