Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2024, 20:37
Static task
static1
Behavioral task
behavioral1
Sample
UPDATE PRICELIST.exe
Resource
win7-20240903-en
General
-
Target
UPDATE PRICELIST.exe
-
Size
775KB
-
MD5
a901bb7c45815da070fc9242afc8ddbc
-
SHA1
099ddc6edc09ee9b69dfdbe4d9cbab40f6a47b0d
-
SHA256
50f5a84413e64d6c7f7e816570456063ae4ff444d6f81b195b17576a21b6f5a9
-
SHA512
8da7c79ee9593327889e87effe6cf699db8d5fc0e37ed4c6c753f3b0de0c8f1c63be651d9b64b1f951b61dba58b019d2206ad9dbc4b98f4c0fe84ff2c091f164
-
SSDEEP
12288:zgolxmnZz9MYLKXLo3QMdUkF1YBusJ1ONHWi2ATHRioE/mZb94X4JFP1t2HERgP:zD2Zz9MGd5FYD+y0aZ
Malware Config
Extracted
xloader
2.5
nphk
sexytinydoll.com
7warsari7.com
trufflecreekkennels.com
eurodrev.club
monstersclan.tech
deathgummies.com
mitratechs.com
kissmint.art
solid114.com
exclusivoclub.com
iegco.group
hokiboyathena.xyz
sathapornstainlesssteel.com
ci-ohio.com
royal-deliverymail-fee.com
sakisushitallahassee.com
rinconescoces.net
meetthespace.com
natbplc.com
fragcoconut.com
bougiesnacks.com
lindamorenastar.com
hdhongxi.com
jsgunworksstc.com
customerstudies.com
coveryourbunsbbq.com
unikmot.com
paramustowing.com
fairystarwands.com
livingboardwalk.com
dgfinancialservicesllc.com
lewishead.com
pancakieswup.xyz
ktnarm.xyz
brilliantcave.com
suprebahia.com
ivegotthat.com
cryptocrazia2030.com
sentpostja.com
infiteltech.com
smav4.xyz
tvbarra.online
quarterrising.com
copywrap.com
nftroglodytes.com
deluxebaddieb.com
corporateequity.online
chairsexpert.com
trueke.one
elektrodidak.com
livheallthhtoyof6.xyz
kimi-lah.com
thexbshop.com
dekulturcoffe.com
signalandreport.com
comcast-inter.ltd
support-insagramhelp.com
izitrade4u2.com
eining.info
best-of-company.com
chicanolineapperal.net
spgqqc.website
cigreencig.com
shiyuejoy.com
makerealmoneyeveryday.com
Signatures
-
Xloader family
-
Xloader payload 4 IoCs
resource yara_rule behavioral2/memory/4464-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4464-17-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4464-21-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4704-29-0x0000000001450000-0x0000000001479000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2376 set thread context of 4464 2376 UPDATE PRICELIST.exe 100 PID 4464 set thread context of 3444 4464 UPDATE PRICELIST.exe 56 PID 4464 set thread context of 3444 4464 UPDATE PRICELIST.exe 56 PID 4704 set thread context of 3444 4704 explorer.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UPDATE PRICELIST.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 2376 UPDATE PRICELIST.exe 4464 UPDATE PRICELIST.exe 4464 UPDATE PRICELIST.exe 4464 UPDATE PRICELIST.exe 4464 UPDATE PRICELIST.exe 4464 UPDATE PRICELIST.exe 4464 UPDATE PRICELIST.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe 4704 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4464 UPDATE PRICELIST.exe 4464 UPDATE PRICELIST.exe 4464 UPDATE PRICELIST.exe 4464 UPDATE PRICELIST.exe 4704 explorer.exe 4704 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2376 UPDATE PRICELIST.exe Token: SeDebugPrivilege 4464 UPDATE PRICELIST.exe Token: SeDebugPrivilege 4704 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2376 wrote to memory of 4464 2376 UPDATE PRICELIST.exe 100 PID 2376 wrote to memory of 4464 2376 UPDATE PRICELIST.exe 100 PID 2376 wrote to memory of 4464 2376 UPDATE PRICELIST.exe 100 PID 2376 wrote to memory of 4464 2376 UPDATE PRICELIST.exe 100 PID 2376 wrote to memory of 4464 2376 UPDATE PRICELIST.exe 100 PID 2376 wrote to memory of 4464 2376 UPDATE PRICELIST.exe 100 PID 3444 wrote to memory of 4704 3444 Explorer.EXE 101 PID 3444 wrote to memory of 4704 3444 Explorer.EXE 101 PID 3444 wrote to memory of 4704 3444 Explorer.EXE 101 PID 4704 wrote to memory of 2708 4704 explorer.exe 102 PID 4704 wrote to memory of 2708 4704 explorer.exe 102 PID 4704 wrote to memory of 2708 4704 explorer.exe 102
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\UPDATE PRICELIST.exe"C:\Users\Admin\AppData\Local\Temp\UPDATE PRICELIST.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\UPDATE PRICELIST.exe"C:\Users\Admin\AppData\Local\Temp\UPDATE PRICELIST.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4464
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\UPDATE PRICELIST.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2708
-
-