Analysis
-
max time kernel
155s -
max time network
158s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 06:05
Static task
static1
Behavioral task
behavioral1
Sample
PO7420.exe
Resource
win7v20210408
General
-
Target
PO7420.exe
-
Size
670KB
-
MD5
02e6d76727a49338165563bfccb66182
-
SHA1
f1302c87caad5869fdf9c151c0a506cda1b3d5a3
-
SHA256
98a9431a38a821366e3bf9cc3bbb9a9b44f5820632ac85c5a9f2349e65a507a0
-
SHA512
605d13c0b75c8cd94ceff9cc3d7cfa317b5b360df62c6a0f93a838558081665b0ef3d7bca5857cf1cf41a5e5f7db745d74d3fe9a6d9b4900da110efbb6749b0e
Malware Config
Extracted
xloader
2.3
c28h
http://www.yourweddingscent.online/c28h/
xn--osegredodameditao-nqb9e.com
blakepleasant.com
midnightindulgence.com
lungx.com
goldenretrieversmn.com
thecapshooter.com
luxuryledlighting.com
coachlind.com
jewelryart-byirene.com
legacyvending.net
staffjet.info
geogest.com
okmulgeedream.center
mexicoifbbproleague.net
tomrings.com
kidsomia.com
learnwithalinguist.com
getboardsuited.com
aiyuc.com
wowmanship.com
zcw58736.com
brava94fm.com
mayuraindia.com
sportclever.com
elcars.info
citestpridom20200814092033.net
fleurtigresse.com
zfcai1688.com
glucosecur.com
hyrrp.com
naplesfloridalifestylehomes.com
elegantsuperfoods.com
manoircarlhanjess.com
ezprone.com
spirituallystrong.net
4acostleyst.com
connectedvpn.com
themetathought.com
cartscroll.com
toiletoshop.com
pop-down.space
winatlife-blog.com
progressglobe.com
shopcamera.net
jordanshoeweb.com
theuneducationofamerica.com
bubelu.net
foreignpal.com
courtdistribute.com
librettostay.com
7arfok.com
joannetaylorpr.com
realinvest-egy.com
cerachip.com
welcometoeverywhere.com
rifepackaging.com
alphameresa.com
gylvs.com
izmoo2-hoeiprotein-review.com
airpodanchor.com
conhecimentovivo.technology
cherrisesimon.com
mileybarcus.com
tubekhan.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1596-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1596-67-0x000000000041D0D0-mapping.dmp xloader behavioral1/memory/1044-74-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1012 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO7420.exePO7420.execolorcpl.exedescription pid process target process PID 1840 set thread context of 1596 1840 PO7420.exe PO7420.exe PID 1596 set thread context of 1200 1596 PO7420.exe Explorer.EXE PID 1044 set thread context of 1200 1044 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
PO7420.execolorcpl.exepid process 1596 PO7420.exe 1596 PO7420.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe 1044 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO7420.execolorcpl.exepid process 1596 PO7420.exe 1596 PO7420.exe 1596 PO7420.exe 1044 colorcpl.exe 1044 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO7420.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1596 PO7420.exe Token: SeDebugPrivilege 1044 colorcpl.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PO7420.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1840 wrote to memory of 1596 1840 PO7420.exe PO7420.exe PID 1840 wrote to memory of 1596 1840 PO7420.exe PO7420.exe PID 1840 wrote to memory of 1596 1840 PO7420.exe PO7420.exe PID 1840 wrote to memory of 1596 1840 PO7420.exe PO7420.exe PID 1840 wrote to memory of 1596 1840 PO7420.exe PO7420.exe PID 1840 wrote to memory of 1596 1840 PO7420.exe PO7420.exe PID 1840 wrote to memory of 1596 1840 PO7420.exe PO7420.exe PID 1200 wrote to memory of 1044 1200 Explorer.EXE colorcpl.exe PID 1200 wrote to memory of 1044 1200 Explorer.EXE colorcpl.exe PID 1200 wrote to memory of 1044 1200 Explorer.EXE colorcpl.exe PID 1200 wrote to memory of 1044 1200 Explorer.EXE colorcpl.exe PID 1044 wrote to memory of 1012 1044 colorcpl.exe cmd.exe PID 1044 wrote to memory of 1012 1044 colorcpl.exe cmd.exe PID 1044 wrote to memory of 1012 1044 colorcpl.exe cmd.exe PID 1044 wrote to memory of 1012 1044 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO7420.exe"C:\Users\Admin\AppData\Local\Temp\PO7420.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO7420.exe"C:\Users\Admin\AppData\Local\Temp\PO7420.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO7420.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1012-76-0x0000000000000000-mapping.dmp
-
memory/1044-77-0x0000000000A40000-0x0000000000ACF000-memory.dmpFilesize
572KB
-
memory/1044-75-0x00000000020D0000-0x00000000023D3000-memory.dmpFilesize
3.0MB
-
memory/1044-73-0x0000000000B20000-0x0000000000B38000-memory.dmpFilesize
96KB
-
memory/1044-74-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/1044-72-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1044-71-0x0000000000000000-mapping.dmp
-
memory/1200-70-0x0000000007030000-0x00000000071CF000-memory.dmpFilesize
1.6MB
-
memory/1200-78-0x0000000004A30000-0x0000000004B2A000-memory.dmpFilesize
1000KB
-
memory/1596-69-0x0000000000120000-0x0000000000130000-memory.dmpFilesize
64KB
-
memory/1596-68-0x0000000000C50000-0x0000000000F53000-memory.dmpFilesize
3.0MB
-
memory/1596-67-0x000000000041D0D0-mapping.dmp
-
memory/1596-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1840-60-0x0000000000BA0000-0x0000000000BA1000-memory.dmpFilesize
4KB
-
memory/1840-65-0x0000000000560000-0x000000000058A000-memory.dmpFilesize
168KB
-
memory/1840-64-0x0000000005B90000-0x0000000005BEE000-memory.dmpFilesize
376KB
-
memory/1840-63-0x0000000000390000-0x0000000000397000-memory.dmpFilesize
28KB
-
memory/1840-62-0x0000000004790000-0x0000000004791000-memory.dmpFilesize
4KB