Overview
overview
10Static
static
10malware/EinTT.exe
windows7-x64
10malware/EinTT.exe
windows10-2004-x64
10malware/fox.exe
windows7-x64
3malware/fox.exe
windows10-2004-x64
3malware/guJPO.exe
windows7-x64
10malware/guJPO.exe
windows10-2004-x64
10malware/loader1.exe
windows7-x64
10malware/loader1.exe
windows10-2004-x64
7dnjdbaa.exe
windows7-x64
3dnjdbaa.exe
windows10-2004-x64
3malware/regasm.exe
windows7-x64
10malware/regasm.exe
windows10-2004-x64
10malware/vbc.exe
windows7-x64
10malware/vbc.exe
windows10-2004-x64
7rywcikv.exe
windows7-x64
3rywcikv.exe
windows10-2004-x64
3malware/vbc1.exe
windows7-x64
10malware/vbc1.exe
windows10-2004-x64
7eblupydfzx.exe
windows7-x64
3eblupydfzx.exe
windows10-2004-x64
3malware/vbc2.exe
windows7-x64
10malware/vbc2.exe
windows10-2004-x64
7ioatgumevw.exe
windows7-x64
3ioatgumevw.exe
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 20:32
Behavioral task
behavioral1
Sample
malware/EinTT.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
malware/EinTT.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
malware/fox.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
malware/fox.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
malware/guJPO.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
malware/guJPO.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
malware/loader1.exe
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
malware/loader1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
dnjdbaa.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
dnjdbaa.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
malware/regasm.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
malware/regasm.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
malware/vbc.exe
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
malware/vbc.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
rywcikv.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
rywcikv.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
malware/vbc1.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
malware/vbc1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
eblupydfzx.exe
Resource
win7-20241023-en
Behavioral task
behavioral20
Sample
eblupydfzx.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
malware/vbc2.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
malware/vbc2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
ioatgumevw.exe
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
ioatgumevw.exe
Resource
win10v2004-20241007-en
General
-
Target
malware/guJPO.exe
-
Size
164KB
-
MD5
a73bd7a7d57c7132fab130836c4e1bf3
-
SHA1
be5a57900b99030c1edda051f47ac7b71d5a4402
-
SHA256
4ef90b24b4674cd6914181ff64e47d9a31069412cb41ffb60dfcf1c0f491dd74
-
SHA512
6470654f2dcf22bcbf38d293f08545de4660ea2f66dc180523c5b2ebf1e664b2f93756b62f665c3d30f923eb0efcc4f5025bb7f27bd2d4420fda3128238ba20a
-
SSDEEP
3072:fYdJcDSGFUXHZXG/+wsaE8HV6mIJpLTw5h87lhYHkwA3ZtaYvIN:fYMYpW/zJZHEm2pLUh87lPX7aq
Malware Config
Extracted
xloader
2.5
ahc8
192451.com
wwwripostes.net
sirikhalsalaw.com
bitterbaybay.com
stella-scrubs.com
almanecermezcal.com
goodgood.online
translate-now.online
sincerefilm.com
quadrantforensics.com
johnfrenchart.com
plick-click.com
alnileen.com
tghi.xyz
172711.com
maymakita.com
punnyaseva.com
ukash-online.com
sho-yururi-blog.com
hebergement-solidaire.com
civicinfluencers.net
gzhf8888.com
kuleallstar.com
palisadeslodgecondos.com
holyhirschsprungs.com
azalearoseuk.com
jaggllc.com
italianrofrow.xyz
ioewur.xyz
3a5hlv.icu
kitcycle.com
estate.xyz
ankaraescortvip.xyz
richclubsite2001.xyz
kastore.website
515pleasantvalleyway.com
sittlermd.com
mytemple.group
tiny-wagen.com
sharaleesvintageflames.com
mentalesteem.com
sport-newss.online
fbve.space
lovingtruebloodindallas.com
eaglehospitality.biz
roofrepairnow.info
mcrosfts-updata.digital
cimpactinc.com
greatnotleyeast.com
lovely-tics.com
douglas-enterprise.com
dayannalima.online
ksodl.com
rainbowlampro.com
theinteriorsfurniture.com
eidmueller.email
cg020.online
gta6fuzhu.com
cinemaocity.com
hopeitivity.com
savageequipment.biz
groceriesbazaar.com
hempgotas.com
casino-pharaon-play.xyz
ralfrassendnk-login.com
Signatures
-
Xloader family
-
Xloader payload 2 IoCs
resource yara_rule behavioral5/memory/2232-6-0x0000000000C10000-0x0000000000C39000-memory.dmp xloader behavioral5/memory/2792-11-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
pid Process 2708 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2232 set thread context of 1220 2232 guJPO.exe 21 PID 2232 set thread context of 1220 2232 guJPO.exe 21 PID 2792 set thread context of 1220 2792 NETSTAT.EXE 21 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NETSTAT.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 2792 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 2232 guJPO.exe 2232 guJPO.exe 2232 guJPO.exe 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE 2792 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 2232 guJPO.exe 2232 guJPO.exe 2232 guJPO.exe 2232 guJPO.exe 2792 NETSTAT.EXE 2792 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2232 guJPO.exe Token: SeDebugPrivilege 2792 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1220 wrote to memory of 2792 1220 Explorer.EXE 30 PID 1220 wrote to memory of 2792 1220 Explorer.EXE 30 PID 1220 wrote to memory of 2792 1220 Explorer.EXE 30 PID 1220 wrote to memory of 2792 1220 Explorer.EXE 30 PID 2792 wrote to memory of 2708 2792 NETSTAT.EXE 31 PID 2792 wrote to memory of 2708 2792 NETSTAT.EXE 31 PID 2792 wrote to memory of 2708 2792 NETSTAT.EXE 31 PID 2792 wrote to memory of 2708 2792 NETSTAT.EXE 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\malware\guJPO.exe"C:\Users\Admin\AppData\Local\Temp\malware\guJPO.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\malware\guJPO.exe"3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2708
-
-