Analysis
-
max time kernel
147s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 06:30
Static task
static1
Behavioral task
behavioral1
Sample
PO_0008.exe
Resource
win7-20231215-en
General
-
Target
PO_0008.exe
-
Size
679KB
-
MD5
113286f80f81317488aa39f931bde38f
-
SHA1
e6c32240a28d90156493dd84360e083f0899ce36
-
SHA256
25a0902b3158cd4c095c68e6f549d8a8f26415037bf234c17b052fa70574caf3
-
SHA512
26007e3e7c671f24910b2734c49ac3b99ce19b62c4e2b6a309901189d8f7520dc5e0f070857c1979b3584bb2c4b351043a910b9010e60c9104fd38233b5e63be
-
SSDEEP
12288:SKqJZ4sLu1XsqA+aYX9fy+bVTuCv4xFlkyDZ6U+:T6ZhLuWqA5MLQxbdB+
Malware Config
Extracted
xloader
2.3
usvr
theblockmeatstore.com
drone-moment.com
srsfashionbd.com
kylayagerartwork.com
instagrams.tools
rosenwealth.com
indicraftsvilla.com
rswizard.com
irist.one
pubgclaimx14.com
thegeorgiahomefinder.com
unusualdog.com
kifayatikart.com
methodunit.net
bavarian-luxury.com
17391000.com
ipcsaveday.com
yael-b.com
pasionqueconecta.com
youngsvideography.com
absorbscratch.icu
nzrugbylife.info
inabellesolutions.com
applesoso.com
soshop365.com
viewmydiary.com
onemillionrosary.com
erotickykontakt.com
xn--yfr994dchc.net
quiltedpicturebooks.com
monteiromarquesadv.com
anugrahdayakencana.com
jz-fh.com
beijingjiadu.com
qdwentang.com
shandasden.com
xn--bckb2ercf4fxgsa3e.xyz
ecozoca.com
spiritsvest.com
pigsflycheap.com
onenationunderbread.com
bunganutlakecampingarea.com
deltafinancialgroup.net
glamsocialevents.com
sportzdestinations.com
memento-lagoon.com
nuvo-condos.com
urteiki.com
negociosconjuanceri.com
finescocms.com
simposiocpa.com
topelk.com
duetoboias.com
priormakers.net
impossibilitee.com
zombiguitar.com
conseilaffaires.com
ecrires.xyz
magetu.info
miracle-tone.com
quranvisor.com
thebabytemplate.com
wcarrillo.com
wallstmotorsports.com
microprojects.net
Signatures
-
Xloader payload 4 IoCs
resource yara_rule behavioral1/memory/2836-3-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2836-6-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2776-12-0x0000000000070000-0x0000000000098000-memory.dmp xloader behavioral1/memory/2776-15-0x0000000000070000-0x0000000000098000-memory.dmp xloader -
Deletes itself 1 IoCs
pid Process 2696 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2656 set thread context of 2836 2656 PO_0008.exe 17 PID 2836 set thread context of 1192 2836 PO_0008.exe 12 PID 2776 set thread context of 1192 2776 cscript.exe 12 -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2836 PO_0008.exe 2836 PO_0008.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe 2776 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2656 PO_0008.exe 2836 PO_0008.exe 2836 PO_0008.exe 2836 PO_0008.exe 2776 cscript.exe 2776 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2836 PO_0008.exe Token: SeDebugPrivilege 2776 cscript.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2656 wrote to memory of 2836 2656 PO_0008.exe 17 PID 2656 wrote to memory of 2836 2656 PO_0008.exe 17 PID 2656 wrote to memory of 2836 2656 PO_0008.exe 17 PID 2656 wrote to memory of 2836 2656 PO_0008.exe 17 PID 2656 wrote to memory of 2836 2656 PO_0008.exe 17 PID 1192 wrote to memory of 2776 1192 Explorer.EXE 29 PID 1192 wrote to memory of 2776 1192 Explorer.EXE 29 PID 1192 wrote to memory of 2776 1192 Explorer.EXE 29 PID 1192 wrote to memory of 2776 1192 Explorer.EXE 29 PID 2776 wrote to memory of 2696 2776 cscript.exe 31 PID 2776 wrote to memory of 2696 2776 cscript.exe 31 PID 2776 wrote to memory of 2696 2776 cscript.exe 31 PID 2776 wrote to memory of 2696 2776 cscript.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\PO_0008.exe"C:\Users\Admin\AppData\Local\Temp\PO_0008.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\PO_0008.exe"C:\Users\Admin\AppData\Local\Temp\PO_0008.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO_0008.exe"3⤵
- Deletes itself
PID:2696
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:2760
-