Analysis
-
max time kernel
59s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 22:57
Static task
static1
Behavioral task
behavioral1
Sample
IMG_38575943.exe
Resource
win7-20240221-en
General
-
Target
IMG_38575943.exe
-
Size
341KB
-
MD5
2a11ef715093c4429cd05dc3950c7f89
-
SHA1
3199e3c72fc349d9cce951c2c8830d88a8da4454
-
SHA256
50df1fc76a41a970a44ac40efdd0113c599a7091891dc13c25e78abe52a97158
-
SHA512
24f2d7a608d421258334144217e97dccdeb023d5e621774f213eda210a8937df0c7d12cfd02e8c96d5951011d6142a320ca3b40bedb8ac6ad5f95ccc6d3d2d0a
-
SSDEEP
6144:HqPwmYdAbc0C3LFDDOQmjUi0GL9jDAlPMKpPbd6j62AeI4KR0VoFtDFF7g:HqPwmYdAbc0CboQmjIGN6Pzd6j6/eWtU
Malware Config
Extracted
xloader
2.5
c6si
tristateinc.construction
americanscaregroundstexas.com
kanimisoshiru.com
wihling.com
fishcheekstosa.com
parentsfuid.com
greenstandmarket.com
fc8fla8kzq.com
gametwist-83.club
jobsncvs.com
directrealtysells.com
avida2015.com
conceptasite.net
arkaneattire.com
indev-mobility.info
2160centurypark412.com
valefloor.com
septembership.com
stackflix.com
jimc0sales.net
socialviralup.com
lastra41.com
juliaepaulovaocasar.com
jurisagora.com
drawandgrow.online
rebekahlouise.com
herport-fr.com
iphone13.webcam
appz-one.net
inpost-pl.net
promocion360fitness.com
global-forbes.biz
diamondtrade.net
albertcantos.com
gtgits.com
travel-ai.online
busipe6.com
mualikesubvn.com
niftyhandy.com
docprops.com
lido88.bet
baywoodphotography.com
cargosouq.info
newsnowlive.online
floridafishingoverboard.com
missnikissalsa.net
walletvalidate.space
kissimmeeinternationalcup.com
charterhome.school
gurujupiter.com
entertainmentwitchy.com
jokeaou.com
sugarmountainfirearms.com
iss-sa.com
smittyssierra.com
freedomoff.com
giftoin.com
realitystararmwrestling.com
salsalunch-equallyage.com
ladouba.com
thepropertygoat.com
bestofmerrick.guide
4the.top
regioinversiones.com
129qihu.com
Signatures
-
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2532-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2532-17-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2532-22-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2780-30-0x0000000000080000-0x00000000000A9000-memory.dmp xloader behavioral1/memory/2780-32-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2396 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
IMG_38575943.exeIMG_38575943.exeNAPSTAT.EXEdescription pid process target process PID 1372 set thread context of 2532 1372 IMG_38575943.exe IMG_38575943.exe PID 2532 set thread context of 1260 2532 IMG_38575943.exe Explorer.EXE PID 2532 set thread context of 1260 2532 IMG_38575943.exe Explorer.EXE PID 2780 set thread context of 1260 2780 NAPSTAT.EXE Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
taskmgr.exeIMG_38575943.exeNAPSTAT.EXEpid process 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 2532 IMG_38575943.exe 2532 IMG_38575943.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 2532 IMG_38575943.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 2780 NAPSTAT.EXE 1224 taskmgr.exe 1224 taskmgr.exe 2780 NAPSTAT.EXE 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 1224 taskmgr.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
IMG_38575943.exeNAPSTAT.EXEpid process 2532 IMG_38575943.exe 2532 IMG_38575943.exe 2532 IMG_38575943.exe 2532 IMG_38575943.exe 2780 NAPSTAT.EXE 2780 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exeIMG_38575943.exeNAPSTAT.EXEdescription pid process Token: SeDebugPrivilege 1224 taskmgr.exe Token: SeDebugPrivilege 2532 IMG_38575943.exe Token: SeDebugPrivilege 2780 NAPSTAT.EXE -
Suspicious use of FindShellTrayWindow 40 IoCs
Processes:
