Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-11-2024 21:22
Static task
static1
Behavioral task
behavioral1
Sample
d2d96154024ca3137cd2e84d367053ea8e0de0459a781356577a3ba775c1fb8e.js
Resource
win7-20241023-en
General
-
Target
d2d96154024ca3137cd2e84d367053ea8e0de0459a781356577a3ba775c1fb8e.js
-
Size
354KB
-
MD5
4e5cc8fddecae16e747e6b1a48b31cd5
-
SHA1
9195d4069bc82b38261bb9ec58333921e7164eac
-
SHA256
d2d96154024ca3137cd2e84d367053ea8e0de0459a781356577a3ba775c1fb8e
-
SHA512
fa27ad2184bc22d0d7784e1ecffd049266c43b196635373e73280d71e244061687113143361e8466f29f489259afd0b18e8c50ffb37007cc199fea0e28475ad1
-
SSDEEP
6144:MFy6iTj2GQabp6O5GiyPXg6FRC5epPNmyJn6kiMJ+ME5fSKO37S:MFy6NagigXg6FR7NmyJGMfExSPG
Malware Config
Extracted
xloader
2.5
pzi0
laylmodest.com
woruke.club
metaverseslots.net
syscogent.net
aluxxenterprise.com
lm-solar.com
lightempirestore.com
witcheboutique.com
hometech-bosch.xyz
expert-netcad.com
poteconomist.com
mycousinsfriend.biz
shineveranda.com
collegedictionary.cloud
zqlidexx.com
businessesopportunity.com
2utalahs4.com
participatetn.info
dare2ownit.com
varser.com
gxo.digital
networkroftrl.xyz
renturways.com
theprooff.com
ncgf06.xyz
lighterior2.com
one-seo.xyz
benzprod.xyz
k6tkuwrnjake.biz
robinlynnolson.com
ioptest.com
modern-elementz.com
baetsupreme.net
lapetiteagencequimonte.com
xn--bellemre-60a.com
bringthegalaxy.com
shopnobra.com
maroondragon.com
pandemictickets.com
intelligentrereturns.net
quietshop.art
anarkalidress.com
wasserstoff-station.net
filmweltruhr.com
buck100.com
maxicashprommu.xyz
studiosilhouettes.com
lightningridgetradingpost.com
zhuanzhuan9987.top
mlelement.com
krystalsescapetravels.com
simplyabcbooks.com
greenhouse1995systems.com
altogetheradhd.com
servicedogumentary.com
cdcawpx.com
motometics.com
palisadesattahoe.com
paradgmpharma.com
microexpertise.com
venkycouture.online
maculardegenerationtsusanet.com
atlasbrandwear.com
karegcc.com
buffstaff.com
Signatures
-
Vjw0rm family
-
Xloader family
-
Xloader payload 3 IoCs
resource yara_rule behavioral2/files/0x000a000000023b79-6.dat xloader behavioral2/memory/4520-13-0x0000000000180000-0x00000000001A9000-memory.dmp xloader behavioral2/memory/1796-19-0x00000000005D0000-0x00000000005F9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
flow pid Process 89 1796 cmd.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CJiKMkZXYA.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CJiKMkZXYA.js wscript.exe -
Executes dropped EXE 1 IoCs
pid Process 4520 wealth.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\CJiKMkZXYA.js\"" wscript.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4520 set thread context of 3456 4520 wealth.exe 56 PID 1796 set thread context of 3456 1796 cmd.exe 56 -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wealth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 4520 wealth.exe 4520 wealth.exe 4520 wealth.exe 4520 wealth.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe 1796 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4520 wealth.exe 4520 wealth.exe 4520 wealth.exe 1796 cmd.exe 1796 cmd.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4520 wealth.exe Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE Token: SeDebugPrivilege 1796 cmd.exe Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE Token: SeShutdownPrivilege 3456 Explorer.EXE Token: SeCreatePagefilePrivilege 3456 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2832 wrote to memory of 1688 2832 wscript.exe 82 PID 2832 wrote to memory of 1688 2832 wscript.exe 82 PID 2832 wrote to memory of 4520 2832 wscript.exe 83 PID 2832 wrote to memory of 4520 2832 wscript.exe 83 PID 2832 wrote to memory of 4520 2832 wscript.exe 83 PID 3456 wrote to memory of 1796 3456 Explorer.EXE 85 PID 3456 wrote to memory of 1796 3456 Explorer.EXE 85 PID 3456 wrote to memory of 1796 3456 Explorer.EXE 85 PID 1796 wrote to memory of 2856 1796 cmd.exe 89 PID 1796 wrote to memory of 2856 1796 cmd.exe 89 PID 1796 wrote to memory of 2856 1796 cmd.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\d2d96154024ca3137cd2e84d367053ea8e0de0459a781356577a3ba775c1fb8e.js2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\CJiKMkZXYA.js"3⤵
- Drops startup file
- Adds Run key to start application
PID:1688
-
-
C:\Users\Admin\AppData\Local\Temp\wealth.exe"C:\Users\Admin\AppData\Local\Temp\wealth.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4520
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\wealth.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2856
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
163KB
MD583481bf872730cd133669c5ea5b1be2b
SHA1fbd2369965b20f6bee09063aa454de13a18c71d3
SHA2565d174dd08492f307e4b367e262f3e96b9beefb99f5abb11043ddf7142a18e9e8
SHA5129080dc9bcdfba87ff3ecb3ba04af7a03dea2228f093fbb91149ff8825694601908ba85b2ce27a1de47ce1f6e263b03d96d80d43b7a4033051fbbac64fde7dc51
-
Filesize
23KB
MD51962a74165904451424267c78882130c
SHA1761254145b67dd9b85a7c689dcd4aa61e2c16420
SHA256b054f1670ebc434d9c756d7ecf2c0a9cafedbacd2b1ca89aef12a49733007095
SHA512d3abf4e9b6279508f326aa979942d183f02c45c95bcf1a3820f67b6b8bc29c73d44fb19dba8438da46f8c778012d027067655620387b4c88cce7917c525760b4