Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-07-2021 13:01
Static task
static1
Behavioral task
behavioral1
Sample
uiza7XkNGQPRQvb.exe
Resource
win7v20210410
General
-
Target
uiza7XkNGQPRQvb.exe
-
Size
693KB
-
MD5
9d9f2d5ba71372d4bbd85a9088ba7bc7
-
SHA1
353192974e4f523bdcb472478e5a652e194c6481
-
SHA256
a6169937c872aefc3f1e5c13e40f05d9cb0cbba3a16490f134b810b47027b035
-
SHA512
7ea510bdc7057f5442055b8c36b329e8e0c68cdc2c0f93a693e69979307369d2eb662093ecc53ee6b03b2667598fa28b9d01ed15679f98fce2eec911e5c564a8
Malware Config
Extracted
xloader
2.3
http://www.lapashawhite.com/p596/
ushistorical.com
lovepropertylondon.com
acupress-the-point.com
3772548.com
ambientabuse.com
primaveracm.com
themidwestmomblog.com
havasavunma.com
rockyroadbrand.com
zzphys.com
masque-inclusif.com
myeonyeokplus.com
linkernet.pro
zezirma.com
mysiniar.com
andreamall.com
mattesonauto.com
wandopowerinc.com
casaurgence.com
salishseaquilts.com
yourchanceisnow.com
tumulusresearch.com
blendandspend.com
pevention.com
cloudrevolutionawards.com
beadedbodied.com
marylandpaymentrelief.net
5935699.com
silverleafcompanies.com
slxxxhub.com
combatstriking.com
sex-shop.life
cuncunkan.com
italiamo-magagine.com
sfvoterguide.com
2012boulevard.com
mslookbook.com
897tj1.net
cgslnc.net
kashyaptalkz.com
researchcse.com
lunzhu168.com
mlfkt.com
customcardstudio.com
kirklandramblerforsale.com
magetu.info
wptheme247.com
purposedenver.com
journaldelaphotographie.com
yieldwadi.site
mobilefriendlysites.com
ocularjournal.com
consigli.energy
infintylights.com
itcohempproject.com
montcairo.net
allegrohascockroaches.com
flexbandofficial.com
greatindiapropertyshow.com
kabin-fever.com
designsoc.com
javlao.com
controltower.services
masihsarap.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/300-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/300-67-0x000000000041D060-mapping.dmp xloader behavioral1/memory/332-74-0x00000000000F0000-0x0000000000119000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1884 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
uiza7XkNGQPRQvb.exeuiza7XkNGQPRQvb.execmstp.exedescription pid process target process PID 768 set thread context of 300 768 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 300 set thread context of 1288 300 uiza7XkNGQPRQvb.exe Explorer.EXE PID 332 set thread context of 1288 332 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
uiza7XkNGQPRQvb.exeuiza7XkNGQPRQvb.execmstp.exepid process 768 uiza7XkNGQPRQvb.exe 300 uiza7XkNGQPRQvb.exe 300 uiza7XkNGQPRQvb.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe 332 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
uiza7XkNGQPRQvb.execmstp.exepid process 300 uiza7XkNGQPRQvb.exe 300 uiza7XkNGQPRQvb.exe 300 uiza7XkNGQPRQvb.exe 332 cmstp.exe 332 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
uiza7XkNGQPRQvb.exeuiza7XkNGQPRQvb.execmstp.exedescription pid process Token: SeDebugPrivilege 768 uiza7XkNGQPRQvb.exe Token: SeDebugPrivilege 300 uiza7XkNGQPRQvb.exe Token: SeDebugPrivilege 332 cmstp.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
uiza7XkNGQPRQvb.exeExplorer.EXEcmstp.exedescription pid process target process PID 768 wrote to memory of 300 768 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 768 wrote to memory of 300 768 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 768 wrote to memory of 300 768 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 768 wrote to memory of 300 768 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 768 wrote to memory of 300 768 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 768 wrote to memory of 300 768 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 768 wrote to memory of 300 768 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 1288 wrote to memory of 332 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 332 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 332 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 332 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 332 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 332 1288 Explorer.EXE cmstp.exe PID 1288 wrote to memory of 332 1288 Explorer.EXE cmstp.exe PID 332 wrote to memory of 1884 332 cmstp.exe cmd.exe PID 332 wrote to memory of 1884 332 cmstp.exe cmd.exe PID 332 wrote to memory of 1884 332 cmstp.exe cmd.exe PID 332 wrote to memory of 1884 332 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/300-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/300-69-0x0000000000200000-0x0000000000211000-memory.dmpFilesize
68KB
-
memory/300-68-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/300-67-0x000000000041D060-mapping.dmp
-
memory/332-73-0x0000000000420000-0x0000000000438000-memory.dmpFilesize
96KB
-
memory/332-71-0x0000000000000000-mapping.dmp
-
memory/332-77-0x0000000000640000-0x00000000006D0000-memory.dmpFilesize
576KB
-
memory/332-76-0x0000000002170000-0x0000000002473000-memory.dmpFilesize
3.0MB
-
memory/332-74-0x00000000000F0000-0x0000000000119000-memory.dmpFilesize
164KB
-
memory/332-72-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/768-62-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/768-60-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/768-65-0x0000000000520000-0x000000000054F000-memory.dmpFilesize
188KB
-
memory/768-63-0x00000000004A0000-0x00000000004BB000-memory.dmpFilesize
108KB
-
memory/768-64-0x0000000005EE0000-0x0000000005F52000-memory.dmpFilesize
456KB
-
memory/1288-70-0x0000000006F50000-0x000000000709C000-memory.dmpFilesize
1.3MB
-
memory/1288-78-0x0000000003BD0000-0x0000000003C9F000-memory.dmpFilesize
828KB
-
memory/1884-75-0x0000000000000000-mapping.dmp