Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2024 15:42
Static task
static1
Behavioral task
behavioral1
Sample
de5ca69a7939c4a8ce6846463990aa7b.exe
Resource
win7-20240221-en
General
-
Target
de5ca69a7939c4a8ce6846463990aa7b.exe
-
Size
723KB
-
MD5
de5ca69a7939c4a8ce6846463990aa7b
-
SHA1
358c3f58194ccc713f000e194024b817f6cb5320
-
SHA256
5bc9d0c8fd02f1c138178b1291378304a653717076f9e12ba4334609dcf7b11c
-
SHA512
827bb09597d0226e27e2740886993593d7565d1bb5d130ee46bd87c6663f1cb60ac369a3272675fad8c8d8789e3b6aaf822ef13bcdf89cf821830ce795a7f7c6
-
SSDEEP
12288:PxTEgx9h1GicKzIfOJtHQgXSFJJucyM/+IQVQCU20v9X4g8p9U7hZePuxQJPmEqw:qoL1GhIIfQV1SzyM2IQinD9XF
Malware Config
Extracted
xloader
2.3
t75f
onegolfsydney.com
kaizensportscoaching.com
mliacbjv.icu
rinstech.net
midas-parts.com
istmenian.com
ibrahimpike.com
herbspaces.com
gentleman4higher.com
workabusiness.com
isabusive.website
222555dy.com
lwhyzhzb.xyz
gabrielabravoillanes.com
hearthomelife.com
buildswealth.com
printitaz.com
l-mventures.com
baincot3.com
nstaq-labs.com
wikendi.com
newyears21.com
citestaccnt1597730671.com
thecuriousincidentwes.com
alchembiopro.com
stardustanimations.com
ssgasiaw.com
sarajanesstudio.com
whitepointfineart.com
dlglawtx.com
doudiangroup.com
jackpod.team
abvoltprunus.bid
miimamablog.com
selfbuildwithmannok.com
thanhxuan99.online
germantos.com
waterdoor.net
wmscloud.net
services-24hras.com
maneadvisors.com
mosineetowing.com
blockdelightsmart.com
booyaka.design
brewery-run.com
dexteroushandmade.com
minhamochila.com
drawingwoo.com
thesalcombefurniturecompany.net
nashautoglass.com
beenationgear.com
cleanseforlifewellness.com
corecounselingcenter.info
naturalcreativesociety.com
sarcontraders.com
lickitbuddyrehab.com
theweekendrecap.com
cetiya-veluvana.com
w7asd.net
nyctophilia.net
asialion.net
goldentreegrp.com
jacobuspark.com
punchingforce.com
vertexnailsblaine.com
Signatures
-
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4436-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4436-17-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4908-23-0x0000000001060000-0x0000000001089000-memory.dmp xloader behavioral2/memory/4908-25-0x0000000001060000-0x0000000001089000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
de5ca69a7939c4a8ce6846463990aa7b.exeRegSvcs.exeraserver.exedescription pid process target process PID 772 set thread context of 4436 772 de5ca69a7939c4a8ce6846463990aa7b.exe RegSvcs.exe PID 4436 set thread context of 3504 4436 RegSvcs.exe Explorer.EXE PID 4908 set thread context of 3504 4908 raserver.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
de5ca69a7939c4a8ce6846463990aa7b.exeRegSvcs.exeraserver.exepid process 772 de5ca69a7939c4a8ce6846463990aa7b.exe 772 de5ca69a7939c4a8ce6846463990aa7b.exe 772 de5ca69a7939c4a8ce6846463990aa7b.exe 4436 RegSvcs.exe 4436 RegSvcs.exe 4436 RegSvcs.exe 4436 RegSvcs.exe 4436 RegSvcs.exe 4436 RegSvcs.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe 4908 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeraserver.exepid process 4436 RegSvcs.exe 4436 RegSvcs.exe 4436 RegSvcs.exe 4908 raserver.exe 4908 raserver.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
de5ca69a7939c4a8ce6846463990aa7b.exeRegSvcs.exeraserver.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 772 de5ca69a7939c4a8ce6846463990aa7b.exe Token: SeDebugPrivilege 4436 RegSvcs.exe Token: SeDebugPrivilege 4908 raserver.exe Token: SeShutdownPrivilege 3504 Explorer.EXE Token: SeCreatePagefilePrivilege 3504 Explorer.EXE Token: SeShutdownPrivilege 3504 Explorer.EXE Token: SeCreatePagefilePrivilege 3504 Explorer.EXE Token: SeShutdownPrivilege 3504 Explorer.EXE Token: SeCreatePagefilePrivilege 3504 Explorer.EXE Token: SeShutdownPrivilege 3504 Explorer.EXE Token: SeCreatePagefilePrivilege 3504 Explorer.EXE Token: SeShutdownPrivilege 3504 Explorer.EXE Token: SeCreatePagefilePrivilege 3504 Explorer.EXE Token: SeShutdownPrivilege 3504 Explorer.EXE Token: SeCreatePagefilePrivilege 3504 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3504 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
de5ca69a7939c4a8ce6846463990aa7b.exeExplorer.EXEraserver.exedescription pid process target process PID 772 wrote to memory of 4436 772 de5ca69a7939c4a8ce6846463990aa7b.exe RegSvcs.exe PID 772 wrote to memory of 4436 772 de5ca69a7939c4a8ce6846463990aa7b.exe RegSvcs.exe PID 772 wrote to memory of 4436 772 de5ca69a7939c4a8ce6846463990aa7b.exe RegSvcs.exe PID 772 wrote to memory of 4436 772 de5ca69a7939c4a8ce6846463990aa7b.exe RegSvcs.exe PID 772 wrote to memory of 4436 772 de5ca69a7939c4a8ce6846463990aa7b.exe RegSvcs.exe PID 772 wrote to memory of 4436 772 de5ca69a7939c4a8ce6846463990aa7b.exe RegSvcs.exe PID 3504 wrote to memory of 4908 3504 Explorer.EXE raserver.exe PID 3504 wrote to memory of 4908 3504 Explorer.EXE raserver.exe PID 3504 wrote to memory of 4908 3504 Explorer.EXE raserver.exe PID 4908 wrote to memory of 2736 4908 raserver.exe cmd.exe PID 4908 wrote to memory of 2736 4908 raserver.exe cmd.exe PID 4908 wrote to memory of 2736 4908 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\de5ca69a7939c4a8ce6846463990aa7b.exe"C:\Users\Admin\AppData\Local\Temp\de5ca69a7939c4a8ce6846463990aa7b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/772-8-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/772-2-0x00000000080B0000-0x0000000008654000-memory.dmpFilesize
5.6MB
-
memory/772-9-0x0000000007B30000-0x0000000007B40000-memory.dmpFilesize
64KB
-
memory/772-10-0x0000000009310000-0x0000000009376000-memory.dmpFilesize
408KB
-
memory/772-4-0x0000000007B30000-0x0000000007B40000-memory.dmpFilesize
64KB
-
memory/772-5-0x0000000007B90000-0x0000000007B9A000-memory.dmpFilesize
40KB
-
memory/772-6-0x0000000009270000-0x000000000930C000-memory.dmpFilesize
624KB
-
memory/772-7-0x0000000007DF0000-0x0000000007E0C000-memory.dmpFilesize
112KB
-
memory/772-0-0x0000000000BF0000-0x0000000000CAC000-memory.dmpFilesize
752KB
-
memory/772-1-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/772-3-0x0000000007BA0000-0x0000000007C32000-memory.dmpFilesize
584KB
-
memory/772-11-0x00000000050A0000-0x00000000050CE000-memory.dmpFilesize
184KB
-
memory/772-14-0x0000000075150000-0x0000000075900000-memory.dmpFilesize
7.7MB
-
memory/3504-34-0x0000000008E30000-0x0000000008F89000-memory.dmpFilesize
1.3MB
-
memory/3504-19-0x00000000033A0000-0x0000000003486000-memory.dmpFilesize
920KB
-
memory/3504-31-0x0000000008E30000-0x0000000008F89000-memory.dmpFilesize
1.3MB
-
memory/3504-30-0x0000000008E30000-0x0000000008F89000-memory.dmpFilesize
1.3MB
-
memory/3504-28-0x00000000033A0000-0x0000000003486000-memory.dmpFilesize
920KB
-
memory/4436-15-0x0000000001030000-0x000000000137A000-memory.dmpFilesize
3.3MB
-
memory/4436-18-0x0000000001020000-0x0000000001030000-memory.dmpFilesize
64KB
-
memory/4436-17-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4436-12-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4908-22-0x00000000005F0000-0x000000000060F000-memory.dmpFilesize
124KB
-
memory/4908-23-0x0000000001060000-0x0000000001089000-memory.dmpFilesize
164KB
-
memory/4908-24-0x0000000002F70000-0x00000000032BA000-memory.dmpFilesize
3.3MB
-
memory/4908-25-0x0000000001060000-0x0000000001089000-memory.dmpFilesize
164KB
-
memory/4908-27-0x0000000002E00000-0x0000000002E8F000-memory.dmpFilesize
572KB
-
memory/4908-20-0x00000000005F0000-0x000000000060F000-memory.dmpFilesize
124KB