Overview
overview
10Static
static
8Order.exe
windows7-x64
5Order.exe
windows10-2004-x64
5төлем...DF.exe
windows7-x64
10төлем...DF.exe
windows10-2004-x64
1087597.exe
windows7-x64
1087597.exe
windows10-2004-x64
1029146c1ccd...70.exe
windows7-x64
729146c1ccd...70.exe
windows10-2004-x64
72cc3b42957...8e.exe
windows7-x64
102cc3b42957...8e.exe
windows10-2004-x64
10RICHIESTA ...TA.exe
windows7-x64
10RICHIESTA ...TA.exe
windows10-2004-x64
1039c1e12e0a...25c.js
windows7-x64
339c1e12e0a...25c.js
windows10-2004-x64
33f46e10e5f...3b.exe
windows7-x64
103f46e10e5f...3b.exe
windows10-2004-x64
1053074094ad...95dbec
debian-12-mipsel
10632cfc71bd...b1.doc
windows7-x64
10632cfc71bd...b1.doc
windows10-2004-x64
10685dce7a17...03.exe
windows7-x64
10685dce7a17...03.exe
windows10-2004-x64
106c4aab4c3b...e2.exe
windows7-x64
106c4aab4c3b...e2.exe
windows10-2004-x64
1073a52a4c60...c0.exe
windows7-x64
373a52a4c60...c0.exe
windows10-2004-x64
3Inv_7623980.exe
windows7-x64
10Inv_7623980.exe
windows10-2004-x64
108954739d96...a8.ps1
windows7-x64
38954739d96...a8.ps1
windows10-2004-x64
8USD $.exe
windows7-x64
10USD $.exe
windows10-2004-x64
1091d079d937...b9.exe
windows7-x64
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23-12-2024 12:40
Behavioral task
behavioral1
Sample
Order.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Order.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
төлем туралы есеп#454326_PDF.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
төлем туралы есеп#454326_PDF.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
87597.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
87597.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
29146c1ccdf280c8ac9d0c861f8bd222d2d93777c8a822da4d72c64fc3f78670.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
29146c1ccdf280c8ac9d0c861f8bd222d2d93777c8a822da4d72c64fc3f78670.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
2cc3b4295747aeeb5a54b923fdbc9be766ee156c8914f5c07663f7cb1055068e.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
RICHIESTA DI OFFERTA.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
RICHIESTA DI OFFERTA.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
39c1e12e0ada85fa835b623a4698345bf95372bea57a7d3a5070ea1d5d5d825c.js
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
39c1e12e0ada85fa835b623a4698345bf95372bea57a7d3a5070ea1d5d5d825c.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
3f46e10e5fe376b995e2947d1be21955aa8341f39d80cca737109fcf2cf2bf3b.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
3f46e10e5fe376b995e2947d1be21955aa8341f39d80cca737109fcf2cf2bf3b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
53074094addc55786936f3d67d7fe36554a7c4f4f96c06252ae768707295dbec
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral18
Sample
632cfc71bd4734fdd98e48166a52fbc4a48d43640f3375fd882dd374479bffb1.doc
Resource
win7-20240903-en
Behavioral task
behavioral19
Sample
632cfc71bd4734fdd98e48166a52fbc4a48d43640f3375fd882dd374479bffb1.doc
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
Resource
win7-20241010-en
Behavioral task
behavioral21
Sample
685dce7a17356b2a9fe68600ab29af885c591d23221e8f65396478d3a1f5ae03.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
Resource
win7-20240729-en
Behavioral task
behavioral23
Sample
6c4aab4c3bd1ba8f77a781d70ecbc1b4c7dfd9d3c7ad60158fb8d35d1d4246e2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
73a52a4c60d253ccdb79e5d50814d1689a49fd85f9e0a40a0dc57ba7fb54e5c0.exe
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
73a52a4c60d253ccdb79e5d50814d1689a49fd85f9e0a40a0dc57ba7fb54e5c0.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
Inv_7623980.exe
Resource
win7-20240903-en
Behavioral task
behavioral27
Sample
Inv_7623980.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
8954739d960eecd84aa64e657aed72d40567764023ba14e048778d0ebf24cba8.ps1
Resource
win7-20240903-en
Behavioral task
behavioral29
Sample
8954739d960eecd84aa64e657aed72d40567764023ba14e048778d0ebf24cba8.ps1
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
