Analysis
-
max time kernel
148s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 18:34
Static task
static1
Behavioral task
behavioral1
Sample
PO#652.exe
Resource
win7-20240708-en
General
-
Target
PO#652.exe
-
Size
345KB
-
MD5
095d3e149a73c5daa7da04428ee3d561
-
SHA1
a2bee1c142d50ef4f821e30eae5a1a30efa8f009
-
SHA256
a8fe6d7fa624e8e96f71d3ff6375a012b44b51f06179feb7cef8c33fd6d38570
-
SHA512
69912e46c134c99f03af4dbc9dd9dbd7da100e56c513d7be6f92d38a69eae2094c85aab239dff41d5a84dfe3e92dc730e0653f74e668e556d9c84d4ad677b650
-
SSDEEP
6144:vv0M3Nkx/86kMUoM4fonNsK1UQR24dkyc1QCPBvHgy8DPlJB7F9GzypL1yO42s2b:vcM3H6kM7gnRBR24yRPBPgy8DNFwe7ya
Malware Config
Extracted
xloader
2.3
m3de
ad-unity.com
republicans2032.com
blackculturewriters.com
wallnewphoto.com
etripideas.com
solarphlare.com
consultoranexo.com
hayasalon.com
pillowcasefactory.club
service-manbzcsexer.com
medicinerx.today
oliviarescigno.com
tomcruise.club
tetsim.com
atonalai.net
malcomsons.com
straitskids.com
luca-cci.com
pero.financial
wowbdshop.com
williammassimi.com
856379738.xyz
freshsifish.com
instinctbands.com
immignet.com
contex3.info
rawvegangoods.com
sn1008.com
lyo.xyz
hopefulsoil.com
igxwdxggfg8d2.net
gp240.com
martymohr.com
divineseo.com
nelvine.com
cryptotshirtshop.com
linglingproperty.com
tvdeu.com
massiv.agency
helforddepositaryservices.com
moneys365.online
stagepins.com
techinspect.online
playrajshreelucky.com
wingmonsters.com
cleveland.sucks
karmikclothing.com
tuandphillip.com
gywj2020.com
lapicy.com
schwarzwald-erleben.net
citestaccnt1597754245.com
perfectretreatswa.com
canadianmusicindustrycd.com
muhunt.net
arcax.info
avpwine.com
blazingsandals.com
rcdfashion.info
darling-date.com
nashrahsecretz.com
houstongundealer.com
parislovearts.com
bagibaso.com
sunsfactory.net
Signatures
-
Core1 .NET packer 1 IoCs
Detects packer/loader used by .NET malware.
resource yara_rule behavioral1/memory/1596-2-0x00000000020D0000-0x0000000002112000-memory.dmp Core1 -
Xloader payload 5 IoCs
resource yara_rule behavioral1/memory/1596-2-0x00000000020D0000-0x0000000002112000-memory.dmp xloader behavioral1/memory/1596-3-0x00000000008F0000-0x0000000000918000-memory.dmp xloader behavioral1/memory/2804-14-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2804-18-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/2952-26-0x00000000000C0000-0x00000000000E8000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1596 set thread context of 2804 1596 PO#652.exe 30 PID 2804 set thread context of 1252 2804 svchost.exe 21 PID 2804 set thread context of 1252 2804 svchost.exe 21 PID 2952 set thread context of 1252 2952 msdt.exe 21 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdt.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2804 svchost.exe 2804 svchost.exe 2804 svchost.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe 2952 msdt.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2804 svchost.exe 2804 svchost.exe 2804 svchost.exe 2804 svchost.exe 2952 msdt.exe 2952 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2804 svchost.exe Token: SeDebugPrivilege 2952 msdt.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1596 wrote to memory of 2804 1596 PO#652.exe 30 PID 1596 wrote to memory of 2804 1596 PO#652.exe 30 PID 1596 wrote to memory of 2804 1596 PO#652.exe 30 PID 1596 wrote to memory of 2804 1596 PO#652.exe 30 PID 1596 wrote to memory of 2804 1596 PO#652.exe 30 PID 1596 wrote to memory of 2804 1596 PO#652.exe 30 PID 1596 wrote to memory of 2804 1596 PO#652.exe 30 PID 1252 wrote to memory of 2952 1252 Explorer.EXE 31 PID 1252 wrote to memory of 2952 1252 Explorer.EXE 31 PID 1252 wrote to memory of 2952 1252 Explorer.EXE 31 PID 1252 wrote to memory of 2952 1252 Explorer.EXE 31 PID 2952 wrote to memory of 2600 2952 msdt.exe 32 PID 2952 wrote to memory of 2600 2952 msdt.exe 32 PID 2952 wrote to memory of 2600 2952 msdt.exe 32 PID 2952 wrote to memory of 2600 2952 msdt.exe 32
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\PO#652.exe"C:\Users\Admin\AppData\Local\Temp\PO#652.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWow64\svchost.exe"C:\\Windows\\SysWow64\\svchost.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWow64\svchost.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2600
-
-