Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2024 15:32
Static task
static1
Behavioral task
behavioral1
Sample
7a9cf63d76a9013b241c538061e457e3.exe
Resource
win7-20231129-en
General
-
Target
7a9cf63d76a9013b241c538061e457e3.exe
-
Size
603KB
-
MD5
7a9cf63d76a9013b241c538061e457e3
-
SHA1
f694dec9c2b83cb06887d7996031e69b748af9eb
-
SHA256
28c67cdcd4523ca934a1b72c6c8f5ed39874b6b8f66e3f679cb1095f859f6e83
-
SHA512
822424d5ddd757cfc07b4cc99f8500f2f37884bb594e89b96bab63b6ada87c9105e8dfc500973b2c3c02354642d647a6d3be14b5fd1033ec1f513fed3ec16b02
-
SSDEEP
12288:DE4qEJBJnO/F1l1+51DvL9YG3Gp0uyGwYvVPwD3GJDPdvaVMA:FJnO/3L+5RJypDm2JdvaeA
Malware Config
Extracted
xloader
2.3
n58i
nl-cafe.com
votetedjaleta.com
britrobertsrealtor.com
globipark.com
citysucces.com
verisignwebsite-verified.com
riddlepc.com
rosecityclimbing.com
oleandrinextract.com
salmankonstruksi.com
needhamchannel.com
refreshx2z.com
youth66.com
pla-russia.com
halloweenmaskpro.com
exdysis.com
1gcz.com
lookgoodman.com
rlxagva.com
stlcityc.com
writingleagues.com
biodunandewaoluwa.com
whitepetalsboutiques.com
idirtivio.com
ministerioslodj.com
bachelors.win
floortak.co.uk
naturaldogseltzer.com
hypermediarus.online
grandrapidsvirtualboatshow.com
usabrokersgroup.net
marketlala.com
5923599.com
oldhousechicago.com
crucial.company
chickaboom.net
fashionelixirs.com
robertstevensonphotography.com
goddessruby.com
hostings.company
freeganyachtclub.com
shierxing.com
sfca01.com
ahhtcd.com
yournumberoneteam.com
w88linklogin.com
worldchampsfootball.club
arcadems.com
rutroms.club
oxfordholidaycottage.com
science-laboratory.info
wecarefamilyphysicians.com
cdaaesthetics.com
defyesthetics.com
haselwoodvwevents.com
promoterss.com
gromov-plc.com
themaximogroup.com
litlidin.com
guangheng-sh.com
cashcowlending.com
foxelpie.com
bppublicschool.com
terapiademuerdago.com
mack3sleeve.com
Signatures
-
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4740-11-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4740-16-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1308-21-0x0000000000B70000-0x0000000000B99000-memory.dmp xloader behavioral2/memory/1308-23-0x0000000000B70000-0x0000000000B99000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
7a9cf63d76a9013b241c538061e457e3.exeRegSvcs.exeNETSTAT.EXEdescription pid process target process PID 2116 set thread context of 4740 2116 7a9cf63d76a9013b241c538061e457e3.exe RegSvcs.exe PID 4740 set thread context of 3392 4740 RegSvcs.exe Explorer.EXE PID 1308 set thread context of 3392 1308 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1308 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
7a9cf63d76a9013b241c538061e457e3.exeRegSvcs.exeNETSTAT.EXEpid process 2116 7a9cf63d76a9013b241c538061e457e3.exe 2116 7a9cf63d76a9013b241c538061e457e3.exe 4740 RegSvcs.exe 4740 RegSvcs.exe 4740 RegSvcs.exe 4740 RegSvcs.exe 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE 1308 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeNETSTAT.EXEpid process 4740 RegSvcs.exe 4740 RegSvcs.exe 4740 RegSvcs.exe 1308 NETSTAT.EXE 1308 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
7a9cf63d76a9013b241c538061e457e3.exeRegSvcs.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 2116 7a9cf63d76a9013b241c538061e457e3.exe Token: SeDebugPrivilege 4740 RegSvcs.exe Token: SeDebugPrivilege 1308 NETSTAT.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3392 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
