Analysis
-
max time kernel
153s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
31-03-2024 22:47
Static task
static1
Behavioral task
behavioral1
Sample
czOxHskgIAQwZ8m.exe
Resource
win7-20240221-en
General
-
Target
czOxHskgIAQwZ8m.exe
-
Size
425KB
-
MD5
edb54a30972b862cfba8589bb1f67c7e
-
SHA1
7f3b9b36342bb863950e592063db38cd2c3f8bb9
-
SHA256
856b8775a8063900378a815cd03d0f9628c4296eddd93ac9e9cd52269178c079
-
SHA512
51f1e192a0f06472c5bf3da68e511d1112dd61a8a429aeb14c39e3d8e05b0448b5086d4367a2953b3dbbaa453faac63aa4319127aa9944e68334322cc6bc8f42
-
SSDEEP
12288:S0SrZ2vE4MtuTN6GLMX3a9sO81joauMuB3fj:Sf2vE9tuPgHa2O8hoauMuB
Malware Config
Extracted
xloader
2.5
amb4
ameerkabob.com
wenzhikeji.online
ktnsoil.xyz
dock7rods.com
simbaimmigration.com
tanahvilamalino.online
amaozn-co-jp.xyz
atahukukbafra.com
attruth.net
jigservices.net
310indianway.com
freelotto.online
mylanding-page.com
dudemealprep.com
wellmaintainedhealth.com
vitemonprenom.com
laurynfauntroy.com
pilotmom.info
arpatientsapp.com
sendangdigital.com
supportkey.xyz
freshoffthefire.com
pokorny.industries
abdullahbinfalajstore.com
waterhammerstudios.com
hellocs.xyz
sdsshy.com
eid.paris
zhuoyu168.com
merchantsimplicity.net
evasiebenhaar.com
mlnettoayage.com
snorecareclinic.com
sequimapartment.com
egmetaverse.com
costalitaestepona2d.com
foxwodds.com
tasteofstraddie.com
jutaiminer.com
heavyverse.com
webuycodes.com
humanassetcapital.info
experienceanewromantic.com
fellasies.com
immsyvisuals.com
taiwanlongyu.com
04mpt.xyz
buck100.com
nevenieiker.quest
villagestreetwear.com
emeraldcoastmcdonalds.com
nomanproject.xyz
798791.com
megmonroe.com
agreeablebeauty.com
captainscookcasino.com
nlbydcg.xyz
appcast-65.com
lowesoneroofmedianetwork.us
franksmaintenanceplusllc.net
cesmedeyatkirala.com
kuzeykibrissatilik.com
cryptorickclub.art
alexiscomputers.com
shopmew.com
Signatures
-
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2504-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2504-17-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2504-21-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/796-27-0x0000000000080000-0x00000000000A9000-memory.dmp xloader behavioral1/memory/796-29-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1164 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
czOxHskgIAQwZ8m.execzOxHskgIAQwZ8m.exewlanext.exedescription pid process target process PID 2836 set thread context of 2504 2836 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 2504 set thread context of 1380 2504 czOxHskgIAQwZ8m.exe Explorer.EXE PID 2504 set thread context of 1380 2504 czOxHskgIAQwZ8m.exe Explorer.EXE PID 796 set thread context of 1380 796 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
czOxHskgIAQwZ8m.execzOxHskgIAQwZ8m.exewlanext.exepid process 2836 czOxHskgIAQwZ8m.exe 2836 czOxHskgIAQwZ8m.exe 2836 czOxHskgIAQwZ8m.exe 2836 czOxHskgIAQwZ8m.exe 2836 czOxHskgIAQwZ8m.exe 2836 czOxHskgIAQwZ8m.exe 2836 czOxHskgIAQwZ8m.exe 2504 czOxHskgIAQwZ8m.exe 2504 czOxHskgIAQwZ8m.exe 2504 czOxHskgIAQwZ8m.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe 796 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
czOxHskgIAQwZ8m.exewlanext.exepid process 2504 czOxHskgIAQwZ8m.exe 2504 czOxHskgIAQwZ8m.exe 2504 czOxHskgIAQwZ8m.exe 2504 czOxHskgIAQwZ8m.exe 796 wlanext.exe 796 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
czOxHskgIAQwZ8m.execzOxHskgIAQwZ8m.exewlanext.exedescription pid process Token: SeDebugPrivilege 2836 czOxHskgIAQwZ8m.exe Token: SeDebugPrivilege 2504 czOxHskgIAQwZ8m.exe Token: SeDebugPrivilege 796 wlanext.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
czOxHskgIAQwZ8m.exeExplorer.EXEwlanext.exedescription pid process target process PID 2836 wrote to memory of 2504 2836 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 2836 wrote to memory of 2504 2836 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 2836 wrote to memory of 2504 2836 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 2836 wrote to memory of 2504 2836 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 2836 wrote to memory of 2504 2836 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 2836 wrote to memory of 2504 2836 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 2836 wrote to memory of 2504 2836 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 1380 wrote to memory of 796 1380 Explorer.EXE wlanext.exe PID 1380 wrote to memory of 796 1380 Explorer.EXE wlanext.exe PID 1380 wrote to memory of 796 1380 Explorer.EXE wlanext.exe PID 1380 wrote to memory of 796 1380 Explorer.EXE wlanext.exe PID 796 wrote to memory of 1164 796 wlanext.exe cmd.exe PID 796 wrote to memory of 1164 796 wlanext.exe cmd.exe PID 796 wrote to memory of 1164 796 wlanext.exe cmd.exe PID 796 wrote to memory of 1164 796 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2504 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"3⤵
- Deletes itself
PID:1164