Analysis
-
max time kernel
146s -
max time network
177s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
26-08-2021 12:27
Static task
static1
Behavioral task
behavioral1
Sample
PO650.exe
Resource
win7v20210410
General
-
Target
PO650.exe
-
Size
260KB
-
MD5
0f9ed47f1ffe3b1cd242b7872f4ce341
-
SHA1
37c2b669d727b1aec796644c1f4f884f0ad86944
-
SHA256
d7abd3634174ad687ef4153f268667361c7177b73871c7dbd296659d918e0d36
-
SHA512
b739a86c7ba735fe40e7630603519d2383b7615ab5c96780138455496da804e19a3d8b3228afb98403b84cdf9b769b064af899f173dd044bd313b1e32d4a18bf
Malware Config
Extracted
xloader
2.3
c28h
http://www.yourweddingscent.online/c28h/
xn--osegredodameditao-nqb9e.com
blakepleasant.com
midnightindulgence.com
lungx.com
goldenretrieversmn.com
thecapshooter.com
luxuryledlighting.com
coachlind.com
jewelryart-byirene.com
legacyvending.net
staffjet.info
geogest.com
okmulgeedream.center
mexicoifbbproleague.net
tomrings.com
kidsomia.com
learnwithalinguist.com
getboardsuited.com
aiyuc.com
wowmanship.com
zcw58736.com
brava94fm.com
mayuraindia.com
sportclever.com
elcars.info
citestpridom20200814092033.net
fleurtigresse.com
zfcai1688.com
glucosecur.com
hyrrp.com
naplesfloridalifestylehomes.com
elegantsuperfoods.com
manoircarlhanjess.com
ezprone.com
spirituallystrong.net
4acostleyst.com
connectedvpn.com
themetathought.com
cartscroll.com
toiletoshop.com
pop-down.space
winatlife-blog.com
progressglobe.com
shopcamera.net
jordanshoeweb.com
theuneducationofamerica.com
bubelu.net
foreignpal.com
courtdistribute.com
librettostay.com
7arfok.com
joannetaylorpr.com
realinvest-egy.com
cerachip.com
welcometoeverywhere.com
rifepackaging.com
alphameresa.com
gylvs.com
izmoo2-hoeiprotein-review.com
airpodanchor.com
conhecimentovivo.technology
cherrisesimon.com
mileybarcus.com
tubekhan.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1752-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1368-70-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1588 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO650.exePO650.execolorcpl.exedescription pid process target process PID 1080 set thread context of 1752 1080 PO650.exe PO650.exe PID 1752 set thread context of 1256 1752 PO650.exe Explorer.EXE PID 1368 set thread context of 1256 1368 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
PO650.execolorcpl.exepid process 1752 PO650.exe 1752 PO650.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe 1368 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO650.exePO650.execolorcpl.exepid process 1080 PO650.exe 1752 PO650.exe 1752 PO650.exe 1752 PO650.exe 1368 colorcpl.exe 1368 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO650.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1752 PO650.exe Token: SeDebugPrivilege 1368 colorcpl.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
PO650.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1080 wrote to memory of 1752 1080 PO650.exe PO650.exe PID 1080 wrote to memory of 1752 1080 PO650.exe PO650.exe PID 1080 wrote to memory of 1752 1080 PO650.exe PO650.exe PID 1080 wrote to memory of 1752 1080 PO650.exe PO650.exe PID 1080 wrote to memory of 1752 1080 PO650.exe PO650.exe PID 1256 wrote to memory of 1368 1256 Explorer.EXE colorcpl.exe PID 1256 wrote to memory of 1368 1256 Explorer.EXE colorcpl.exe PID 1256 wrote to memory of 1368 1256 Explorer.EXE colorcpl.exe PID 1256 wrote to memory of 1368 1256 Explorer.EXE colorcpl.exe PID 1368 wrote to memory of 1588 1368 colorcpl.exe cmd.exe PID 1368 wrote to memory of 1588 1368 colorcpl.exe cmd.exe PID 1368 wrote to memory of 1588 1368 colorcpl.exe cmd.exe PID 1368 wrote to memory of 1588 1368 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO650.exe"C:\Users\Admin\AppData\Local\Temp\PO650.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO650.exe"C:\Users\Admin\AppData\Local\Temp\PO650.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO650.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1080-61-0x0000000000090000-0x0000000000092000-memory.dmpFilesize
8KB
-
memory/1256-65-0x0000000006070000-0x0000000006208000-memory.dmpFilesize
1.6MB
-
memory/1256-73-0x0000000006210000-0x000000000638F000-memory.dmpFilesize
1.5MB
-
memory/1368-70-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1368-66-0x0000000000000000-mapping.dmp
-
memory/1368-67-0x0000000075561000-0x0000000075563000-memory.dmpFilesize
8KB
-
memory/1368-69-0x0000000000800000-0x0000000000818000-memory.dmpFilesize
96KB
-
memory/1368-71-0x00000000020D0000-0x00000000023D3000-memory.dmpFilesize
3.0MB
-
memory/1368-72-0x00000000004E0000-0x000000000056F000-memory.dmpFilesize
572KB
-
memory/1588-68-0x0000000000000000-mapping.dmp
-
memory/1752-64-0x0000000000260000-0x0000000000270000-memory.dmpFilesize
64KB
-
memory/1752-63-0x0000000000830000-0x0000000000B33000-memory.dmpFilesize
3.0MB
-
memory/1752-60-0x000000000041D0D0-mapping.dmp
-
memory/1752-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB