Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 20:13
Static task
static1
Behavioral task
behavioral1
Sample
Pump Parts & Stainless Steel.exe
Resource
win7-20241023-en
General
-
Target
Pump Parts & Stainless Steel.exe
-
Size
540KB
-
MD5
e0213cf3bd4ca9cfd094272ed98c37a6
-
SHA1
704402640a854c50d4a787155d4eba19829106c9
-
SHA256
9e94ea964630e088c92a9caf37bbf4e9716e9490142e58f3ba84042b02461021
-
SHA512
e52494a23e98c19c23c18c025de804426464101d436b6ba66b096112bc8c06ff86baed2d3164688f15299edf2c4a5351b12475e70f7cde851d7b9006e8913e86
-
SSDEEP
12288:YhAgAIs25v5+Yzr9KtMsIUFVhwsAsK4POYiUmjclhVkOHdSMV/8pS:Y15lzr9F3UjKZsK49+4
Malware Config
Extracted
xloader
2.5
m3ci
424964.com
ocean-breath-retreat.com
icidedansdehors.art
wrochtthurl.quest
6455gfg.top
dgfipmailservice.online
banjofarmenica.com
dkcazin.com
jobs-fp.com
karens-kornerr.com
parmaesq.com
nuevochile.net
inputsquad.com
consultacedula-sep.digital
taogoubao.net
gimmesolar.com
bluelacedefense.com
grandagent.club
warqatalzawaj.com
getvirbelanow.com
omnifichub.com
rjtherealest.com
hqpzchmo.xyz
pearl-street-art.com
dudukrumah.com
resetmybutton.info
dinodao.xyz
payment-securecard.com
gorjessbyjessicaservice.website
edayispeove.com
glorian34.com
moviezwaphd.red
bxqiche.com
associate-cien.com
coparivan.quest
buyseneca.com
del-directory.xyz
thedarkhuntressexperience.com
trevaleaf.com
kwsi.online
2552111.com
highpacts.com
queenslandspirits.com
magazinhaberlerim.com
radialodge.com
packgames.store
sterre.one
tkspoboys.com
datashen.com
xn--4gqyn781iuoq.xyz
breadnbutterflies.com
intotheground.net
tenlog043.xyz
bendingwillowbirth.com
lavellwesley.com
aumpatho.com
fdklflkdioerklfdke.store
nxscrapbook.com
dan-is-a-ghey-retard.com
retailzoohub.com
pause-beautystore.com
accentpavementmaintenance.com
brittsballers.com
indev-mobility.info
bravobug.net
Signatures
-
Xloader family
-
Xloader payload 3 IoCs
resource yara_rule behavioral2/memory/1348-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1348-18-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1348-22-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3356 set thread context of 1348 3356 Pump Parts & Stainless Steel.exe 89 PID 1348 set thread context of 3484 1348 RegSvcs.exe 56 PID 1348 set thread context of 3484 1348 RegSvcs.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Pump Parts & Stainless Steel.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1348 RegSvcs.exe 1348 RegSvcs.exe 1348 RegSvcs.exe 1348 RegSvcs.exe 1348 RegSvcs.exe 1348 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1348 RegSvcs.exe 1348 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1348 RegSvcs.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3356 wrote to memory of 1348 3356 Pump Parts & Stainless Steel.exe 89 PID 3356 wrote to memory of 1348 3356 Pump Parts & Stainless Steel.exe 89 PID 3356 wrote to memory of 1348 3356 Pump Parts & Stainless Steel.exe 89 PID 3356 wrote to memory of 1348 3356 Pump Parts & Stainless Steel.exe 89 PID 3356 wrote to memory of 1348 3356 Pump Parts & Stainless Steel.exe 89 PID 3356 wrote to memory of 1348 3356 Pump Parts & Stainless Steel.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\Pump Parts & Stainless Steel.exe"C:\Users\Admin\AppData\Local\Temp\Pump Parts & Stainless Steel.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1348
-
-