Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en -
submitted
15-09-2021 06:06
Static task
static1
Behavioral task
behavioral1
Sample
PO7420.exe
Resource
win7-en
General
-
Target
PO7420.exe
-
Size
670KB
-
MD5
02e6d76727a49338165563bfccb66182
-
SHA1
f1302c87caad5869fdf9c151c0a506cda1b3d5a3
-
SHA256
98a9431a38a821366e3bf9cc3bbb9a9b44f5820632ac85c5a9f2349e65a507a0
-
SHA512
605d13c0b75c8cd94ceff9cc3d7cfa317b5b360df62c6a0f93a838558081665b0ef3d7bca5857cf1cf41a5e5f7db745d74d3fe9a6d9b4900da110efbb6749b0e
Malware Config
Extracted
xloader
2.3
c28h
http://www.yourweddingscent.online/c28h/
xn--osegredodameditao-nqb9e.com
blakepleasant.com
midnightindulgence.com
lungx.com
goldenretrieversmn.com
thecapshooter.com
luxuryledlighting.com
coachlind.com
jewelryart-byirene.com
legacyvending.net
staffjet.info
geogest.com
okmulgeedream.center
mexicoifbbproleague.net
tomrings.com
kidsomia.com
learnwithalinguist.com
getboardsuited.com
aiyuc.com
wowmanship.com
zcw58736.com
brava94fm.com
mayuraindia.com
sportclever.com
elcars.info
citestpridom20200814092033.net
fleurtigresse.com
zfcai1688.com
glucosecur.com
hyrrp.com
naplesfloridalifestylehomes.com
elegantsuperfoods.com
manoircarlhanjess.com
ezprone.com
spirituallystrong.net
4acostleyst.com
connectedvpn.com
themetathought.com
cartscroll.com
toiletoshop.com
pop-down.space
winatlife-blog.com
progressglobe.com
shopcamera.net
jordanshoeweb.com
theuneducationofamerica.com
bubelu.net
foreignpal.com
courtdistribute.com
librettostay.com
7arfok.com
joannetaylorpr.com
realinvest-egy.com
cerachip.com
welcometoeverywhere.com
rifepackaging.com
alphameresa.com
gylvs.com
izmoo2-hoeiprotein-review.com
airpodanchor.com
conhecimentovivo.technology
cherrisesimon.com
mileybarcus.com
tubekhan.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4844-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4844-126-0x000000000041D0D0-mapping.dmp xloader behavioral2/memory/4880-133-0x0000000003100000-0x0000000003129000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO7420.exePO7420.execmmon32.exedescription pid process target process PID 4740 set thread context of 4844 4740 PO7420.exe PO7420.exe PID 4844 set thread context of 2532 4844 PO7420.exe Explorer.EXE PID 4880 set thread context of 2532 4880 cmmon32.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
PO7420.execmmon32.exepid process 4844 PO7420.exe 4844 PO7420.exe 4844 PO7420.exe 4844 PO7420.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe 4880 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2532 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO7420.execmmon32.exepid process 4844 PO7420.exe 4844 PO7420.exe 4844 PO7420.exe 4880 cmmon32.exe 4880 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
PO7420.execmmon32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4844 PO7420.exe Token: SeDebugPrivilege 4880 cmmon32.exe Token: SeShutdownPrivilege 2532 Explorer.EXE Token: SeCreatePagefilePrivilege 2532 Explorer.EXE Token: SeShutdownPrivilege 2532 Explorer.EXE Token: SeCreatePagefilePrivilege 2532 Explorer.EXE -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
Explorer.EXEpid process 2532 Explorer.EXE 2532 Explorer.EXE 2532 Explorer.EXE 2532 Explorer.EXE 2532 Explorer.EXE 2532 Explorer.EXE 2532 Explorer.EXE 2532 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO7420.exeExplorer.EXEcmmon32.exedescription pid process target process PID 4740 wrote to memory of 4844 4740 PO7420.exe PO7420.exe PID 4740 wrote to memory of 4844 4740 PO7420.exe PO7420.exe PID 4740 wrote to memory of 4844 4740 PO7420.exe PO7420.exe PID 4740 wrote to memory of 4844 4740 PO7420.exe PO7420.exe PID 4740 wrote to memory of 4844 4740 PO7420.exe PO7420.exe PID 4740 wrote to memory of 4844 4740 PO7420.exe PO7420.exe PID 2532 wrote to memory of 4880 2532 Explorer.EXE cmmon32.exe PID 2532 wrote to memory of 4880 2532 Explorer.EXE cmmon32.exe PID 2532 wrote to memory of 4880 2532 Explorer.EXE cmmon32.exe PID 4880 wrote to memory of 4908 4880 cmmon32.exe cmd.exe PID 4880 wrote to memory of 4908 4880 cmmon32.exe cmd.exe PID 4880 wrote to memory of 4908 4880 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO7420.exe"C:\Users\Admin\AppData\Local\Temp\PO7420.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO7420.exe"C:\Users\Admin\AppData\Local\Temp\PO7420.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO7420.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2532-129-0x00000000006E0000-0x00000000007A7000-memory.dmpFilesize
796KB
-
memory/2532-136-0x0000000005730000-0x00000000057F2000-memory.dmpFilesize
776KB
-
memory/4740-117-0x0000000005BB0000-0x0000000005BB1000-memory.dmpFilesize
4KB
-
memory/4740-118-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/4740-119-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/4740-120-0x0000000005580000-0x0000000005612000-memory.dmpFilesize
584KB
-
memory/4740-121-0x0000000009040000-0x0000000009047000-memory.dmpFilesize
28KB
-
memory/4740-122-0x0000000009110000-0x0000000009111000-memory.dmpFilesize
4KB
-
memory/4740-123-0x0000000009070000-0x00000000090CE000-memory.dmpFilesize
376KB
-
memory/4740-124-0x000000000B8F0000-0x000000000B91A000-memory.dmpFilesize
168KB
-
memory/4740-115-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/4844-126-0x000000000041D0D0-mapping.dmp
-
memory/4844-127-0x0000000001200000-0x0000000001520000-memory.dmpFilesize
3.1MB
-
memory/4844-128-0x0000000000DB0000-0x0000000000DC0000-memory.dmpFilesize
64KB
-
memory/4844-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4880-130-0x0000000000000000-mapping.dmp
-
memory/4880-132-0x0000000001070000-0x000000000107C000-memory.dmpFilesize
48KB
-
memory/4880-133-0x0000000003100000-0x0000000003129000-memory.dmpFilesize
164KB
-
memory/4880-134-0x0000000005050000-0x0000000005370000-memory.dmpFilesize
3.1MB
-
memory/4880-135-0x0000000004E80000-0x0000000004F0F000-memory.dmpFilesize
572KB
-
memory/4908-131-0x0000000000000000-mapping.dmp