Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
22-06-2024 18:56
Behavioral task
behavioral1
Sample
XyloTool.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
XyloTool.exe
Resource
win10v2004-20240611-en
General
-
Target
XyloTool.exe
-
Size
5.9MB
-
MD5
1bae503880fbeb67ea0df79e4123eb3f
-
SHA1
66f88a8d04503aa36f97153271e756b184915cfd
-
SHA256
6ba55b8fc0d8a37a2d5942c54d86c267d38fc4bd4bc1339dde80190ddf800980
-
SHA512
bea868f8215a69ff0f72a67b04cb0eeb3030b1c830c700ca29b61f1e38ccddb5401ae3285b9101d3998480a31a8e7a5fe053ad2b464de6ffdfea36cda403e663
-
SSDEEP
98304:zN+nhj832i65sn6Wfz7pnxCjJaWlpx1dstaNoSwKHf1c3z5MOueAeF29hGkr/LcQ:zAn4EDOYjJlpZstQoS9Hf12VKXpbGC0E
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
XyloTool.exepid process 2728 XyloTool.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI24362\python310.dll upx behavioral1/memory/2728-23-0x000007FEF64B0000-0x000007FEF6915000-memory.dmp upx -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7zFM.exepid process 2560 7zFM.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7zFM.exedescription pid process Token: SeRestorePrivilege 2560 7zFM.exe Token: 35 2560 7zFM.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
XyloTool.exedescription pid process target process PID 2436 wrote to memory of 2728 2436 XyloTool.exe XyloTool.exe PID 2436 wrote to memory of 2728 2436 XyloTool.exe XyloTool.exe PID 2436 wrote to memory of 2728 2436 XyloTool.exe XyloTool.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\XyloTool.exe"C:\Users\Admin\AppData\Local\Temp\XyloTool.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\XyloTool.exe"C:\Users\Admin\AppData\Local\Temp\XyloTool.exe"2⤵
- Loads dropped DLL
PID:2728
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2560
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:464
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\_MEI24362\python310.dllFilesize
1.4MB
MD5b93eda8cc111a5bde906505224b717c3
SHA15f1ae1ab1a3c4c023ea8138d4b09cbc1cd8e8f9e
SHA256efa27cd726dbf3bf2448476a993dc0d5ffb0264032bf83a72295ab3fc5bcd983
SHA512b20195930967b4dc9f60c15d9ceae4d577b00095f07bd93aa4f292b94a2e5601d605659e95d5168c1c2d85dc87a54d27775f8f20ebcacf56904e4aa30f1affba
-
memory/2728-23-0x000007FEF64B0000-0x000007FEF6915000-memory.dmpFilesize
4.4MB