Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
12-10-2021 07:44
Behavioral task
behavioral1
Sample
xz.exe
Resource
win7-en-20210920
General
-
Target
xz.exe
-
Size
163KB
-
MD5
3b710cc2fd2ed7c2c71e88b128cb1297
-
SHA1
cde9f5bc3064e6e84473b74c62c289e38db2f00b
-
SHA256
0c22acaa973cbb781aea92dc1fb5a8c7cc1fd2abd403f2a6b9703f8f1e1c8657
-
SHA512
a74f820a0e1a6a2db21998109ebba32ffc1abac3fc26eaabb28a891170aa5d5c0b1e893e0a215a0a285dda95bf579e91b00f93cfa8561c882ee1bb4a1faa1c50
Malware Config
Extracted
xloader
2.5
mjyv
http://www.simpeltattofor.men/mjyv/
wenyuexuan.com
tropicaldepression.info
healthylifefit.com
reemletenleafy.com
jmrrve.com
mabduh.com
esomvw.com
selfcaresereneneness.com
murdabudz.com
meinemail.online
brandqrcodes.com
live-in-pflege.com
nickrecovery.com
ziototoristorante.com
chatcure.com
corlora.com
localagentlab.com
yogo7.net
krveop.com
heianswer.xyz
idproslot.xyz
anielleharris.com
lebonaharchitects.com
chilestew.com
ventasdecasasylotes.xyz
welcome-sber.store
ahmedintisher.com
pastlinks.com
productprinting.online
babybox.media
volteraenergy.net
chinatowndeliver.com
behiscalm.com
totalselfconfidence.net
single-on-purpose.com
miyonbuilding.com
medicalmanagementinc.info
bellaalubo.com
dubaibiologicdentist.com
jspagnier-graveur.com
deskbk.com
thehauntdepot.com
5fbuy.com
calmingscience.com
luvnecklace.com
noun-bug.com
mysenarai.com
socialmediaplugin.com
livinglovinglincoln.com
vaxfreeschool.com
bjjinmei.com
p60p.com
upgradepklohb.xyz
georges-lego.com
lkkogltoyof4.xyz
fryhealty.com
peacetransformationpath.com
lightfootsteps.com
recreativemysteriousgift.com
luminoza.website
mccorklehometeam.com
car-insurance-rates-x2.info
serpasboutiquedecarnes.com
1971event.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1844-120-0x00000000004D0000-0x00000000004F9000-memory.dmp xloader -
Suspicious use of SetThreadContext 2 IoCs
Processes:
xz.exerundll32.exedescription pid process target process PID 3128 set thread context of 3016 3128 xz.exe Explorer.EXE PID 1844 set thread context of 3016 1844 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
xz.exerundll32.exepid process 3128 xz.exe 3128 xz.exe 3128 xz.exe 3128 xz.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe 1844 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3016 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
xz.exerundll32.exepid process 3128 xz.exe 3128 xz.exe 3128 xz.exe 1844 rundll32.exe 1844 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
xz.exeExplorer.EXErundll32.exedescription pid process Token: SeDebugPrivilege 3128 xz.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeDebugPrivilege 1844 rundll32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 3016 Explorer.EXE 3016 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 3016 Explorer.EXE 3016 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3016 Explorer.EXE -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
Explorer.EXErundll32.exedescription pid process target process PID 3016 wrote to memory of 1844 3016 Explorer.EXE rundll32.exe PID 3016 wrote to memory of 1844 3016 Explorer.EXE rundll32.exe PID 3016 wrote to memory of 1844 3016 Explorer.EXE rundll32.exe PID 1844 wrote to memory of 2920 1844 rundll32.exe cmd.exe PID 1844 wrote to memory of 2920 1844 rundll32.exe cmd.exe PID 1844 wrote to memory of 2920 1844 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xz.exe"C:\Users\Admin\AppData\Local\Temp\xz.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\xz.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1844-117-0x0000000000000000-mapping.dmp
-
memory/1844-119-0x0000000000BC0000-0x0000000000BD3000-memory.dmpFilesize
76KB
-
memory/1844-120-0x00000000004D0000-0x00000000004F9000-memory.dmpFilesize
164KB
-
memory/1844-121-0x0000000004320000-0x0000000004640000-memory.dmpFilesize
3.1MB
-
memory/1844-122-0x0000000004170000-0x0000000004200000-memory.dmpFilesize
576KB
-
memory/2920-118-0x0000000000000000-mapping.dmp
-
memory/3016-116-0x0000000003250000-0x00000000033C6000-memory.dmpFilesize
1.5MB
-
memory/3016-123-0x0000000006920000-0x00000000069B6000-memory.dmpFilesize
600KB
-
memory/3128-114-0x0000000000A20000-0x0000000000D40000-memory.dmpFilesize
3.1MB
-
memory/3128-115-0x00000000009A0000-0x00000000009B1000-memory.dmpFilesize
68KB