Analysis
-
max time kernel
148s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-10-2021 05:10
Static task
static1
Behavioral task
behavioral1
Sample
PO4103.EXE
Resource
win7-en-20211014
General
-
Target
PO4103.EXE
-
Size
323KB
-
MD5
525a51d150340de3d796982e812fae03
-
SHA1
d6a2f004ab7380a03c384363a2b6d11a2cba9252
-
SHA256
7e84244d68162f8dc6c05011200a2b13aa73ed3c0e922e075cdf1ee2e7047e27
-
SHA512
40798f75d608f18b697238292f69f09b82991cffc856feeac7174d86a0949368862144f7d2f5bae94ac8901e567a01d9aa64181032d0e94dc12c46c687a50a33
Malware Config
Extracted
xloader
2.5
hpin
http://www.smgraphicdesign.com/hpin/
lalashealingplace.com
melaniealdridgephotography.com
ss3369.com
career-bliss.com
handelbabu.quest
larryhover.com
xyz-vr.xyz
telvicedemo.net
aaakk95.com
follow-er.com
thepiwarrior.com
dgltqd.com
dailyswee.com
tonymoney.net
earthsidesoulalchemist.com
meditatieleeuwarden.online
blancorealtor.com
xn--erhardlohmller-psb.gmbh
coachtobetter.info
singpost.agency
cryptovikings.art
abovetherootsgrower.com
steeltoilets.com
ugearup.com
catchotter.com
jamesstewartjr.com
jaysmhp.com
emotionfocusedapproaches.com
asamanagement.xyz
gillbane.com
supremepeak.net
logicalstrength.com
kuaiyicai.net
lappajarvi-info.com
babyfaceskincare86.com
luxuryhomesinpinellas.com
fitnessbymargaret.com
combatcollective.com
tremas25.com
ytfusion.com
les-ptites-pepites.com
gritnail.store
endosstore.com
deeznft.com
bits-clicks.com
reviewercasino.com
bets-bc-pvitt.xyz
mussten-viva.com
vegan-mexican.com
allsystemnow.online
mylimitlesssuccess.com
su458.com
gombc-a02.com
revuedrh.com
presidentfun.com
aragonproductions.com
iphone13.computer
codingnesia.tech
taiycwyb.com
asesoriasfinancieras.xyz
gxystgs.com
brilliantyard.com
mediationmattersgc.com
healingprotection.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4036-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4036-126-0x000000000041D480-mapping.dmp xloader behavioral2/memory/4036-130-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1012-134-0x0000000000F20000-0x0000000000F49000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO4103.EXEPO4103.EXEcmmon32.exedescription pid process target process PID 1920 set thread context of 4036 1920 PO4103.EXE PO4103.EXE PID 4036 set thread context of 3028 4036 PO4103.EXE Explorer.EXE PID 4036 set thread context of 3028 4036 PO4103.EXE Explorer.EXE PID 1012 set thread context of 3028 1012 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
PO4103.EXEPO4103.EXEcmmon32.exepid process 1920 PO4103.EXE 1920 PO4103.EXE 1920 PO4103.EXE 1920 PO4103.EXE 4036 PO4103.EXE 4036 PO4103.EXE 4036 PO4103.EXE 4036 PO4103.EXE 4036 PO4103.EXE 4036 PO4103.EXE 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe 1012 cmmon32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO4103.EXEcmmon32.exepid process 4036 PO4103.EXE 4036 PO4103.EXE 4036 PO4103.EXE 4036 PO4103.EXE 1012 cmmon32.exe 1012 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
PO4103.EXEPO4103.EXEcmmon32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1920 PO4103.EXE Token: SeDebugPrivilege 4036 PO4103.EXE Token: SeDebugPrivilege 1012 cmmon32.exe Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
PO4103.EXEPO4103.EXEcmmon32.exedescription pid process target process PID 1920 wrote to memory of 2588 1920 PO4103.EXE PO4103.EXE PID 1920 wrote to memory of 2588 1920 PO4103.EXE PO4103.EXE PID 1920 wrote to memory of 2588 1920 PO4103.EXE PO4103.EXE PID 1920 wrote to memory of 2140 1920 PO4103.EXE PO4103.EXE PID 1920 wrote to memory of 2140 1920 PO4103.EXE PO4103.EXE PID 1920 wrote to memory of 2140 1920 PO4103.EXE PO4103.EXE PID 1920 wrote to memory of 4036 1920 PO4103.EXE PO4103.EXE PID 1920 wrote to memory of 4036 1920 PO4103.EXE PO4103.EXE PID 1920 wrote to memory of 4036 1920 PO4103.EXE PO4103.EXE PID 1920 wrote to memory of 4036 1920 PO4103.EXE PO4103.EXE PID 1920 wrote to memory of 4036 1920 PO4103.EXE PO4103.EXE PID 1920 wrote to memory of 4036 1920 PO4103.EXE PO4103.EXE PID 4036 wrote to memory of 1012 4036 PO4103.EXE cmmon32.exe PID 4036 wrote to memory of 1012 4036 PO4103.EXE cmmon32.exe PID 4036 wrote to memory of 1012 4036 PO4103.EXE cmmon32.exe PID 1012 wrote to memory of 1232 1012 cmmon32.exe cmd.exe PID 1012 wrote to memory of 1232 1012 cmmon32.exe cmd.exe PID 1012 wrote to memory of 1232 1012 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO4103.EXE"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1012-132-0x0000000000000000-mapping.dmp
-
memory/1012-137-0x0000000004EE0000-0x0000000004F70000-memory.dmpFilesize
576KB
-
memory/1012-134-0x0000000000F20000-0x0000000000F49000-memory.dmpFilesize
164KB
-
memory/1012-135-0x0000000005090000-0x00000000053B0000-memory.dmpFilesize
3.1MB
-
memory/1012-133-0x00000000012F0000-0x00000000012FC000-memory.dmpFilesize
48KB
-
memory/1232-136-0x0000000000000000-mapping.dmp
-
memory/1920-121-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/1920-122-0x000000007E710000-0x000000007E711000-memory.dmpFilesize
4KB
-
memory/1920-124-0x00000000072E0000-0x000000000732B000-memory.dmpFilesize
300KB
-
memory/1920-117-0x0000000005C40000-0x0000000005C41000-memory.dmpFilesize
4KB
-
memory/1920-123-0x0000000007140000-0x0000000007147000-memory.dmpFilesize
28KB
-
memory/1920-118-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/1920-119-0x0000000005570000-0x0000000005602000-memory.dmpFilesize
584KB
-
memory/1920-120-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/1920-115-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/4036-126-0x000000000041D480-mapping.dmp
-
memory/4036-131-0x00000000017E0000-0x00000000017F1000-memory.dmpFilesize
68KB
-
memory/4036-130-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4036-129-0x0000000001790000-0x00000000017A1000-memory.dmpFilesize
68KB
-
memory/4036-128-0x00000000018C0000-0x0000000001BE0000-memory.dmpFilesize
3.1MB
-
memory/4036-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB