Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-09-2024 01:29
Static task
static1
Behavioral task
behavioral1
Sample
140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
rxyzg.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral4
Sample
rxyzg.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117.exe
-
Size
192KB
-
MD5
a43025a136bcc6af701054ed51ad8adb
-
SHA1
547032f4afb1cb3b6970ba5a64234d20e815a3a4
-
SHA256
140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117
-
SHA512
e6c9bd2cf29cffb3d318664a9525d6d56767d4ec482b6f38861b1f01d222a73228f4e70bc12b45f700eb37513a32d64616edf09e8b4df349e9a0aa36c7fe3f81
-
SSDEEP
3072:l1NjcVVnLpPuqbJzk9y/Nsso8vTUa6wySNSCV1sPvhDbQh2k4hPwn0gSimGZ6P5u:HNeZFhbEaeSN91sP9baS+npwIn2nyR7
Malware Config
Extracted
xloader
2.5
3e9r
143411.com
300dh.xyz
win-chance.info
essentialsofbeauty.com
skategrindingwheels.com
jyqtgg.com
exodijuis.com
goodwinpuppies.com
doitlive.online
hello-orchid.com
shangjibbs.com
innovarecic.com
fococomunicacaovisuales.com
completemarine.care
parodistluxuryroll.com
anda568.com
unicorm.digital
weaveapp.xyz
artractions.com
app-ads-network.com
okbruv.com
erickdechavez.com
massanyakudachiblog.com
easywhiff.com
biurowe.online
rapibest.com
kfovideo.xyz
bobswoodchip.com
otcnetsys.com
empiredigitalcbdstore.com
securityfirstlt.com
oracigypten.quest
nerohub.com
kartupokerjp889.com
amarbakers.online
hopeballoonfestival.com
pgzaandam.online
pauschalreisen.xyz
topindiahistory.xyz
polkadotskull.com
hdmseotools.com
sampatrickpage.com
document908070392.host
anthonywvea.com
drogueriaaprial.com
iphone13mini.computer
wbgdglobal.com
hyponymys.info
vagusartesaniaymoda.online
gqsmg.com
fandenacqua.quest
lace-underwear.store
xpressporn.com
hotelposadanova.com
rapidcae.com
iuckychance.com
hathumbglobal.com
drone-rullime.com
upgown.com
kvistuv.quest
rogersthemusical.com
likesub247.info
bhadrakalisandhya.com
suddennnnnnnnnnnn03.xyz
divinehuntbegins.net
Signatures
-
Xloader payload 4 IoCs
resource yara_rule behavioral1/memory/1440-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1440-15-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/2796-24-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader behavioral1/memory/2316-41-0x0000000140000000-0x00000001405E8000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
flow pid Process 7 2796 rundll32.exe -
Executes dropped EXE 2 IoCs
pid Process 2380 rxyzg.exe 1440 rxyzg.exe -
Loads dropped DLL 2 IoCs
pid Process 2372 140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117.exe 2380 rxyzg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2380 set thread context of 1440 2380 rxyzg.exe 32 PID 1440 set thread context of 1252 1440 rxyzg.exe 21 PID 2796 set thread context of 1252 2796 rundll32.exe 21 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxyzg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1440 rxyzg.exe 1440 rxyzg.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2796 rundll32.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2796 rundll32.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2796 rundll32.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1252 Explorer.EXE 2316 taskmgr.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1440 rxyzg.exe 1440 rxyzg.exe 1440 rxyzg.exe 2796 rundll32.exe 2796 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1440 rxyzg.exe Token: SeDebugPrivilege 2796 rundll32.exe Token: SeShutdownPrivilege 1252 Explorer.EXE Token: SeDebugPrivilege 2316 taskmgr.exe Token: SeShutdownPrivilege 1252 Explorer.EXE -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe -
Suspicious use of SendNotifyMessage 30 IoCs
pid Process 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe 2316 taskmgr.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2380 2372 140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117.exe 31 PID 2372 wrote to memory of 2380 2372 140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117.exe 31 PID 2372 wrote to memory of 2380 2372 140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117.exe 31 PID 2372 wrote to memory of 2380 2372 140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117.exe 31 PID 2380 wrote to memory of 1440 2380 rxyzg.exe 32 PID 2380 wrote to memory of 1440 2380 rxyzg.exe 32 PID 2380 wrote to memory of 1440 2380 rxyzg.exe 32 PID 2380 wrote to memory of 1440 2380 rxyzg.exe 32 PID 2380 wrote to memory of 1440 2380 rxyzg.exe 32 PID 2380 wrote to memory of 1440 2380 rxyzg.exe 32 PID 2380 wrote to memory of 1440 2380 rxyzg.exe 32 PID 1252 wrote to memory of 2796 1252 Explorer.EXE 33 PID 1252 wrote to memory of 2796 1252 Explorer.EXE 33 PID 1252 wrote to memory of 2796 1252 Explorer.EXE 33 PID 1252 wrote to memory of 2796 1252 Explorer.EXE 33 PID 1252 wrote to memory of 2796 1252 Explorer.EXE 33 PID 1252 wrote to memory of 2796 1252 Explorer.EXE 33 PID 1252 wrote to memory of 2796 1252 Explorer.EXE 33 PID 2796 wrote to memory of 2824 2796 rundll32.exe 34 PID 2796 wrote to memory of 2824 2796 rundll32.exe 34 PID 2796 wrote to memory of 2824 2796 rundll32.exe 34 PID 2796 wrote to memory of 2824 2796 rundll32.exe 34 PID 1252 wrote to memory of 2316 1252 Explorer.EXE 37 PID 1252 wrote to memory of 2316 1252 Explorer.EXE 37 PID 1252 wrote to memory of 2316 1252 Explorer.EXE 37
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117.exe"C:\Users\Admin\AppData\Local\Temp\140c2a66e6feca66598f349391e11813c91e918bad57de7422e0531ab42a6117.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\rxyzg.exeC:\Users\Admin\AppData\Local\Temp\rxyzg.exe C:\Users\Admin\AppData\Local\Temp\mfqbqbhcqx3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\rxyzg.exeC:\Users\Admin\AppData\Local\Temp\rxyzg.exe C:\Users\Admin\AppData\Local\Temp\mfqbqbhcqx4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1440
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\rxyzg.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2824
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
163KB
MD54b647b9910011c7dcb6efcdf177f4c4a
SHA1cf59b74c1bec81062866e3327bf057fdbadd8eab
SHA25609bdf441425a65d105404065b4feaa4c231a7d5ea21bf9b3b832c30ed6ee053e
SHA5125fece077b9fb7b1fe1646e0a31a6cc5ec246dcb13229caac5838c1ef277eef4cee5ba2b2d013c37eeab7d55ba8d38c92c9684a05b63456b93104a37302c4c234
-
Filesize
4KB
MD52ce8643c23d1bc7f420bdde0683c28ee
SHA1c84271354bceeededc251467eae7cab0f2c3636c
SHA256c4c7b8ac8e31d6d252b19de0bebaf27e31e0c5c2200c9be94eaecfed81db601c
SHA5126319803d938cd42e7f434cfdcf71f547db70d77493d3c5010cb82371d12a156704bf0e554e5d88d7bbe591cb0dd03c7812b0e159ec3e29d2117e560802eb3b63
-
Filesize
3KB
MD564d3f2b2a7c95bc7051051fe34620dc3
SHA11a089f830583bca8aae69330a9e4946bbe03fb4f
SHA256d1595a226a32172f214ff69b964281ef663079b6467cffa98edc6064a9f69ab6
SHA512af6b303b98765034f886e8bc9889f829a0265bde7559b9e738ff310be6747be083c377fecc76a007d2f464907bff80c6acfc90abf7f46a1408438554a01bff7e