Analysis
-
max time kernel
146s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08-03-2024 02:00
Static task
static1
Behavioral task
behavioral1
Sample
ba3c72780f80542fe09aeed80a9a56c6.exe
Resource
win7-20240221-en
General
-
Target
ba3c72780f80542fe09aeed80a9a56c6.exe
-
Size
489KB
-
MD5
ba3c72780f80542fe09aeed80a9a56c6
-
SHA1
22bc724884cf52efe4c596bcd8ffdd155c783238
-
SHA256
c840ee368fcab5974485c16fc456b1dc1923cc5e113ce6a96f6f314a7ec5ac94
-
SHA512
a66602343d24dff4330551b900644ece8fe62059a88327ddac99fb0bc625a7eb3cfa6f3697beed4a0ec9f2f1f227f42dd4e36c43470cf4c71d38b6ad07ee15fd
-
SSDEEP
6144:nnBvlIlWuTpGUMgc8cNPD/t1owJ/ag1iTOEdo29hwgy537GjqsfThJS8MHoAeTRk:nOWNUMFNbt7ag1jAhwgySLhDMHoF1k
Malware Config
Extracted
xloader
2.3
t75f
onegolfsydney.com
kaizensportscoaching.com
mliacbjv.icu
rinstech.net
midas-parts.com
istmenian.com
ibrahimpike.com
herbspaces.com
gentleman4higher.com
workabusiness.com
isabusive.website
222555dy.com
lwhyzhzb.xyz
gabrielabravoillanes.com
hearthomelife.com
buildswealth.com
printitaz.com
l-mventures.com
baincot3.com
nstaq-labs.com
wikendi.com
newyears21.com
citestaccnt1597730671.com
thecuriousincidentwes.com
alchembiopro.com
stardustanimations.com
ssgasiaw.com
sarajanesstudio.com
whitepointfineart.com
dlglawtx.com
doudiangroup.com
jackpod.team
abvoltprunus.bid
miimamablog.com
selfbuildwithmannok.com
thanhxuan99.online
germantos.com
waterdoor.net
wmscloud.net
services-24hras.com
maneadvisors.com
mosineetowing.com
blockdelightsmart.com
booyaka.design
brewery-run.com
dexteroushandmade.com
minhamochila.com
drawingwoo.com
thesalcombefurniturecompany.net
nashautoglass.com
beenationgear.com
cleanseforlifewellness.com
corecounselingcenter.info
naturalcreativesociety.com
sarcontraders.com
lickitbuddyrehab.com
theweekendrecap.com
cetiya-veluvana.com
w7asd.net
nyctophilia.net
asialion.net
goldentreegrp.com
jacobuspark.com
punchingforce.com
vertexnailsblaine.com
Signatures
-
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2760-14-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2760-18-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2608-24-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader behavioral1/memory/2608-26-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ba3c72780f80542fe09aeed80a9a56c6.exeRegSvcs.exechkdsk.exedescription pid process target process PID 2244 set thread context of 2760 2244 ba3c72780f80542fe09aeed80a9a56c6.exe RegSvcs.exe PID 2760 set thread context of 1208 2760 RegSvcs.exe Explorer.EXE PID 2608 set thread context of 1208 2608 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
ba3c72780f80542fe09aeed80a9a56c6.exeRegSvcs.exechkdsk.exepid process 2244 ba3c72780f80542fe09aeed80a9a56c6.exe 2244 ba3c72780f80542fe09aeed80a9a56c6.exe 2760 RegSvcs.exe 2760 RegSvcs.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe 2608 chkdsk.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exechkdsk.exepid process 2760 RegSvcs.exe 2760 RegSvcs.exe 2760 RegSvcs.exe 2608 chkdsk.exe 2608 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
ba3c72780f80542fe09aeed80a9a56c6.exeRegSvcs.exechkdsk.exedescription pid process Token: SeDebugPrivilege 2244 ba3c72780f80542fe09aeed80a9a56c6.exe Token: SeDebugPrivilege 2760 RegSvcs.exe Token: SeDebugPrivilege 2608 chkdsk.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
