Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-05-2021 04:28
Static task
static1
Behavioral task
behavioral1
Sample
sa.exe
Resource
win7v20210410
General
-
Target
sa.exe
-
Size
841KB
-
MD5
0aecf41f923bf5cd728a670757af61ed
-
SHA1
57aba2a76789f270cc3a78903c1cd54ec15d2080
-
SHA256
c6f11920b2ae7f0255d65e4b04f9944247438ee4d346dc4745f50602df41007b
-
SHA512
ec827ca487e09e6e74451b0002c9769f882c1a162d0a0f2cfcecf7e6c3b9f2880ff7d25b8114351114a3f8bd6a83383cca183fbe44ea2db353eba10ceba2caf3
Malware Config
Extracted
xloader
2.3
http://www.cats16.com/8u3b/
pipienta.com
wisdomfest.net
jenniferreich.com
bigcanoehomesforless.com
kayandbernard.com
offerbuildingsecrets.com
benleefoto.com
contactlesssoftware.tech
statenislandplumbing.info
lifestylemedicineservices.com
blazerplanning.com
fnatic-skins.club
effectivemarketinginc.com
babyshopit.com
2000deal.com
k12paymentcemter.com
spwakd.com
lesreponses.com
abundando.com
hawkspremierfhc.com
midwestmadeclothing.com
kamuakuinisiapa.com
swirlingheadjewelry.com
donelys.com
stiloksero.com
hoangphucsolar.com
gb-contracting.com
girlboyfriends.com
decadejam.com
glassfullcoffee.com
todoparaconstruccion.com
anygivenrunday.com
newgalaxyindia.com
dahlonegaforless.com
blue-light.tech
web-evo.com
armmotive.com
mollysmulligan.com
penislandbrewer.com
wgrimao.com
dxm-int.net
sarmaayagroup.com
timbraunmusician.com
amazoncovid19tracer.com
peaknband.com
pyqxlz.com
palomachurch.com
surfboardwarehouse.net
burundiacademyst.com
pltcoin.com
workinglifestyle.com
vickybowskill.com
ottawahomevalues.info
jtrainterrain.com
francescoiocca.com
metallitypiercing.com
lashsavings.com
discjockeydelraybeach.com
indicraftsvilla.com
tbq.xyz
arfjkacsgatfzbazpdth.com
appsend.online
cunerier.com
orospucocuguatmaca.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2752-125-0x000000000041D0A0-mapping.dmp xloader behavioral2/memory/2752-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1156-133-0x0000000002900000-0x0000000002929000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
sa.exesa.exewscript.exedescription pid process target process PID 648 set thread context of 2752 648 sa.exe sa.exe PID 2752 set thread context of 2428 2752 sa.exe Explorer.EXE PID 1156 set thread context of 2428 1156 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
sa.exesa.exewscript.exepid process 648 sa.exe 648 sa.exe 2752 sa.exe 2752 sa.exe 2752 sa.exe 2752 sa.exe 1156 wscript.exe 1156 wscript.exe 1156 wscript.exe 1156 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
sa.exewscript.exepid process 2752 sa.exe 2752 sa.exe 2752 sa.exe 1156 wscript.exe 1156 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
sa.exesa.exewscript.exedescription pid process Token: SeDebugPrivilege 648 sa.exe Token: SeDebugPrivilege 2752 sa.exe Token: SeDebugPrivilege 1156 wscript.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
sa.exeExplorer.EXEwscript.exedescription pid process target process PID 648 wrote to memory of 2692 648 sa.exe sa.exe PID 648 wrote to memory of 2692 648 sa.exe sa.exe PID 648 wrote to memory of 2692 648 sa.exe sa.exe PID 648 wrote to memory of 2752 648 sa.exe sa.exe PID 648 wrote to memory of 2752 648 sa.exe sa.exe PID 648 wrote to memory of 2752 648 sa.exe sa.exe PID 648 wrote to memory of 2752 648 sa.exe sa.exe PID 648 wrote to memory of 2752 648 sa.exe sa.exe PID 648 wrote to memory of 2752 648 sa.exe sa.exe PID 2428 wrote to memory of 1156 2428 Explorer.EXE wscript.exe PID 2428 wrote to memory of 1156 2428 Explorer.EXE wscript.exe PID 2428 wrote to memory of 1156 2428 Explorer.EXE wscript.exe PID 1156 wrote to memory of 2120 1156 wscript.exe cmd.exe PID 1156 wrote to memory of 2120 1156 wscript.exe cmd.exe PID 1156 wrote to memory of 2120 1156 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sa.exe"C:\Users\Admin\AppData\Local\Temp\sa.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sa.exe"C:\Users\Admin\AppData\Local\Temp\sa.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\sa.exe"C:\Users\Admin\AppData\Local\Temp\sa.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\sa.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/648-121-0x00000000059C0000-0x00000000059CE000-memory.dmpFilesize
56KB
-
memory/648-123-0x00000000015B0000-0x0000000001616000-memory.dmpFilesize
408KB
-
memory/648-117-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/648-118-0x0000000005720000-0x0000000005721000-memory.dmpFilesize
4KB
-
memory/648-119-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/648-120-0x0000000005680000-0x0000000005B7E000-memory.dmpFilesize
5.0MB
-
memory/648-116-0x0000000005B80000-0x0000000005B81000-memory.dmpFilesize
4KB
-
memory/648-114-0x0000000000B80000-0x0000000000B81000-memory.dmpFilesize
4KB
-
memory/648-122-0x0000000001500000-0x00000000015AC000-memory.dmpFilesize
688KB
-
memory/1156-135-0x0000000004430000-0x00000000044C0000-memory.dmpFilesize
576KB
-
memory/1156-134-0x0000000004500000-0x0000000004820000-memory.dmpFilesize
3.1MB
-
memory/1156-132-0x0000000000360000-0x0000000000387000-memory.dmpFilesize
156KB
-
memory/1156-133-0x0000000002900000-0x0000000002929000-memory.dmpFilesize
164KB
-
memory/1156-130-0x0000000000000000-mapping.dmp
-
memory/2120-131-0x0000000000000000-mapping.dmp
-
memory/2428-129-0x0000000005E10000-0x0000000005F1B000-memory.dmpFilesize
1.0MB
-
memory/2428-136-0x0000000002460000-0x000000000253A000-memory.dmpFilesize
872KB
-
memory/2752-128-0x0000000001370000-0x0000000001381000-memory.dmpFilesize
68KB
-
memory/2752-127-0x0000000000F20000-0x0000000001240000-memory.dmpFilesize
3.1MB
-
memory/2752-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2752-125-0x000000000041D0A0-mapping.dmp