Analysis
-
max time kernel
146s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
26-10-2021 05:10
Static task
static1
Behavioral task
behavioral1
Sample
PO4103.EXE
Resource
win7-en-20211014
General
-
Target
PO4103.EXE
-
Size
323KB
-
MD5
525a51d150340de3d796982e812fae03
-
SHA1
d6a2f004ab7380a03c384363a2b6d11a2cba9252
-
SHA256
7e84244d68162f8dc6c05011200a2b13aa73ed3c0e922e075cdf1ee2e7047e27
-
SHA512
40798f75d608f18b697238292f69f09b82991cffc856feeac7174d86a0949368862144f7d2f5bae94ac8901e567a01d9aa64181032d0e94dc12c46c687a50a33
Malware Config
Extracted
xloader
2.5
hpin
http://www.smgraphicdesign.com/hpin/
lalashealingplace.com
melaniealdridgephotography.com
ss3369.com
career-bliss.com
handelbabu.quest
larryhover.com
xyz-vr.xyz
telvicedemo.net
aaakk95.com
follow-er.com
thepiwarrior.com
dgltqd.com
dailyswee.com
tonymoney.net
earthsidesoulalchemist.com
meditatieleeuwarden.online
blancorealtor.com
xn--erhardlohmller-psb.gmbh
coachtobetter.info
singpost.agency
cryptovikings.art
abovetherootsgrower.com
steeltoilets.com
ugearup.com
catchotter.com
jamesstewartjr.com
jaysmhp.com
emotionfocusedapproaches.com
asamanagement.xyz
gillbane.com
supremepeak.net
logicalstrength.com
kuaiyicai.net
lappajarvi-info.com
babyfaceskincare86.com
luxuryhomesinpinellas.com
fitnessbymargaret.com
combatcollective.com
tremas25.com
ytfusion.com
les-ptites-pepites.com
gritnail.store
endosstore.com
deeznft.com
bits-clicks.com
reviewercasino.com
bets-bc-pvitt.xyz
mussten-viva.com
vegan-mexican.com
allsystemnow.online
mylimitlesssuccess.com
su458.com
gombc-a02.com
revuedrh.com
presidentfun.com
aragonproductions.com
iphone13.computer
codingnesia.tech
taiycwyb.com
asesoriasfinancieras.xyz
gxystgs.com
brilliantyard.com
mediationmattersgc.com
healingprotection.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1464-64-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1464-65-0x000000000041D480-mapping.dmp xloader behavioral1/memory/1464-69-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1104-74-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1472 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO4103.EXEPO4103.EXEsystray.exedescription pid process target process PID 1428 set thread context of 1464 1428 PO4103.EXE PO4103.EXE PID 1464 set thread context of 1272 1464 PO4103.EXE Explorer.EXE PID 1464 set thread context of 1272 1464 PO4103.EXE Explorer.EXE PID 1104 set thread context of 1272 1104 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
PO4103.EXEsystray.exepid process 1464 PO4103.EXE 1464 PO4103.EXE 1464 PO4103.EXE 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe 1104 systray.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO4103.EXEsystray.exepid process 1464 PO4103.EXE 1464 PO4103.EXE 1464 PO4103.EXE 1464 PO4103.EXE 1104 systray.exe 1104 systray.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
PO4103.EXEExplorer.EXEsystray.exedescription pid process Token: SeDebugPrivilege 1464 PO4103.EXE Token: SeShutdownPrivilege 1272 Explorer.EXE Token: SeDebugPrivilege 1104 systray.exe Token: SeShutdownPrivilege 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PO4103.EXEPO4103.EXEsystray.exedescription pid process target process PID 1428 wrote to memory of 1464 1428 PO4103.EXE PO4103.EXE PID 1428 wrote to memory of 1464 1428 PO4103.EXE PO4103.EXE PID 1428 wrote to memory of 1464 1428 PO4103.EXE PO4103.EXE PID 1428 wrote to memory of 1464 1428 PO4103.EXE PO4103.EXE PID 1428 wrote to memory of 1464 1428 PO4103.EXE PO4103.EXE PID 1428 wrote to memory of 1464 1428 PO4103.EXE PO4103.EXE PID 1428 wrote to memory of 1464 1428 PO4103.EXE PO4103.EXE PID 1464 wrote to memory of 1104 1464 PO4103.EXE systray.exe PID 1464 wrote to memory of 1104 1464 PO4103.EXE systray.exe PID 1464 wrote to memory of 1104 1464 PO4103.EXE systray.exe PID 1464 wrote to memory of 1104 1464 PO4103.EXE systray.exe PID 1104 wrote to memory of 1472 1104 systray.exe cmd.exe PID 1104 wrote to memory of 1472 1104 systray.exe cmd.exe PID 1104 wrote to memory of 1472 1104 systray.exe cmd.exe PID 1104 wrote to memory of 1472 1104 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"4⤵
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1104-71-0x0000000000000000-mapping.dmp
-
memory/1104-76-0x0000000000580000-0x0000000000610000-memory.dmpFilesize
576KB
-
memory/1104-75-0x0000000001F10000-0x0000000002213000-memory.dmpFilesize
3.0MB
-
memory/1104-74-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1104-73-0x0000000000650000-0x0000000000655000-memory.dmpFilesize
20KB
-
memory/1428-57-0x0000000075C21000-0x0000000075C23000-memory.dmpFilesize
8KB
-
memory/1428-58-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/1428-59-0x0000000000700000-0x0000000000707000-memory.dmpFilesize
28KB
-
memory/1428-60-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1428-61-0x0000000004FC0000-0x000000000500B000-memory.dmpFilesize
300KB
-
memory/1428-55-0x00000000013B0000-0x00000000013B1000-memory.dmpFilesize
4KB
-
memory/1464-67-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/1464-69-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1464-70-0x00000000002D0000-0x00000000002E1000-memory.dmpFilesize
68KB
-
memory/1464-68-0x0000000000240000-0x0000000000251000-memory.dmpFilesize
68KB
-
memory/1464-65-0x000000000041D480-mapping.dmp
-
memory/1464-64-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1464-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1464-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1472-72-0x0000000000000000-mapping.dmp