Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
22-07-2021 13:01
Static task
static1
Behavioral task
behavioral1
Sample
uiza7XkNGQPRQvb.exe
Resource
win7v20210410
General
-
Target
uiza7XkNGQPRQvb.exe
-
Size
693KB
-
MD5
9d9f2d5ba71372d4bbd85a9088ba7bc7
-
SHA1
353192974e4f523bdcb472478e5a652e194c6481
-
SHA256
a6169937c872aefc3f1e5c13e40f05d9cb0cbba3a16490f134b810b47027b035
-
SHA512
7ea510bdc7057f5442055b8c36b329e8e0c68cdc2c0f93a693e69979307369d2eb662093ecc53ee6b03b2667598fa28b9d01ed15679f98fce2eec911e5c564a8
Malware Config
Extracted
xloader
2.3
http://www.lapashawhite.com/p596/
ushistorical.com
lovepropertylondon.com
acupress-the-point.com
3772548.com
ambientabuse.com
primaveracm.com
themidwestmomblog.com
havasavunma.com
rockyroadbrand.com
zzphys.com
masque-inclusif.com
myeonyeokplus.com
linkernet.pro
zezirma.com
mysiniar.com
andreamall.com
mattesonauto.com
wandopowerinc.com
casaurgence.com
salishseaquilts.com
yourchanceisnow.com
tumulusresearch.com
blendandspend.com
pevention.com
cloudrevolutionawards.com
beadedbodied.com
marylandpaymentrelief.net
5935699.com
silverleafcompanies.com
slxxxhub.com
combatstriking.com
sex-shop.life
cuncunkan.com
italiamo-magagine.com
sfvoterguide.com
2012boulevard.com
mslookbook.com
897tj1.net
cgslnc.net
kashyaptalkz.com
researchcse.com
lunzhu168.com
mlfkt.com
customcardstudio.com
kirklandramblerforsale.com
magetu.info
wptheme247.com
purposedenver.com
journaldelaphotographie.com
yieldwadi.site
mobilefriendlysites.com
ocularjournal.com
consigli.energy
infintylights.com
itcohempproject.com
montcairo.net
allegrohascockroaches.com
flexbandofficial.com
greatindiapropertyshow.com
kabin-fever.com
designsoc.com
javlao.com
controltower.services
masihsarap.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1656-126-0x000000000041D060-mapping.dmp xloader behavioral2/memory/1656-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1932-134-0x0000000002C10000-0x0000000002C39000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
uiza7XkNGQPRQvb.exeuiza7XkNGQPRQvb.exeipconfig.exedescription pid process target process PID 3412 set thread context of 1656 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 1656 set thread context of 2492 1656 uiza7XkNGQPRQvb.exe Explorer.EXE PID 1656 set thread context of 2492 1656 uiza7XkNGQPRQvb.exe Explorer.EXE PID 1932 set thread context of 2492 1932 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1932 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
uiza7XkNGQPRQvb.exeuiza7XkNGQPRQvb.exeipconfig.exepid process 3412 uiza7XkNGQPRQvb.exe 3412 uiza7XkNGQPRQvb.exe 3412 uiza7XkNGQPRQvb.exe 3412 uiza7XkNGQPRQvb.exe 3412 uiza7XkNGQPRQvb.exe 3412 uiza7XkNGQPRQvb.exe 3412 uiza7XkNGQPRQvb.exe 1656 uiza7XkNGQPRQvb.exe 1656 uiza7XkNGQPRQvb.exe 1656 uiza7XkNGQPRQvb.exe 1656 uiza7XkNGQPRQvb.exe 1656 uiza7XkNGQPRQvb.exe 1656 uiza7XkNGQPRQvb.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe 1932 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2492 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
uiza7XkNGQPRQvb.exeipconfig.exepid process 1656 uiza7XkNGQPRQvb.exe 1656 uiza7XkNGQPRQvb.exe 1656 uiza7XkNGQPRQvb.exe 1656 uiza7XkNGQPRQvb.exe 1932 ipconfig.exe 1932 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
uiza7XkNGQPRQvb.exeuiza7XkNGQPRQvb.exeipconfig.exedescription pid process Token: SeDebugPrivilege 3412 uiza7XkNGQPRQvb.exe Token: SeDebugPrivilege 1656 uiza7XkNGQPRQvb.exe Token: SeDebugPrivilege 1932 ipconfig.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2492 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
uiza7XkNGQPRQvb.exeExplorer.EXEipconfig.exedescription pid process target process PID 3412 wrote to memory of 2128 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 2128 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 2128 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 2152 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 2152 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 2152 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 2320 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 2320 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 2320 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 1656 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 1656 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 1656 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 1656 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 1656 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 3412 wrote to memory of 1656 3412 uiza7XkNGQPRQvb.exe uiza7XkNGQPRQvb.exe PID 2492 wrote to memory of 1932 2492 Explorer.EXE ipconfig.exe PID 2492 wrote to memory of 1932 2492 Explorer.EXE ipconfig.exe PID 2492 wrote to memory of 1932 2492 Explorer.EXE ipconfig.exe PID 1932 wrote to memory of 2252 1932 ipconfig.exe cmd.exe PID 1932 wrote to memory of 2252 1932 ipconfig.exe cmd.exe PID 1932 wrote to memory of 2252 1932 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\uiza7XkNGQPRQvb.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1656-126-0x000000000041D060-mapping.dmp
-
memory/1656-130-0x0000000001530000-0x0000000001541000-memory.dmpFilesize
68KB
-
memory/1656-127-0x0000000001210000-0x0000000001530000-memory.dmpFilesize
3.1MB
-
memory/1656-128-0x0000000000DD0000-0x0000000000DE1000-memory.dmpFilesize
68KB
-
memory/1656-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1932-134-0x0000000002C10000-0x0000000002C39000-memory.dmpFilesize
164KB
-
memory/1932-137-0x0000000002E50000-0x0000000002EE0000-memory.dmpFilesize
576KB
-
memory/1932-136-0x0000000002F60000-0x0000000003280000-memory.dmpFilesize
3.1MB
-
memory/1932-133-0x00000000002D0000-0x00000000002DB000-memory.dmpFilesize
44KB
-
memory/1932-132-0x0000000000000000-mapping.dmp
-
memory/2252-135-0x0000000000000000-mapping.dmp
-
memory/2492-129-0x0000000003390000-0x0000000003478000-memory.dmpFilesize
928KB
-
memory/2492-138-0x0000000001470000-0x0000000001529000-memory.dmpFilesize
740KB
-
memory/2492-131-0x00000000059F0000-0x0000000005B57000-memory.dmpFilesize
1.4MB
-
memory/3412-120-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/3412-116-0x00000000029B0000-0x00000000029B1000-memory.dmpFilesize
4KB
-
memory/3412-117-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/3412-118-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/3412-114-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/3412-119-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/3412-121-0x0000000005100000-0x00000000055FE000-memory.dmpFilesize
5.0MB
-
memory/3412-124-0x0000000008740000-0x000000000876F000-memory.dmpFilesize
188KB
-
memory/3412-123-0x00000000086C0000-0x0000000008732000-memory.dmpFilesize
456KB
-
memory/3412-122-0x00000000055E0000-0x00000000055FB000-memory.dmpFilesize
108KB