Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-05-2021 11:02
Static task
static1
Behavioral task
behavioral1
Sample
e9777bb4_by_Libranalysis.exe
Resource
win7v20210408
General
-
Target
e9777bb4_by_Libranalysis.exe
-
Size
920KB
-
MD5
e9777bb4745f38009a1d806392a437e5
-
SHA1
76ffc32ba98dd84e396af77ad4311d99b3a1bbb0
-
SHA256
eb8c5fa3da30f5d972e7d30767099990aadce5af9e046a2765b0c64222eab118
-
SHA512
794f80a25ae343075421e2d6a030d3a30ef0f2790649fad1c7fc80b31b4ce9d755dfe10634e0d28a684f39d2cffec0c8e7c17d18547df88335ef2d5c2de29f0f
Malware Config
Extracted
xloader
2.3
http://www.asconstructionin.com/m3rc/
manonkelley.com
prosperouspromises.com
biglebowlski.com
zhenyash.com
wayinfinite.com
vaginalmedicine.com
garnogroup.com
6-8-8-8-8.website
universtal.com
gillet.pro
hwrfxkna.com
unapersonaestabien.com
organicdiehards.com
santini7.com
salt9pepper.com
ericasorganiclife.com
vipgifts.online
mariozumbo.com
genetikfatura.com
heypapabear.com
saniorsterimist.com
the-bold-type.com
maxitoto.com
bluemanmoon.com
providenceoffices.com
jimsklena.com
thefritzserpong.com
qlmstore.com
thetipsytwo.com
cunerier.com
seniorliving100ig.com
danuvia.net
thegijofficial.com
nanogentherapeutics.com
paradajaime.com
nononenseforex.com
hsrinspection.com
labarberiadesamu.com
viviangee.net
shhhapparel.com
100hoodia.com
drlisatharler.com
kefeiping.com
rsw111004.com
irisxorose.com
arabacamfilmi.com
iconchen.com
dhinchakk.com
monitoryourproperty.com
justinforga.com
api-pay-app.com
siplamedia.com
voltageweldingmasks.com
dirtylyxx.com
thelashingladybug.com
cageusa.com
avaatraelegant.com
faydety.info
doggyfacemask.com
virtualtoursthailand.com
northtlc.com
3911599.com
freelancer.wales
gudamma.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3428-124-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3428-125-0x000000000041D030-mapping.dmp xloader behavioral2/memory/2244-133-0x0000000002980000-0x00000000029A8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
e9777bb4_by_Libranalysis.exee9777bb4_by_Libranalysis.exewscript.exedescription pid process target process PID 808 set thread context of 3428 808 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 3428 set thread context of 2428 3428 e9777bb4_by_Libranalysis.exe Explorer.EXE PID 2244 set thread context of 2428 2244 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
e9777bb4_by_Libranalysis.exee9777bb4_by_Libranalysis.exewscript.exepid process 808 e9777bb4_by_Libranalysis.exe 808 e9777bb4_by_Libranalysis.exe 808 e9777bb4_by_Libranalysis.exe 3428 e9777bb4_by_Libranalysis.exe 3428 e9777bb4_by_Libranalysis.exe 3428 e9777bb4_by_Libranalysis.exe 3428 e9777bb4_by_Libranalysis.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe 2244 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2428 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
e9777bb4_by_Libranalysis.exewscript.exepid process 3428 e9777bb4_by_Libranalysis.exe 3428 e9777bb4_by_Libranalysis.exe 3428 e9777bb4_by_Libranalysis.exe 2244 wscript.exe 2244 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e9777bb4_by_Libranalysis.exee9777bb4_by_Libranalysis.exewscript.exedescription pid process Token: SeDebugPrivilege 808 e9777bb4_by_Libranalysis.exe Token: SeDebugPrivilege 3428 e9777bb4_by_Libranalysis.exe Token: SeDebugPrivilege 2244 wscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2428 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e9777bb4_by_Libranalysis.exeExplorer.EXEwscript.exedescription pid process target process PID 808 wrote to memory of 3428 808 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 808 wrote to memory of 3428 808 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 808 wrote to memory of 3428 808 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 808 wrote to memory of 3428 808 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 808 wrote to memory of 3428 808 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 808 wrote to memory of 3428 808 e9777bb4_by_Libranalysis.exe e9777bb4_by_Libranalysis.exe PID 2428 wrote to memory of 2244 2428 Explorer.EXE wscript.exe PID 2428 wrote to memory of 2244 2428 Explorer.EXE wscript.exe PID 2428 wrote to memory of 2244 2428 Explorer.EXE wscript.exe PID 2244 wrote to memory of 4060 2244 wscript.exe cmd.exe PID 2244 wrote to memory of 4060 2244 wscript.exe cmd.exe PID 2244 wrote to memory of 4060 2244 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e9777bb4_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\e9777bb4_by_Libranalysis.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e9777bb4_by_Libranalysis.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\e9777bb4_by_Libranalysis.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/808-123-0x00000000062E0000-0x0000000006321000-memory.dmpFilesize
260KB
-
memory/808-114-0x0000000000E50000-0x0000000000E51000-memory.dmpFilesize
4KB
-
memory/808-117-0x0000000007E10000-0x0000000007E11000-memory.dmpFilesize
4KB
-
memory/808-118-0x0000000008120000-0x0000000008121000-memory.dmpFilesize
4KB
-
memory/808-122-0x0000000005C50000-0x0000000005CE0000-memory.dmpFilesize
576KB
-
memory/808-120-0x000000000B660000-0x000000000B661000-memory.dmpFilesize
4KB
-
memory/808-116-0x0000000008520000-0x0000000008521000-memory.dmpFilesize
4KB
-
memory/808-121-0x0000000003290000-0x000000000329E000-memory.dmpFilesize
56KB
-
memory/808-119-0x0000000008280000-0x0000000008281000-memory.dmpFilesize
4KB
-
memory/2244-133-0x0000000002980000-0x00000000029A8000-memory.dmpFilesize
160KB
-
memory/2244-135-0x0000000004900000-0x000000000498F000-memory.dmpFilesize
572KB
-
memory/2244-132-0x0000000000940000-0x0000000000967000-memory.dmpFilesize
156KB
-
memory/2244-130-0x0000000000000000-mapping.dmp
-
memory/2244-134-0x0000000004A50000-0x0000000004D70000-memory.dmpFilesize
3.1MB
-
memory/2428-136-0x0000000005920000-0x00000000059DB000-memory.dmpFilesize
748KB
-
memory/2428-129-0x00000000064E0000-0x0000000006655000-memory.dmpFilesize
1.5MB
-
memory/3428-125-0x000000000041D030-mapping.dmp
-
memory/3428-127-0x00000000019C0000-0x0000000001CE0000-memory.dmpFilesize
3.1MB
-
memory/3428-128-0x0000000001CE0000-0x0000000001CF0000-memory.dmpFilesize
64KB
-
memory/3428-124-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4060-131-0x0000000000000000-mapping.dmp