Analysis
-
max time kernel
149s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
04-02-2022 05:58
Static task
static1
Behavioral task
behavioral1
Sample
SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe
Resource
win10v2004-en-20220113
General
-
Target
SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe
-
Size
563KB
-
MD5
6ba8c1b65f0d629b681ef2a34cb24785
-
SHA1
18c8b83ff38a0b5a650cfbd0392bef190fe81921
-
SHA256
f61b011c13db4d0cf3d35a73c8e1cf9edd3505c68013af06e24f7c0a857c6dc3
-
SHA512
e5b0bf176ca0d0108ab6c526ad1f0e13b25b5d9eb86f6f47e60454bdbaa36005f809b91b3ffa62edf8927fbd56d341e0356acf4985a184d6732666773c91718d
Malware Config
Extracted
xloader
2.5
pout
leadergaterealty.com
k7bsz.info
laidjapp1.com
eastcountytaxi.com
betterlife-uae.com
materaiku.com
chanhxebinhthuan-hcm.online
06gjm.xyz
67t.xyz
here-we-meet.com
screened-articletoseetoday.info
lucykg.club
mujdobron.quest
susakhi.com
funtabse.com
unlimitedpain.com
2ed58fwec.xyz
weighttrainingexpert.com
allisonsheillax.com
yektaburgers.com
altijdstoer.info
airemspapartments.com
videomuncher.com
centerstagedrama.com
nikkou-toy.store
arequipesymerengues.com
haishandl.com
fy2zy5.com
mailheld.digital
sheepysage.com
fabricadocredito.com
siq212.com
moo-coo.com
hoomxb.net
6s2.space
rsholding.net
castellanacustomboats.online
tremblock.com
ramblingkinkster.com
teamsooners.club
onlinecasino-univ.com
dash8board.com
aichuncha.com
springhilllawn.com
zgluke.com
happynft.agency
urbanempireapparel.com
guanyiren.com
biglotteryking.com
marionkgregory.store
mujeresyaccion.com
smcusa.net
mayyon.net
vivibanca.website
15dgj.xyz
miabossjewelry.com
ideeperloshopping.cloud
healizy.com
huvao.com
huggsforbubbs.com
radiomacadam.online
firirifilms.com
knowhorses.com
chickenbeetlebooks.com
transtarintl.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1628-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1532-69-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 12 1532 rundll32.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1176 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exeSOA _ Aug-Dec 2021 Require Sign&Seal stamp.exerundll32.exedescription pid process target process PID 1204 set thread context of 1628 1204 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe PID 1628 set thread context of 1268 1628 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe Explorer.EXE PID 1532 set thread context of 1268 1532 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exerundll32.exepid process 1628 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe 1628 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe 1532 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exerundll32.exepid process 1628 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe 1628 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe 1628 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe 1532 rundll32.exe 1532 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exerundll32.exedescription pid process Token: SeDebugPrivilege 1628 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe Token: SeDebugPrivilege 1532 rundll32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exeExplorer.EXErundll32.exedescription pid process target process PID 1204 wrote to memory of 1628 1204 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe PID 1204 wrote to memory of 1628 1204 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe PID 1204 wrote to memory of 1628 1204 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe PID 1204 wrote to memory of 1628 1204 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe PID 1204 wrote to memory of 1628 1204 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe PID 1204 wrote to memory of 1628 1204 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe PID 1204 wrote to memory of 1628 1204 SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe PID 1268 wrote to memory of 1532 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1532 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1532 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1532 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1532 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1532 1268 Explorer.EXE rundll32.exe PID 1268 wrote to memory of 1532 1268 Explorer.EXE rundll32.exe PID 1532 wrote to memory of 1176 1532 rundll32.exe cmd.exe PID 1532 wrote to memory of 1176 1532 rundll32.exe cmd.exe PID 1532 wrote to memory of 1176 1532 rundll32.exe cmd.exe PID 1532 wrote to memory of 1176 1532 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe"C:\Users\Admin\AppData\Local\Temp\SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe"C:\Users\Admin\AppData\Local\Temp\SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SOA _ Aug-Dec 2021 Require Sign&Seal stamp.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1204-55-0x0000000075B11000-0x0000000075B13000-memory.dmpFilesize
8KB
-
memory/1204-56-0x0000000004840000-0x0000000004841000-memory.dmpFilesize
4KB
-
memory/1204-57-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/1204-58-0x0000000004845000-0x0000000004856000-memory.dmpFilesize
68KB
-
memory/1204-59-0x0000000004880000-0x00000000048DE000-memory.dmpFilesize
376KB
-
memory/1204-54-0x0000000000E80000-0x0000000000F14000-memory.dmpFilesize
592KB
-
memory/1268-66-0x0000000004060000-0x0000000004111000-memory.dmpFilesize
708KB
-
memory/1268-72-0x0000000004DA0000-0x0000000004EB8000-memory.dmpFilesize
1.1MB
-
memory/1532-69-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/1532-70-0x0000000002030000-0x0000000002333000-memory.dmpFilesize
3.0MB
-
memory/1532-68-0x0000000000460000-0x000000000046E000-memory.dmpFilesize
56KB
-
memory/1532-71-0x0000000001EA0000-0x0000000001F30000-memory.dmpFilesize
576KB
-
memory/1628-64-0x00000000009A0000-0x0000000000CA3000-memory.dmpFilesize
3.0MB
-
memory/1628-65-0x0000000000290000-0x00000000002A1000-memory.dmpFilesize
68KB
-
memory/1628-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1628-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1628-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB