Analysis
-
max time kernel
150s -
max time network
41s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
11-05-2021 13:31
Static task
static1
Behavioral task
behavioral1
Sample
da.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
da.exe
Resource
win10v20210408
General
-
Target
da.exe
-
Size
875KB
-
MD5
9fdf605ce0358540d48502367e637b0a
-
SHA1
1416ebf9b0382a8794bb89f5ee947ec668ce7fdb
-
SHA256
df22601db1675ce639bc8efe21534f7371050ae9637f6cdf38bc23ae6c18efdf
-
SHA512
a194aba3f8c20669ff741ccb59ce7b7023123e1e7984d6d6306a9099d78775ba7bdb92691c26b39522ede6f799f34e96d6b14db1e66429bea26077b95e805bf7
Malware Config
Extracted
xloader
2.3
http://www.cats16.com/8u3b/
pipienta.com
wisdomfest.net
jenniferreich.com
bigcanoehomesforless.com
kayandbernard.com
offerbuildingsecrets.com
benleefoto.com
contactlesssoftware.tech
statenislandplumbing.info
lifestylemedicineservices.com
blazerplanning.com
fnatic-skins.club
effectivemarketinginc.com
babyshopit.com
2000deal.com
k12paymentcemter.com
spwakd.com
lesreponses.com
abundando.com
hawkspremierfhc.com
midwestmadeclothing.com
kamuakuinisiapa.com
swirlingheadjewelry.com
donelys.com
stiloksero.com
hoangphucsolar.com
gb-contracting.com
girlboyfriends.com
decadejam.com
glassfullcoffee.com
todoparaconstruccion.com
anygivenrunday.com
newgalaxyindia.com
dahlonegaforless.com
blue-light.tech
web-evo.com
armmotive.com
mollysmulligan.com
penislandbrewer.com
wgrimao.com
dxm-int.net
sarmaayagroup.com
timbraunmusician.com
amazoncovid19tracer.com
peaknband.com
pyqxlz.com
palomachurch.com
surfboardwarehouse.net
burundiacademyst.com
pltcoin.com
workinglifestyle.com
vickybowskill.com
ottawahomevalues.info
jtrainterrain.com
francescoiocca.com
metallitypiercing.com
lashsavings.com
discjockeydelraybeach.com
indicraftsvilla.com
tbq.xyz
arfjkacsgatfzbazpdth.com
appsend.online
cunerier.com
orospucocuguatmaca.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/476-67-0x000000000041D0A0-mapping.dmp xloader behavioral1/memory/476-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 2 IoCs
Processes:
da.exeda.exedescription pid process target process PID 1612 set thread context of 476 1612 da.exe da.exe PID 476 set thread context of 1272 476 da.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
da.exepid process 476 da.exe 476 da.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
da.exepid process 476 da.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
da.exedescription pid process Token: SeDebugPrivilege 476 da.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
da.exeExplorer.EXEdescription pid process target process PID 1612 wrote to memory of 476 1612 da.exe da.exe PID 1612 wrote to memory of 476 1612 da.exe da.exe PID 1612 wrote to memory of 476 1612 da.exe da.exe PID 1612 wrote to memory of 476 1612 da.exe da.exe PID 1612 wrote to memory of 476 1612 da.exe da.exe PID 1612 wrote to memory of 476 1612 da.exe da.exe PID 1612 wrote to memory of 476 1612 da.exe da.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe PID 1272 wrote to memory of 1108 1272 Explorer.EXE msiexec.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\da.exe"C:\Users\Admin\AppData\Local\Temp\da.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\da.exe"C:\Users\Admin\AppData\Local\Temp\da.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/476-67-0x000000000041D0A0-mapping.dmp
-
memory/476-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/476-69-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/476-70-0x0000000000230000-0x0000000000241000-memory.dmpFilesize
68KB
-
memory/1272-71-0x0000000004AE0000-0x0000000004BA6000-memory.dmpFilesize
792KB
-
memory/1612-60-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/1612-62-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/1612-63-0x0000000000450000-0x0000000000454000-memory.dmpFilesize
16KB
-
memory/1612-64-0x00000000051E0000-0x00000000052A4000-memory.dmpFilesize
784KB
-
memory/1612-65-0x0000000007740000-0x00000000077C1000-memory.dmpFilesize
516KB