Analysis
-
max time kernel
148s -
max time network
162s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-09-2021 06:05
Static task
static1
Behavioral task
behavioral1
Sample
PO7420.exe
Resource
win7v20210408
General
-
Target
PO7420.exe
-
Size
670KB
-
MD5
02e6d76727a49338165563bfccb66182
-
SHA1
f1302c87caad5869fdf9c151c0a506cda1b3d5a3
-
SHA256
98a9431a38a821366e3bf9cc3bbb9a9b44f5820632ac85c5a9f2349e65a507a0
-
SHA512
605d13c0b75c8cd94ceff9cc3d7cfa317b5b360df62c6a0f93a838558081665b0ef3d7bca5857cf1cf41a5e5f7db745d74d3fe9a6d9b4900da110efbb6749b0e
Malware Config
Extracted
xloader
2.3
c28h
http://www.yourweddingscent.online/c28h/
xn--osegredodameditao-nqb9e.com
blakepleasant.com
midnightindulgence.com
lungx.com
goldenretrieversmn.com
thecapshooter.com
luxuryledlighting.com
coachlind.com
jewelryart-byirene.com
legacyvending.net
staffjet.info
geogest.com
okmulgeedream.center
mexicoifbbproleague.net
tomrings.com
kidsomia.com
learnwithalinguist.com
getboardsuited.com
aiyuc.com
wowmanship.com
zcw58736.com
brava94fm.com
mayuraindia.com
sportclever.com
elcars.info
citestpridom20200814092033.net
fleurtigresse.com
zfcai1688.com
glucosecur.com
hyrrp.com
naplesfloridalifestylehomes.com
elegantsuperfoods.com
manoircarlhanjess.com
ezprone.com
spirituallystrong.net
4acostleyst.com
connectedvpn.com
themetathought.com
cartscroll.com
toiletoshop.com
pop-down.space
winatlife-blog.com
progressglobe.com
shopcamera.net
jordanshoeweb.com
theuneducationofamerica.com
bubelu.net
foreignpal.com
courtdistribute.com
librettostay.com
7arfok.com
joannetaylorpr.com
realinvest-egy.com
cerachip.com
welcometoeverywhere.com
rifepackaging.com
alphameresa.com
gylvs.com
izmoo2-hoeiprotein-review.com
airpodanchor.com
conhecimentovivo.technology
cherrisesimon.com
mileybarcus.com
tubekhan.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3948-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3948-125-0x000000000041D0D0-mapping.dmp xloader behavioral2/memory/752-132-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO7420.exePO7420.execmstp.exedescription pid process target process PID 584 set thread context of 3948 584 PO7420.exe PO7420.exe PID 3948 set thread context of 2224 3948 PO7420.exe Explorer.EXE PID 752 set thread context of 2224 752 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
PO7420.execmstp.exepid process 3948 PO7420.exe 3948 PO7420.exe 3948 PO7420.exe 3948 PO7420.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe 752 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2224 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO7420.execmstp.exepid process 3948 PO7420.exe 3948 PO7420.exe 3948 PO7420.exe 752 cmstp.exe 752 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO7420.exeExplorer.EXEcmstp.exedescription pid process Token: SeDebugPrivilege 3948 PO7420.exe Token: SeShutdownPrivilege 2224 Explorer.EXE Token: SeCreatePagefilePrivilege 2224 Explorer.EXE Token: SeDebugPrivilege 752 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2224 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO7420.exeExplorer.EXEcmstp.exedescription pid process target process PID 584 wrote to memory of 3948 584 PO7420.exe PO7420.exe PID 584 wrote to memory of 3948 584 PO7420.exe PO7420.exe PID 584 wrote to memory of 3948 584 PO7420.exe PO7420.exe PID 584 wrote to memory of 3948 584 PO7420.exe PO7420.exe PID 584 wrote to memory of 3948 584 PO7420.exe PO7420.exe PID 584 wrote to memory of 3948 584 PO7420.exe PO7420.exe PID 2224 wrote to memory of 752 2224 Explorer.EXE cmstp.exe PID 2224 wrote to memory of 752 2224 Explorer.EXE cmstp.exe PID 2224 wrote to memory of 752 2224 Explorer.EXE cmstp.exe PID 752 wrote to memory of 3864 752 cmstp.exe cmd.exe PID 752 wrote to memory of 3864 752 cmstp.exe cmd.exe PID 752 wrote to memory of 3864 752 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO7420.exe"C:\Users\Admin\AppData\Local\Temp\PO7420.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO7420.exe"C:\Users\Admin\AppData\Local\Temp\PO7420.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO7420.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/584-114-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/584-116-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/584-117-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/584-118-0x0000000004AE0000-0x0000000004FDE000-memory.dmpFilesize
5.0MB
-
memory/584-119-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/584-120-0x0000000008490000-0x0000000008497000-memory.dmpFilesize
28KB
-
memory/584-121-0x0000000008560000-0x0000000008561000-memory.dmpFilesize
4KB
-
memory/584-122-0x00000000065F0000-0x000000000664E000-memory.dmpFilesize
376KB
-
memory/584-123-0x00000000067C0000-0x00000000067EA000-memory.dmpFilesize
168KB
-
memory/752-130-0x0000000000EC0000-0x0000000000ED6000-memory.dmpFilesize
88KB
-
memory/752-129-0x0000000000000000-mapping.dmp
-
memory/752-131-0x0000000004480000-0x00000000047A0000-memory.dmpFilesize
3.1MB
-
memory/752-132-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/752-134-0x0000000000E30000-0x0000000000EBF000-memory.dmpFilesize
572KB
-
memory/2224-128-0x0000000005EB0000-0x000000000602B000-memory.dmpFilesize
1.5MB
-
memory/2224-135-0x0000000006030000-0x000000000617B000-memory.dmpFilesize
1.3MB
-
memory/3864-133-0x0000000000000000-mapping.dmp
-
memory/3948-125-0x000000000041D0D0-mapping.dmp
-
memory/3948-127-0x00000000014E0000-0x00000000014F0000-memory.dmpFilesize
64KB
-
memory/3948-126-0x0000000001500000-0x0000000001820000-memory.dmpFilesize
3.1MB
-
memory/3948-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB