Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
05-05-2021 19:09
Static task
static1
Behavioral task
behavioral1
Sample
6676755EU.exe
Resource
win7v20210408
General
-
Target
6676755EU.exe
-
Size
392KB
-
MD5
21aded2e81b866f45ecfc74f98313388
-
SHA1
afe79c64082ebdab80852f16e94ec852039c66d5
-
SHA256
658b1b36afe7b456ed4ee5935072485e535a524dfbb863e14ee9fe4fbd5884cb
-
SHA512
833d047e96e10e717c34f482448cf7ce775604d1797aede87b822967477e1c107c190c5b7e1f20d70759469db75137028f18345ed0628a4cb12a1a655027fca6
Malware Config
Extracted
xloader
2.3
http://www.wwwnptpool.com/cea0/
answerwith.com
bingji5.com
choicesrecoverytrainings.com
goodyearpromotions.com
projectguruji.com
outofsandbox.com
chicagosingersforhire.com
goprosquad.com
askmohsin.com
avangardinmobiliaria.com
ultimabritannia.com
alimentafricain.com
recruit-marilyn.com
massu-blog.com
commandsilicon.icu
clearchannel.sucks
greenatlasng.com
spatialdesignoxford.com
nurzia.net
technocratbusiness.com
dentdont-express.com
nanomist-sprayer.com
ndawir05.space
good402o8.com
pizzeriacorecor.com
rent.zone
bunies3.com
eeserfi.com
strabet365.com
beeriderrebates.com
vr385.com
tuljasharma.com
container-bnb.com
infolafinanciere.com
globalpvmarketing.com
berandabintoro.com
levantinenaturals.com
cosydrink.com
alltegori.com
fortunitystar.club
comedypizza.net
tinnitus-center-frankfurt.net
igenmarijuana.com
kennewickriverfront.net
parbakedparties.com
scdphispaniccaucus.com
upcellsmartphones.com
bowwowclothingco.com
ranchplaza.com
ottonlineeducation.com
legalleadslab.com
smartchoicesmall.com
collectivesoma.com
primaverastorecolombia.com
gorisingcaptial.com
pridenjoyenterprises.com
emafrancois.com
editmatters.info
tiendadigitalmundial.com
wearethenursery.com
meshlyft.com
casketofnuts.com
theserialgirlfriend.com
culturaretro.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3972-114-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3972-115-0x000000000041D0B0-mapping.dmp xloader behavioral2/memory/3904-116-0x00000000009B0000-0x00000000009DA000-memory.dmp xloader behavioral2/memory/3680-126-0x0000000000540000-0x0000000000569000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
6676755EU.exe6676755EU.exemsiexec.exedescription pid process target process PID 3904 set thread context of 3972 3904 6676755EU.exe 6676755EU.exe PID 3972 set thread context of 2996 3972 6676755EU.exe Explorer.EXE PID 3680 set thread context of 2996 3680 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
6676755EU.exemsiexec.exepid process 3972 6676755EU.exe 3972 6676755EU.exe 3972 6676755EU.exe 3972 6676755EU.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe 3680 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
6676755EU.exemsiexec.exepid process 3972 6676755EU.exe 3972 6676755EU.exe 3972 6676755EU.exe 3680 msiexec.exe 3680 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6676755EU.exemsiexec.exedescription pid process Token: SeDebugPrivilege 3972 6676755EU.exe Token: SeDebugPrivilege 3680 msiexec.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
6676755EU.exeExplorer.EXEmsiexec.exedescription pid process target process PID 3904 wrote to memory of 3972 3904 6676755EU.exe 6676755EU.exe PID 3904 wrote to memory of 3972 3904 6676755EU.exe 6676755EU.exe PID 3904 wrote to memory of 3972 3904 6676755EU.exe 6676755EU.exe PID 3904 wrote to memory of 3972 3904 6676755EU.exe 6676755EU.exe PID 3904 wrote to memory of 3972 3904 6676755EU.exe 6676755EU.exe PID 3904 wrote to memory of 3972 3904 6676755EU.exe 6676755EU.exe PID 2996 wrote to memory of 3680 2996 Explorer.EXE msiexec.exe PID 2996 wrote to memory of 3680 2996 Explorer.EXE msiexec.exe PID 2996 wrote to memory of 3680 2996 Explorer.EXE msiexec.exe PID 3680 wrote to memory of 1280 3680 msiexec.exe cmd.exe PID 3680 wrote to memory of 1280 3680 msiexec.exe cmd.exe PID 3680 wrote to memory of 1280 3680 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6676755EU.exe"C:\Users\Admin\AppData\Local\Temp\6676755EU.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6676755EU.exe"C:\Users\Admin\AppData\Local\Temp\6676755EU.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\6676755EU.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1280-125-0x0000000000000000-mapping.dmp
-
memory/2996-120-0x0000000004D10000-0x0000000004E7F000-memory.dmpFilesize
1.4MB
-
memory/2996-129-0x0000000004E80000-0x0000000004FFB000-memory.dmpFilesize
1.5MB
-
memory/3680-126-0x0000000000540000-0x0000000000569000-memory.dmpFilesize
164KB
-
memory/3680-121-0x0000000000000000-mapping.dmp
-
memory/3680-124-0x0000000000BA0000-0x0000000000BB2000-memory.dmpFilesize
72KB
-
memory/3680-127-0x0000000004830000-0x0000000004B50000-memory.dmpFilesize
3.1MB
-
memory/3680-128-0x00000000044F0000-0x000000000457F000-memory.dmpFilesize
572KB
-
memory/3904-116-0x00000000009B0000-0x00000000009DA000-memory.dmpFilesize
168KB
-
memory/3972-119-0x0000000000430000-0x00000000004DE000-memory.dmpFilesize
696KB
-
memory/3972-118-0x0000000000980000-0x0000000000CA0000-memory.dmpFilesize
3.1MB
-
memory/3972-114-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3972-115-0x000000000041D0B0-mapping.dmp