Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
03-05-2021 07:02
Static task
static1
Behavioral task
behavioral1
Sample
a3aa510e_by_Libranalysis.exe
Resource
win7v20210410
General
-
Target
a3aa510e_by_Libranalysis.exe
-
Size
531KB
-
MD5
a3aa510eb6f74e8dfc7a8c3bcd0fedf6
-
SHA1
286e81ec896f6746a1ca48e59dc6735c25249a37
-
SHA256
3f359e1a20563017c2f66a4e01136fbd73a9293ca1ce3df2dd880a94b9eee23e
-
SHA512
28c5048dda26762d5859488ef46cc222de632174e35d62e07b05ede307ec35309fd5636b53ba454e26386fb7033a8ae60f3cfe920b075cc1373589b14dfee2aa
Malware Config
Extracted
xloader
2.3
http://www.jqjdgw.com/ued5/
italiancosmeticbeauty.com
zhima7.com
phresheffect.com
comp-savvy.net
xjhtcaum.com
copperbrassgermkey.com
smero.financial
opticsoptimum.com
pisanosportpraxis.com
pediatricfeedrates.com
binsogleam.com
sarahseatter.com
wywatershed.com
smellyhomeshop.com
naviorchidlife.com
cunerier.com
thecornercomputers.com
brightwoodcollection.com
taxprep-repsolutions.net
phukien4u.net
crezcayemprenda.com
terrasroraima.com
vinkot.com
endthefatblogs.com
nwmicrobefreesolutions.com
chandlerguo.com
pacificedgesunglasses.com
hurrygift.com
felocacasa.com
zoom-sides.com
dovesprinklers.com
caravaggioclothing.com
renchengjixie.com
hfctzdsns.club
sukaa.tech
gurukulmitra.com
thedailyprocrastinator.com
xinxiu.store
woodlanddentalcarefl.com
pyperpay.com
fabularo.com
tvdajiang14.com
ihatesammamish.com
bbluebelttvwdbuy.com
replenish-skin.com
qf577.com
freemoneyfornursingschool.com
lpida.com
schmelzens.com
exuberantemodafeminina.com
babylandclothing.com
designer-dropship.com
sbeconlineacademy.com
homeandcabinwoodsigns.com
cqxiangcida.com
806queen.com
metropolisgrowlers.com
easycremationserviceusa.com
greenpis0n.com
vagasportal.com
hargsgroup.com
hyrerecruiting.com
carlsonwagonlit.sucks
beischabig.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3344-126-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3344-127-0x000000000041D070-mapping.dmp xloader behavioral2/memory/4052-134-0x00000000007C0000-0x00000000007E9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
a3aa510e_by_Libranalysis.exea3aa510e_by_Libranalysis.exesystray.exedescription pid process target process PID 3924 set thread context of 3344 3924 a3aa510e_by_Libranalysis.exe a3aa510e_by_Libranalysis.exe PID 3344 set thread context of 3052 3344 a3aa510e_by_Libranalysis.exe Explorer.EXE PID 4052 set thread context of 3052 4052 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
a3aa510e_by_Libranalysis.exea3aa510e_by_Libranalysis.exesystray.exepid process 3924 a3aa510e_by_Libranalysis.exe 3924 a3aa510e_by_Libranalysis.exe 3344 a3aa510e_by_Libranalysis.exe 3344 a3aa510e_by_Libranalysis.exe 3344 a3aa510e_by_Libranalysis.exe 3344 a3aa510e_by_Libranalysis.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe 4052 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
a3aa510e_by_Libranalysis.exesystray.exepid process 3344 a3aa510e_by_Libranalysis.exe 3344 a3aa510e_by_Libranalysis.exe 3344 a3aa510e_by_Libranalysis.exe 4052 systray.exe 4052 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
a3aa510e_by_Libranalysis.exea3aa510e_by_Libranalysis.exesystray.exedescription pid process Token: SeDebugPrivilege 3924 a3aa510e_by_Libranalysis.exe Token: SeDebugPrivilege 3344 a3aa510e_by_Libranalysis.exe Token: SeDebugPrivilege 4052 systray.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
a3aa510e_by_Libranalysis.exeExplorer.EXEsystray.exedescription pid process target process PID 3924 wrote to memory of 3580 3924 a3aa510e_by_Libranalysis.exe a3aa510e_by_Libranalysis.exe PID 3924 wrote to memory of 3580 3924 a3aa510e_by_Libranalysis.exe a3aa510e_by_Libranalysis.exe PID 3924 wrote to memory of 3580 3924 a3aa510e_by_Libranalysis.exe a3aa510e_by_Libranalysis.exe PID 3924 wrote to memory of 3344 3924 a3aa510e_by_Libranalysis.exe a3aa510e_by_Libranalysis.exe PID 3924 wrote to memory of 3344 3924 a3aa510e_by_Libranalysis.exe a3aa510e_by_Libranalysis.exe PID 3924 wrote to memory of 3344 3924 a3aa510e_by_Libranalysis.exe a3aa510e_by_Libranalysis.exe PID 3924 wrote to memory of 3344 3924 a3aa510e_by_Libranalysis.exe a3aa510e_by_Libranalysis.exe PID 3924 wrote to memory of 3344 3924 a3aa510e_by_Libranalysis.exe a3aa510e_by_Libranalysis.exe PID 3924 wrote to memory of 3344 3924 a3aa510e_by_Libranalysis.exe a3aa510e_by_Libranalysis.exe PID 3052 wrote to memory of 4052 3052 Explorer.EXE systray.exe PID 3052 wrote to memory of 4052 3052 Explorer.EXE systray.exe PID 3052 wrote to memory of 4052 3052 Explorer.EXE systray.exe PID 4052 wrote to memory of 1200 4052 systray.exe cmd.exe PID 4052 wrote to memory of 1200 4052 systray.exe cmd.exe PID 4052 wrote to memory of 1200 4052 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a3aa510e_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\a3aa510e_by_Libranalysis.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a3aa510e_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\a3aa510e_by_Libranalysis.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\a3aa510e_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\a3aa510e_by_Libranalysis.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\a3aa510e_by_Libranalysis.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1200-135-0x0000000000000000-mapping.dmp
-
memory/3052-138-0x0000000002E80000-0x0000000002F6B000-memory.dmpFilesize
940KB
-
memory/3052-131-0x0000000008B80000-0x0000000008D0C000-memory.dmpFilesize
1.5MB
-
memory/3344-126-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3344-130-0x0000000000F30000-0x0000000000F41000-memory.dmpFilesize
68KB
-
memory/3344-129-0x0000000001100000-0x0000000001420000-memory.dmpFilesize
3.1MB
-
memory/3344-127-0x000000000041D070-mapping.dmp
-
memory/3924-120-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/3924-119-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/3924-124-0x0000000000D10000-0x0000000000D88000-memory.dmpFilesize
480KB
-
memory/3924-125-0x0000000008010000-0x0000000008041000-memory.dmpFilesize
196KB
-
memory/3924-123-0x000000007F9A0000-0x000000007F9A1000-memory.dmpFilesize
4KB
-
memory/3924-121-0x0000000004F70000-0x0000000004F7D000-memory.dmpFilesize
52KB
-
memory/3924-114-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/3924-122-0x0000000004CD0000-0x00000000051CE000-memory.dmpFilesize
5.0MB
-
memory/3924-118-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/3924-116-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/3924-117-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/4052-133-0x0000000000FB0000-0x0000000000FB6000-memory.dmpFilesize
24KB
-
memory/4052-134-0x00000000007C0000-0x00000000007E9000-memory.dmpFilesize
164KB
-
memory/4052-136-0x0000000004980000-0x0000000004CA0000-memory.dmpFilesize
3.1MB
-
memory/4052-137-0x00000000047E0000-0x0000000004870000-memory.dmpFilesize
576KB
-
memory/4052-132-0x0000000000000000-mapping.dmp