7a9cf63d76a9013b241c538061e457e3.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 2116 wrote to memory of 4740 2116 7a9cf63d76a9013b241c538061e457e3.exe RegSvcs.exe PID 2116 wrote to memory of 4740 2116 7a9cf63d76a9013b241c538061e457e3.exe RegSvcs.exe PID 2116 wrote to memory of 4740 2116 7a9cf63d76a9013b241c538061e457e3.exe RegSvcs.exe PID 2116 wrote to memory of 4740 2116 7a9cf63d76a9013b241c538061e457e3.exe RegSvcs.exe PID 2116 wrote to memory of 4740 2116 7a9cf63d76a9013b241c538061e457e3.exe RegSvcs.exe PID 2116 wrote to memory of 4740 2116 7a9cf63d76a9013b241c538061e457e3.exe RegSvcs.exe PID 3392 wrote to memory of 1308 3392 Explorer.EXE NETSTAT.EXE PID 3392 wrote to memory of 1308 3392 Explorer.EXE NETSTAT.EXE PID 3392 wrote to memory of 1308 3392 Explorer.EXE NETSTAT.EXE PID 1308 wrote to memory of 1532 1308 NETSTAT.EXE cmd.exe PID 1308 wrote to memory of 1532 1308 NETSTAT.EXE cmd.exe PID 1308 wrote to memory of 1532 1308 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7a9cf63d76a9013b241c538061e457e3.exe"C:\Users\Admin\AppData\Local\Temp\7a9cf63d76a9013b241c538061e457e3.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1308-19-0x00000000008F0000-0x00000000008FB000-memory.dmpFilesize
44KB
-
memory/1308-24-0x0000000001390000-0x0000000001420000-memory.dmpFilesize
576KB
-
memory/1308-23-0x0000000000B70000-0x0000000000B99000-memory.dmpFilesize
164KB
-
memory/1308-22-0x0000000001560000-0x00000000018AA000-memory.dmpFilesize
3.3MB
-
memory/1308-20-0x00000000008F0000-0x00000000008FB000-memory.dmpFilesize
44KB
-
memory/1308-21-0x0000000000B70000-0x0000000000B99000-memory.dmpFilesize
164KB
-
memory/2116-6-0x0000000005350000-0x00000000053EC000-memory.dmpFilesize
624KB
-
memory/2116-0-0x00000000005F0000-0x000000000068C000-memory.dmpFilesize
624KB
-
memory/2116-8-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/2116-9-0x0000000006010000-0x0000000006078000-memory.dmpFilesize
416KB
-
memory/2116-10-0x0000000008540000-0x0000000008572000-memory.dmpFilesize
200KB
-
memory/2116-1-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/2116-13-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/2116-2-0x0000000005070000-0x0000000005080000-memory.dmpFilesize
64KB
-
memory/2116-3-0x0000000005210000-0x00000000052A2000-memory.dmpFilesize
584KB
-
memory/2116-4-0x0000000005860000-0x0000000005E04000-memory.dmpFilesize
5.6MB
-
memory/2116-5-0x00000000051D0000-0x00000000051EC000-memory.dmpFilesize
112KB
-
memory/2116-7-0x0000000074650000-0x0000000074E00000-memory.dmpFilesize
7.7MB
-
memory/3392-18-0x00000000085E0000-0x000000000875D000-memory.dmpFilesize
1.5MB
-
memory/3392-26-0x00000000085E0000-0x000000000875D000-memory.dmpFilesize
1.5MB
-
memory/3392-29-0x0000000008F30000-0x0000000009058000-memory.dmpFilesize
1.2MB
-
memory/3392-30-0x0000000008F30000-0x0000000009058000-memory.dmpFilesize
1.2MB
-
memory/3392-33-0x0000000008F30000-0x0000000009058000-memory.dmpFilesize
1.2MB
-
memory/4740-16-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4740-17-0x0000000001430000-0x0000000001441000-memory.dmpFilesize
68KB
-
memory/4740-14-0x0000000001500000-0x000000000184A000-memory.dmpFilesize
3.3MB
-
memory/4740-11-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB