Analysis
-
max time kernel
146s -
max time network
121s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-05-2021 04:28
Static task
static1
Behavioral task
behavioral1
Sample
sa.exe
Resource
win7v20210410
General
-
Target
sa.exe
-
Size
841KB
-
MD5
0aecf41f923bf5cd728a670757af61ed
-
SHA1
57aba2a76789f270cc3a78903c1cd54ec15d2080
-
SHA256
c6f11920b2ae7f0255d65e4b04f9944247438ee4d346dc4745f50602df41007b
-
SHA512
ec827ca487e09e6e74451b0002c9769f882c1a162d0a0f2cfcecf7e6c3b9f2880ff7d25b8114351114a3f8bd6a83383cca183fbe44ea2db353eba10ceba2caf3
Malware Config
Extracted
xloader
2.3
http://www.cats16.com/8u3b/
pipienta.com
wisdomfest.net
jenniferreich.com
bigcanoehomesforless.com
kayandbernard.com
offerbuildingsecrets.com
benleefoto.com
contactlesssoftware.tech
statenislandplumbing.info
lifestylemedicineservices.com
blazerplanning.com
fnatic-skins.club
effectivemarketinginc.com
babyshopit.com
2000deal.com
k12paymentcemter.com
spwakd.com
lesreponses.com
abundando.com
hawkspremierfhc.com
midwestmadeclothing.com
kamuakuinisiapa.com
swirlingheadjewelry.com
donelys.com
stiloksero.com
hoangphucsolar.com
gb-contracting.com
girlboyfriends.com
decadejam.com
glassfullcoffee.com
todoparaconstruccion.com
anygivenrunday.com
newgalaxyindia.com
dahlonegaforless.com
blue-light.tech
web-evo.com
armmotive.com
mollysmulligan.com
penislandbrewer.com
wgrimao.com
dxm-int.net
sarmaayagroup.com
timbraunmusician.com
amazoncovid19tracer.com
peaknband.com
pyqxlz.com
palomachurch.com
surfboardwarehouse.net
burundiacademyst.com
pltcoin.com
workinglifestyle.com
vickybowskill.com
ottawahomevalues.info
jtrainterrain.com
francescoiocca.com
metallitypiercing.com
lashsavings.com
discjockeydelraybeach.com
indicraftsvilla.com
tbq.xyz
arfjkacsgatfzbazpdth.com
appsend.online
cunerier.com
orospucocuguatmaca.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/744-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/744-67-0x000000000041D0A0-mapping.dmp xloader behavioral1/memory/1496-75-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 568 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
sa.exesa.execmmon32.exedescription pid process target process PID 1640 set thread context of 744 1640 sa.exe sa.exe PID 744 set thread context of 1220 744 sa.exe Explorer.EXE PID 1496 set thread context of 1220 1496 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
sa.execmmon32.exepid process 744 sa.exe 744 sa.exe 1496 cmmon32.exe 1496 cmmon32.exe 1496 cmmon32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
sa.execmmon32.exepid process 744 sa.exe 744 sa.exe 744 sa.exe 1496 cmmon32.exe 1496 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
sa.execmmon32.exedescription pid process Token: SeDebugPrivilege 744 sa.exe Token: SeDebugPrivilege 1496 cmmon32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
sa.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1640 wrote to memory of 744 1640 sa.exe sa.exe PID 1640 wrote to memory of 744 1640 sa.exe sa.exe PID 1640 wrote to memory of 744 1640 sa.exe sa.exe PID 1640 wrote to memory of 744 1640 sa.exe sa.exe PID 1640 wrote to memory of 744 1640 sa.exe sa.exe PID 1640 wrote to memory of 744 1640 sa.exe sa.exe PID 1640 wrote to memory of 744 1640 sa.exe sa.exe PID 1220 wrote to memory of 1496 1220 Explorer.EXE cmmon32.exe PID 1220 wrote to memory of 1496 1220 Explorer.EXE cmmon32.exe PID 1220 wrote to memory of 1496 1220 Explorer.EXE cmmon32.exe PID 1220 wrote to memory of 1496 1220 Explorer.EXE cmmon32.exe PID 1496 wrote to memory of 568 1496 cmmon32.exe cmd.exe PID 1496 wrote to memory of 568 1496 cmmon32.exe cmd.exe PID 1496 wrote to memory of 568 1496 cmmon32.exe cmd.exe PID 1496 wrote to memory of 568 1496 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sa.exe"C:\Users\Admin\AppData\Local\Temp\sa.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sa.exe"C:\Users\Admin\AppData\Local\Temp\sa.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\sa.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/568-73-0x0000000000000000-mapping.dmp
-
memory/744-69-0x00000000008A0000-0x0000000000BA3000-memory.dmpFilesize
3.0MB
-
memory/744-70-0x0000000000350000-0x0000000000361000-memory.dmpFilesize
68KB
-
memory/744-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/744-67-0x000000000041D0A0-mapping.dmp
-
memory/1220-78-0x00000000040A0000-0x000000000414C000-memory.dmpFilesize
688KB
-
memory/1220-71-0x0000000004B10000-0x0000000004C41000-memory.dmpFilesize
1.2MB
-
memory/1496-74-0x00000000006C0000-0x00000000006CD000-memory.dmpFilesize
52KB
-
memory/1496-72-0x0000000000000000-mapping.dmp
-
memory/1496-75-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1496-76-0x0000000001F80000-0x0000000002283000-memory.dmpFilesize
3.0MB
-
memory/1496-77-0x0000000001E80000-0x0000000001F10000-memory.dmpFilesize
576KB
-
memory/1640-65-0x0000000007540000-0x00000000075A6000-memory.dmpFilesize
408KB
-
memory/1640-64-0x0000000004F30000-0x0000000004FDC000-memory.dmpFilesize
688KB
-
memory/1640-63-0x0000000000890000-0x000000000089E000-memory.dmpFilesize
56KB
-
memory/1640-60-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/1640-62-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB