Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2024 22:47
Static task
static1
Behavioral task
behavioral1
Sample
czOxHskgIAQwZ8m.exe
Resource
win7-20240221-en
General
-
Target
czOxHskgIAQwZ8m.exe
-
Size
425KB
-
MD5
edb54a30972b862cfba8589bb1f67c7e
-
SHA1
7f3b9b36342bb863950e592063db38cd2c3f8bb9
-
SHA256
856b8775a8063900378a815cd03d0f9628c4296eddd93ac9e9cd52269178c079
-
SHA512
51f1e192a0f06472c5bf3da68e511d1112dd61a8a429aeb14c39e3d8e05b0448b5086d4367a2953b3dbbaa453faac63aa4319127aa9944e68334322cc6bc8f42
-
SSDEEP
12288:S0SrZ2vE4MtuTN6GLMX3a9sO81joauMuB3fj:Sf2vE9tuPgHa2O8hoauMuB
Malware Config
Extracted
xloader
2.5
amb4
ameerkabob.com
wenzhikeji.online
ktnsoil.xyz
dock7rods.com
simbaimmigration.com
tanahvilamalino.online
amaozn-co-jp.xyz
atahukukbafra.com
attruth.net
jigservices.net
310indianway.com
freelotto.online
mylanding-page.com
dudemealprep.com
wellmaintainedhealth.com
vitemonprenom.com
laurynfauntroy.com
pilotmom.info
arpatientsapp.com
sendangdigital.com
supportkey.xyz
freshoffthefire.com
pokorny.industries
abdullahbinfalajstore.com
waterhammerstudios.com
hellocs.xyz
sdsshy.com
eid.paris
zhuoyu168.com
merchantsimplicity.net
evasiebenhaar.com
mlnettoayage.com
snorecareclinic.com
sequimapartment.com
egmetaverse.com
costalitaestepona2d.com
foxwodds.com
tasteofstraddie.com
jutaiminer.com
heavyverse.com
webuycodes.com
humanassetcapital.info
experienceanewromantic.com
fellasies.com
immsyvisuals.com
taiwanlongyu.com
04mpt.xyz
buck100.com
nevenieiker.quest
villagestreetwear.com
emeraldcoastmcdonalds.com
nomanproject.xyz
798791.com
megmonroe.com
agreeablebeauty.com
captainscookcasino.com
nlbydcg.xyz
appcast-65.com
lowesoneroofmedianetwork.us
franksmaintenanceplusllc.net
cesmedeyatkirala.com
kuzeykibrissatilik.com
cryptorickclub.art
alexiscomputers.com
shopmew.com
Signatures
-
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/2172-11-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2172-16-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2172-20-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3872-26-0x0000000000F50000-0x0000000000F79000-memory.dmp xloader behavioral2/memory/3872-28-0x0000000000F50000-0x0000000000F79000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
czOxHskgIAQwZ8m.execzOxHskgIAQwZ8m.exerundll32.exedescription pid process target process PID 3312 set thread context of 2172 3312 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 2172 set thread context of 3476 2172 czOxHskgIAQwZ8m.exe Explorer.EXE PID 2172 set thread context of 3476 2172 czOxHskgIAQwZ8m.exe Explorer.EXE PID 3872 set thread context of 3476 3872 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
czOxHskgIAQwZ8m.execzOxHskgIAQwZ8m.exerundll32.exepid process 3312 czOxHskgIAQwZ8m.exe 3312 czOxHskgIAQwZ8m.exe 3312 czOxHskgIAQwZ8m.exe 3312 czOxHskgIAQwZ8m.exe 3312 czOxHskgIAQwZ8m.exe 3312 czOxHskgIAQwZ8m.exe 2172 czOxHskgIAQwZ8m.exe 2172 czOxHskgIAQwZ8m.exe 2172 czOxHskgIAQwZ8m.exe 2172 czOxHskgIAQwZ8m.exe 2172 czOxHskgIAQwZ8m.exe 2172 czOxHskgIAQwZ8m.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe 3872 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
czOxHskgIAQwZ8m.exerundll32.exepid process 2172 czOxHskgIAQwZ8m.exe 2172 czOxHskgIAQwZ8m.exe 2172 czOxHskgIAQwZ8m.exe 2172 czOxHskgIAQwZ8m.exe 3872 rundll32.exe 3872 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
czOxHskgIAQwZ8m.execzOxHskgIAQwZ8m.exerundll32.exedescription pid process Token: SeDebugPrivilege 3312 czOxHskgIAQwZ8m.exe Token: SeDebugPrivilege 2172 czOxHskgIAQwZ8m.exe Token: SeDebugPrivilege 3872 rundll32.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3476 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
czOxHskgIAQwZ8m.exeExplorer.EXErundll32.exedescription pid process target process PID 3312 wrote to memory of 2172 3312 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 3312 wrote to memory of 2172 3312 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 3312 wrote to memory of 2172 3312 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 3312 wrote to memory of 2172 3312 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 3312 wrote to memory of 2172 3312 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 3312 wrote to memory of 2172 3312 czOxHskgIAQwZ8m.exe czOxHskgIAQwZ8m.exe PID 3476 wrote to memory of 3872 3476 Explorer.EXE rundll32.exe PID 3476 wrote to memory of 3872 3476 Explorer.EXE rundll32.exe PID 3476 wrote to memory of 3872 3476 Explorer.EXE rundll32.exe PID 3872 wrote to memory of 4488 3872 rundll32.exe cmd.exe PID 3872 wrote to memory of 4488 3872 rundll32.exe cmd.exe PID 3872 wrote to memory of 4488 3872 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2172 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\czOxHskgIAQwZ8m.exe"3⤵PID:4488