Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 05:31
Static task
static1
Behavioral task
behavioral1
Sample
1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/ztqv.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/ztqv.dll
Resource
win10v2004-20241007-en
General
-
Target
1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe
-
Size
251KB
-
MD5
2627ba100abc4933106893191384a31d
-
SHA1
a5e77daa3cd30c6ed8106380d408534aac4e6eeb
-
SHA256
1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac
-
SHA512
3769f5645a0e310865fea09e3ca027aebb1b3efde328157b73c61187b3158301e102e5d56a17140fb0d36533c89bede93f124bc657dff9237b6112b2d8c935f7
-
SSDEEP
6144:wBlL/cR8tpViH8hHseEJ1eG6/211J5nQEnURg0HZoAg:CeRSpNhH1EGZc5tURggZoAg
Malware Config
Extracted
xloader
2.5
m5cw
stolpfabriken.com
aromaessentialco.com
rmcclaincpa.com
wuruixin.com
sidhyanticlasses.com
horilka.store
organic-outlaws.com
customsoftwarelogistics.com
cheryltesting.com
thecompacthomegym.com
the22yards.club
quickloanprovidersservices.com
grippyent.com
guard-usa.com
agircredit.com
classificationmetallurgie.com
quizzesandcode.com
catdanos.com
8676789.rest
gotbestshavlngplansforyou.com
supboarddesign.com
byrdemailplans.xyz
anngola.com
milelefoods.com
runawaypklyau.xyz
redesignyourpain.com
yourtv2ship.info
jxypc.com
lerjighjuij.store
spiruline-shop.com
qarziba-therapy.care
hardayumangosteen.com
freevolttech.com
xiongbaosp.xyz
balanzasdeplataforma.com
johnathanmanney.com
estcequecestgreen.com
france-temps-partage.net
fbiicrc.com
privateairjets.com
xn--5m4a23skoc.group
andrewmurnane.com
exitin90.com
depofmvz.com
bosphorus.website
aragon.store
nrnmuhendislik.com
thesharingcorporation.com
tccraft.online
carjabber.com
limitlesschurchbf.com
dazalogistics.com
x-play.club
bitterbay.net
forwardhcd.com
smance.xyz
netgearcloud.net
wellaspiron.com
heidelay.xyz
qknzutohbtro.mobi
epurhybrid.com
pelitupmukaeksklusif.com
secondave.online
lockdownshowdown.online
art-for-a-cause.com
Signatures
-
Xloader family
-
Xloader payload 1 IoCs
resource yara_rule behavioral1/memory/2388-9-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
pid Process 2420 1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2420 set thread context of 2388 2420 1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe 30 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2388 1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2388 2420 1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe 30 PID 2420 wrote to memory of 2388 2420 1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe 30 PID 2420 wrote to memory of 2388 2420 1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe 30 PID 2420 wrote to memory of 2388 2420 1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe 30 PID 2420 wrote to memory of 2388 2420 1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe 30 PID 2420 wrote to memory of 2388 2420 1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe 30 PID 2420 wrote to memory of 2388 2420 1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe"C:\Users\Admin\AppData\Local\Temp\1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe"C:\Users\Admin\AppData\Local\Temp\1e3b17f9813300bb214a12a8be41217770ff025e7e595431e1712b14a55df1ac.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD597d84d39bb68b5a29e976b40d7d0a00c
SHA1cf4c09487fffb9ace9ab6b82f33da0d5a851ef1c
SHA2565b29c5ee49d9cdde15d88a9e4f8f6b4bba9e2dc4ec65c02d734726fe0f2952c8
SHA512aab5b8831538f96c00e77f16349065bfaa93e7b25206a6d5fe0871f518f38ae31437f2f9f93f36f488e1869eaf97dd4697a282d726ce9a292cf4276242733546