taskmgr.exepid process 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe -
Suspicious use of SendNotifyMessage 39 IoCs
Processes:
taskmgr.exepid process 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe 1224 taskmgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
IMG_38575943.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 1372 wrote to memory of 2532 1372 IMG_38575943.exe IMG_38575943.exe PID 1372 wrote to memory of 2532 1372 IMG_38575943.exe IMG_38575943.exe PID 1372 wrote to memory of 2532 1372 IMG_38575943.exe IMG_38575943.exe PID 1372 wrote to memory of 2532 1372 IMG_38575943.exe IMG_38575943.exe PID 1372 wrote to memory of 2532 1372 IMG_38575943.exe IMG_38575943.exe PID 1372 wrote to memory of 2532 1372 IMG_38575943.exe IMG_38575943.exe PID 1372 wrote to memory of 2532 1372 IMG_38575943.exe IMG_38575943.exe PID 1260 wrote to memory of 2780 1260 Explorer.EXE NAPSTAT.EXE PID 1260 wrote to memory of 2780 1260 Explorer.EXE NAPSTAT.EXE PID 1260 wrote to memory of 2780 1260 Explorer.EXE NAPSTAT.EXE PID 1260 wrote to memory of 2780 1260 Explorer.EXE NAPSTAT.EXE PID 2780 wrote to memory of 2396 2780 NAPSTAT.EXE cmd.exe PID 2780 wrote to memory of 2396 2780 NAPSTAT.EXE cmd.exe PID 2780 wrote to memory of 2396 2780 NAPSTAT.EXE cmd.exe PID 2780 wrote to memory of 2396 2780 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IMG_38575943.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1224-25-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1224-26-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1224-6-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1224-7-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/1260-27-0x0000000007070000-0x000000000716C000-memory.dmpFilesize
1008KB
-
memory/1260-18-0x0000000003810000-0x0000000003910000-memory.dmpFilesize
1024KB
-
memory/1260-24-0x0000000006A30000-0x0000000006B38000-memory.dmpFilesize
1.0MB
-
memory/1260-20-0x0000000006A30000-0x0000000006B38000-memory.dmpFilesize
1.0MB
-
memory/1372-4-0x0000000074D70000-0x000000007545E000-memory.dmpFilesize
6.9MB
-
memory/1372-8-0x0000000005130000-0x000000000518E000-memory.dmpFilesize
376KB
-
memory/1372-5-0x0000000004B60000-0x0000000004BA0000-memory.dmpFilesize
256KB
-
memory/1372-3-0x00000000002F0000-0x00000000002FC000-memory.dmpFilesize
48KB
-
memory/1372-2-0x0000000004B60000-0x0000000004BA0000-memory.dmpFilesize
256KB
-
memory/1372-14-0x0000000074D70000-0x000000007545E000-memory.dmpFilesize
6.9MB
-
memory/1372-0-0x0000000000850000-0x00000000008AC000-memory.dmpFilesize
368KB
-
memory/1372-1-0x0000000074D70000-0x000000007545E000-memory.dmpFilesize
6.9MB
-
memory/2532-15-0x0000000000B40000-0x0000000000E43000-memory.dmpFilesize
3.0MB
-
memory/2532-17-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2532-19-0x0000000000140000-0x0000000000151000-memory.dmpFilesize
68KB
-
memory/2532-22-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2532-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2532-23-0x0000000000580000-0x0000000000591000-memory.dmpFilesize
68KB
-
memory/2532-13-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2532-10-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2532-9-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2780-28-0x0000000000C10000-0x0000000000C56000-memory.dmpFilesize
280KB
-
memory/2780-29-0x0000000000C10000-0x0000000000C56000-memory.dmpFilesize
280KB
-
memory/2780-30-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/2780-31-0x0000000002060000-0x0000000002363000-memory.dmpFilesize
3.0MB
-
memory/2780-32-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/2780-34-0x00000000009B0000-0x0000000000A40000-memory.dmpFilesize
576KB