Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-05-2021 10:02
Static task
static1
Behavioral task
behavioral1
Sample
e9777bb4_by_Libranalysis.exe
Resource
win7v20210410
General
-
Target
e9777bb4_by_Libranalysis.exe
-
Size
920KB
-
MD5
e9777bb4745f38009a1d806392a437e5
-
SHA1
76ffc32ba98dd84e396af77ad4311d99b3a1bbb0
-
SHA256
eb8c5fa3da30f5d972e7d30767099990aadce5af9e046a2765b0c64222eab118
-
SHA512
794f80a25ae343075421e2d6a030d3a30ef0f2790649fad1c7fc80b31b4ce9d755dfe10634e0d28a684f39d2cffec0c8e7c17d18547df88335ef2d5c2de29f0f
Malware Config
Extracted
xloader
2.3
http://www.asconstructionin.com/m3rc/
manonkelley.com
prosperouspromises.com
biglebowlski.com
zhenyash.com
wayinfinite.com
vaginalmedicine.com
garnogroup.com
6-8-8-8-8.website
universtal.com
gillet.pro
hwrfxkna.com
unapersonaestabien.com
organicdiehards.com
santini7.com
salt9pepper.com
ericasorganiclife.com
vipgifts.online
mariozumbo.com
genetikfatura.com
heypapabear.com
saniorsterimist.com
the-bold-type.com
maxitoto.com
bluemanmoon.com
providenceoffices.com
jimsklena.com
thefritzserpong.com
qlmstore.com
thetipsytwo.com
cunerier.com
seniorliving100ig.com
danuvia.net
thegijofficial.com
nanogentherapeutics.com
paradajaime.com
nononenseforex.com
hsrinspection.com
labarberiadesamu.com
viviangee.net
shhhapparel.com
100hoodia.com
drlisatharler.com
kefeiping.com
rsw111004.com
irisxorose.com
arabacamfilmi.com
iconchen.com
dhinchakk.com
monitoryourproperty.com
justinforga.com
api-pay-app.com
siplamedia.com
voltageweldingmasks.com
dirtylyxx.com
thelashingladybug.com
cageusa.com
avaatraelegant.com
faydety.info
doggyfacemask.com
virtualtoursthailand.com
northtlc.com
3911599.com
freelancer.wales
gudamma.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1600-124-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/1600-125-0x000000000041D030-mapping.dmp xloader behavioral2/memory/2804-133-0x00000000030B0000-0x00000000030D8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
e9777bb4_by_Libranalysis.exee9777bb4_by_Libranalysis.execontrol.exedescription pid process target process PID 856 set thread context of 1600 856 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 1600 set thread context of 3052 1600 e9777bb4_by_Libranalysis.exe Explorer.EXE PID 2804 set thread context of 3052 2804 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
e9777bb4_by_Libranalysis.exee9777bb4_by_Libranalysis.execontrol.exepid process 856 e9777bb4_by_Libranalysis.exe 856 e9777bb4_by_Libranalysis.exe 856 e9777bb4_by_Libranalysis.exe 856 e9777bb4_by_Libranalysis.exe 856 e9777bb4_by_Libranalysis.exe 1600 e9777bb4_by_Libranalysis.exe 1600 e9777bb4_by_Libranalysis.exe 1600 e9777bb4_by_Libranalysis.exe 1600 e9777bb4_by_Libranalysis.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe 2804 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
e9777bb4_by_Libranalysis.execontrol.exepid process 1600 e9777bb4_by_Libranalysis.exe 1600 e9777bb4_by_Libranalysis.exe 1600 e9777bb4_by_Libranalysis.exe 2804 control.exe 2804 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e9777bb4_by_Libranalysis.exee9777bb4_by_Libranalysis.execontrol.exedescription pid process Token: SeDebugPrivilege 856 e9777bb4_by_Libranalysis.exe Token: SeDebugPrivilege 1600 e9777bb4_by_Libranalysis.exe Token: SeDebugPrivilege 2804 control.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
e9777bb4_by_Libranalysis.exeExplorer.EXEcontrol.exedescription pid process target process PID 856 wrote to memory of 1516 856 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 856 wrote to memory of 1516 856 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 856 wrote to memory of 1516 856 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 856 wrote to memory of 1600 856 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 856 wrote to memory of 1600 856 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 856 wrote to memory of 1600 856 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 856 wrote to memory of 1600 856 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 856 wrote to memory of 1600 856 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 856 wrote to memory of 1600 856 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 3052 wrote to memory of 2804 3052 Explorer.EXE control.exe PID 3052 wrote to memory of 2804 3052 Explorer.EXE control.exe PID 3052 wrote to memory of 2804 3052 Explorer.EXE control.exe PID 2804 wrote to memory of 1316 2804 control.exe cmd.exe PID 2804 wrote to memory of 1316 2804 control.exe cmd.exe PID 2804 wrote to memory of 1316 2804 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e9777bb4_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\e9777bb4_by_Libranalysis.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e9777bb4_by_Libranalysis.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\e9777bb4_by_Libranalysis.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\e9777bb4_by_Libranalysis.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/856-114-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB
-
memory/856-116-0x0000000007DF0000-0x0000000007DF1000-memory.dmpFilesize
4KB
-
memory/856-117-0x0000000007990000-0x0000000007991000-memory.dmpFilesize
4KB
-
memory/856-118-0x00000000076E0000-0x00000000076E1000-memory.dmpFilesize
4KB
-
memory/856-119-0x0000000007960000-0x0000000007961000-memory.dmpFilesize
4KB
-
memory/856-120-0x000000000AEA0000-0x000000000AEA1000-memory.dmpFilesize
4KB
-
memory/856-121-0x0000000004AF0000-0x0000000004AFE000-memory.dmpFilesize
56KB
-
memory/856-122-0x0000000005520000-0x00000000055B0000-memory.dmpFilesize
576KB
-
memory/856-123-0x0000000006720000-0x0000000006761000-memory.dmpFilesize
260KB
-
memory/1316-131-0x0000000000000000-mapping.dmp
-
memory/1600-125-0x000000000041D030-mapping.dmp
-
memory/1600-127-0x0000000001430000-0x0000000001750000-memory.dmpFilesize
3.1MB
-
memory/1600-128-0x0000000000FD0000-0x0000000000FE0000-memory.dmpFilesize
64KB
-
memory/1600-124-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2804-130-0x0000000000000000-mapping.dmp
-
memory/2804-132-0x0000000000150000-0x0000000000170000-memory.dmpFilesize
128KB
-
memory/2804-133-0x00000000030B0000-0x00000000030D8000-memory.dmpFilesize
160KB
-
memory/2804-134-0x00000000045E0000-0x0000000004900000-memory.dmpFilesize
3.1MB
-
memory/2804-135-0x0000000004990000-0x0000000004A1F000-memory.dmpFilesize
572KB
-
memory/3052-129-0x0000000004DA0000-0x0000000004ED5000-memory.dmpFilesize
1.2MB
-
memory/3052-136-0x0000000005F70000-0x000000000609F000-memory.dmpFilesize
1.2MB