USD $.exe
Resource
win7-20241010-en
Behavioral task
behavioral31
Sample
USD $.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
91d079d9371fa53227e4bb2207ba4d3aa4733feee607773b696779c5e87846b9.exe
Resource
win7-20240903-en
General
-
Target
USD $.exe
-
Size
1.0MB
-
MD5
7098068c07032900ff073b55a8ad8e0b
-
SHA1
5bdda0bc06b935689f29d55b297d0523d82c6bfa
-
SHA256
2d7aac32ea8a8329262ead70ec2f030c1a4061e4edafdf03e605bb9ce606836e
-
SHA512
c5568a37cd6cfa600af5742acd1143d434035e2b5d7caa515ccbf182c6f72030e28a3562ee9f5e9341bcc5aeef45f498434fb8ff6835bc07c04220440d0aaf39
-
SSDEEP
12288:WA72Z5kzykTvNYf3ACtYKWBAZcQEuanCJ4ZTuWnCT2EypSTU0KfOgzUhr2X0GSGl:WAaZ5k7TvqfwCqiZ9149O21FCWZ
Malware Config
Extracted
xloader
2.3
weni
sdmdwang.com
konversationswithkoshie.net
carap.club
eagldeream.com
856380585.xyz
elgallocoffee.com
magetu.info
lovertons.com
theichallenge.com
advancedautorepairsonline.com
wingsstyling.info
tapdaugusta.com
wiloasbanhsgtarewdasc.solutions
donjrisdumb.com
experienceddoctor.com
cloverhillconsultants.com
underwear.show
karensgonewild2020.com
arodsr.com
thefucktardmanual.com
712kenwood.info
telecompink.com
ebizkendra.com
kitkatmp3.com
utformehagen.com
profitsnavigator.com
kathyharvey.com
tongaoffshore.com
vrpreservation.com
hy7128.com
nicolettejohnsonphotography.com
rating.travel
visualartcr.com
nationalbarista.com
lovecartoonforever.com
koimkt.com
directpractice.pro
blockchaincloud360.com
queverenbuenosaires.com
coachmyragolden.com
awree.com
facebookipl.com
rcheapwdbuy.com
trinspinsgreen.com
voxaide.com
ecorner.online
mattvickery.com
regarta.com
fknprfct.com
theessentialstore.net
sunilpsingh.com
ovtnywveba.club
optimalgafa.com
awdjob.info
humachem.com
southeasternsteakcompany.com
centerevents.net
warrenswindowcleans.co.uk
lebullterrier.com
thecxchecker.com
formerknown.com
pupbutler.com
tincanphones.com
tgeuuy.cool
panyu-qqbaby.com
Signatures
-
Xloader family
-
Xloader payload 3 IoCs
resource yara_rule behavioral31/memory/2956-12-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral31/memory/2956-17-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral31/memory/824-22-0x0000000000610000-0x0000000000638000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 728 set thread context of 2956 728 USD $.exe 101 PID 2956 set thread context of 3476 2956 RegSvcs.exe 56 PID 824 set thread context of 3476 824 help.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language USD $.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language help.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
pid Process 728 USD $.exe 728 USD $.exe 728 USD $.exe 2956 RegSvcs.exe 2956 RegSvcs.exe 2956 RegSvcs.exe 2956 RegSvcs.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe 824 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2956 RegSvcs.exe 2956 RegSvcs.exe 2956 RegSvcs.exe 824 help.exe 824 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 728 USD $.exe Token: SeDebugPrivilege 2956 RegSvcs.exe Token: SeDebugPrivilege 824 help.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 728 wrote to memory of 4628 728 USD $.exe 100 PID 728 wrote to memory of 4628 728 USD $.exe 100 PID 728 wrote to memory of 4628 728 USD $.exe 100 PID 728 wrote to memory of 2956 728 USD $.exe 101 PID 728 wrote to memory of 2956 728 USD $.exe 101 PID 728 wrote to memory of 2956 728 USD $.exe 101 PID 728 wrote to memory of 2956 728 USD $.exe 101 PID 728 wrote to memory of 2956 728 USD $.exe 101 PID 728 wrote to memory of 2956 728 USD $.exe 101 PID 3476 wrote to memory of 824 3476 Explorer.EXE 102 PID 3476 wrote to memory of 824 3476 Explorer.EXE 102 PID 3476 wrote to memory of 824 3476 Explorer.EXE 102 PID 824 wrote to memory of 3144 824 help.exe 103 PID 824 wrote to memory of 3144 824 help.exe 103 PID 824 wrote to memory of 3144 824 help.exe 103
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\USD $.exe"C:\Users\Admin\AppData\Local\Temp\USD $.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵PID:4628
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3144
-
-