ba3c72780f80542fe09aeed80a9a56c6.exeExplorer.EXEchkdsk.exedescription pid process target process PID 2244 wrote to memory of 2760 2244 ba3c72780f80542fe09aeed80a9a56c6.exe RegSvcs.exe PID 2244 wrote to memory of 2760 2244 ba3c72780f80542fe09aeed80a9a56c6.exe RegSvcs.exe PID 2244 wrote to memory of 2760 2244 ba3c72780f80542fe09aeed80a9a56c6.exe RegSvcs.exe PID 2244 wrote to memory of 2760 2244 ba3c72780f80542fe09aeed80a9a56c6.exe RegSvcs.exe PID 2244 wrote to memory of 2760 2244 ba3c72780f80542fe09aeed80a9a56c6.exe RegSvcs.exe PID 2244 wrote to memory of 2760 2244 ba3c72780f80542fe09aeed80a9a56c6.exe RegSvcs.exe PID 2244 wrote to memory of 2760 2244 ba3c72780f80542fe09aeed80a9a56c6.exe RegSvcs.exe PID 2244 wrote to memory of 2760 2244 ba3c72780f80542fe09aeed80a9a56c6.exe RegSvcs.exe PID 2244 wrote to memory of 2760 2244 ba3c72780f80542fe09aeed80a9a56c6.exe RegSvcs.exe PID 2244 wrote to memory of 2760 2244 ba3c72780f80542fe09aeed80a9a56c6.exe RegSvcs.exe PID 1208 wrote to memory of 2608 1208 Explorer.EXE chkdsk.exe PID 1208 wrote to memory of 2608 1208 Explorer.EXE chkdsk.exe PID 1208 wrote to memory of 2608 1208 Explorer.EXE chkdsk.exe PID 1208 wrote to memory of 2608 1208 Explorer.EXE chkdsk.exe PID 2608 wrote to memory of 1656 2608 chkdsk.exe cmd.exe PID 2608 wrote to memory of 1656 2608 chkdsk.exe cmd.exe PID 2608 wrote to memory of 1656 2608 chkdsk.exe cmd.exe PID 2608 wrote to memory of 1656 2608 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ba3c72780f80542fe09aeed80a9a56c6.exe"C:\Users\Admin\AppData\Local\Temp\ba3c72780f80542fe09aeed80a9a56c6.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1208-19-0x0000000000210000-0x0000000000310000-memory.dmpFilesize
1024KB
-
memory/1208-30-0x0000000006C10000-0x0000000006D25000-memory.dmpFilesize
1.1MB
-
memory/1208-21-0x0000000006C10000-0x0000000006D25000-memory.dmpFilesize
1.1MB
-
memory/2244-15-0x0000000074B40000-0x000000007522E000-memory.dmpFilesize
6.9MB
-
memory/2244-0-0x00000000012A0000-0x0000000001320000-memory.dmpFilesize
512KB
-
memory/2244-5-0x0000000001080000-0x00000000010C0000-memory.dmpFilesize
256KB
-
memory/2244-6-0x0000000004FB0000-0x0000000005014000-memory.dmpFilesize
400KB
-
memory/2244-7-0x0000000000A20000-0x0000000000A4E000-memory.dmpFilesize
184KB
-
memory/2244-1-0x0000000074B40000-0x000000007522E000-memory.dmpFilesize
6.9MB
-
memory/2244-4-0x0000000074B40000-0x000000007522E000-memory.dmpFilesize
6.9MB
-
memory/2244-2-0x0000000001080000-0x00000000010C0000-memory.dmpFilesize
256KB
-
memory/2244-3-0x0000000000680000-0x000000000069C000-memory.dmpFilesize
112KB
-
memory/2608-23-0x0000000000E40000-0x0000000000E47000-memory.dmpFilesize
28KB
-
memory/2608-22-0x0000000000E40000-0x0000000000E47000-memory.dmpFilesize
28KB
-
memory/2608-24-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/2608-25-0x00000000023E0000-0x00000000026E3000-memory.dmpFilesize
3.0MB
-
memory/2608-26-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/2608-28-0x0000000000D20000-0x0000000000DAF000-memory.dmpFilesize
572KB
-
memory/2760-16-0x0000000000B90000-0x0000000000E93000-memory.dmpFilesize
3.0MB
-
memory/2760-14-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2760-20-0x00000000001B0000-0x00000000001C0000-memory.dmpFilesize
64KB
-
memory/2760-18-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2760-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2760-10-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2760-8-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB