Analysis
- max time kernel
150s - max time network
125s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/12/2020, 14:39
Static task
static1
Behavioral task
behavioral1
Sample
anthony.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target anthony.exe
- Size 389KB
- Sample201209-ep6zekhmkn
- SHA256 881dc085a9c46e3e31ad8189720dc6e16a7f3b40a6de30d6cadd088c0f769bec
- MD5 aa078a3e0ae224567676780e445d0987
- SHA1 1a41de109b5ffc1b76d88435e4c1b86d6014361f
- SHA512 28601887427c5a7eaf6e260fa858599030b91a5fc5643abbdca28081ef59747be591690f3f7ee27f4f63af8b389367ccfc440f1f7bcd8ff51497c6572251bc0e
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.wellnesspharma.net/94sb/
Decoy
-
kaligao.com
-
springsbounce.com
-
dreamytree.com
-
trylolows.com
-
butload.info
-
creperie-pancakesquare.com
-
mirajions.com
-
joineduphealthresources.net
-
hamradioblogs.com
-
linghuidz.com
-
atelierzeste.com
-
tweens.network
-
perteprampram03.net
-
connorneill.com
-
nannatech.com
-
chrmo.com
-
nanoring.info
-
mapomarket.com
-
bongkey.com
-
sdhhzp.com
-
threepeninsulas.com
-
izicomp.net
-
gekkey.com
-
pyskah.com
-
tritoncareer.com
-
aspirehowhouse.com
-
don8gr8.com
-
selfie-trends.com
-
jogja1945.info
-
tibio.store
-
kiranmayee.codes
-
stlmache.com
-
aaagroups.net
-
lzli.net
-
ranchomanantiales.com
-
augsburgconfession.net
-
eczamix.com
-
subcontratech.com
-
jwm-consulting.com
-
alepremiumcartel.com
-
thesacralgenie.com
-
dronebezorgd.com
-
shoprosalind.com
-
theafterglowagency.com
-
motoprimoreviews.com
-
walmartpetrex.com
-
awonderliang.com
-
peipei521.com
-
qabwg.com
-
trucleanusa.com
-
mamentos.info
-
wwwmmcguard.com
-
aedisurbancollaborative.com
-
hilferdinghill.com
-
torcida-r.com
-
okna4all.com
-
spidermenroofsupport.com
-
thedojoofdom.com
-
dteenpatti.com
-
starsnus.com
-
bistrooapp.com
-
philosopherbynight.com
-
pfkakaoblue.com
-
qxmasmobitvshop.com
Signatures
- Xloader Payload 3 IoCs
resource yara_rule behavioral1/memory/1264-6-0x00000000006F0000-0x0000000000719000-memory.dmp xloader behavioral1/memory/1444-7-0x0000000000000000-mapping.dmp xloader behavioral1/memory/668-9-0x0000000000000000-mapping.dmp xloader - Loads dropped DLL 1 IoCs
pid Process 1264 rundll32.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1444 set thread context of 1236 1444 cmd.exe 9 PID 1444 set thread context of 1236 1444 cmd.exe 9 PID 668 set thread context of 1236 668 raserver.exe 9 - Suspicious behavior: EnumeratesProcesses 27 IoCs
pid Process 1264 rundll32.exe 1264 rundll32.exe 1444 cmd.exe 1444 cmd.exe 1444 cmd.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe 668 raserver.exe - Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 1264 rundll32.exe 1264 rundll32.exe 1444 cmd.exe 1444 cmd.exe 1444 cmd.exe 1444 cmd.exe 668 raserver.exe 668 raserver.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1444 cmd.exe Token: SeDebugPrivilege 668 raserver.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE - Suspicious use of WriteProcessMemory 61 IoCs
description pid Process procid_target PID 1084 wrote to memory of 1264 1084 anthony.exe 28 PID 1084 wrote to memory of 1264 1084 anthony.exe 28 PID 1084 wrote to memory of 1264 1084 anthony.exe 28 PID 1084 wrote to memory of 1264 1084 anthony.exe 28 PID 1084 wrote to memory of 1264 1084 anthony.exe 28 PID 1084 wrote to memory of 1264 1084 anthony.exe 28 PID 1084 wrote to memory of 1264 1084 anthony.exe 28 PID 1264 wrote to memory of 1520 1264 rundll32.exe 30 PID 1264 wrote to memory of 1520 1264 rundll32.exe 30 PID 1264 wrote to memory of 1520 1264 rundll32.exe 30 PID 1264 wrote to memory of 1520 1264 rundll32.exe 30 PID 1264 wrote to memory of 1520 1264 rundll32.exe 30 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1264 wrote to memory of 1444 1264 rundll32.exe 31 PID 1236 wrote to memory of 668 1236 Explorer.EXE 32 PID 1236 wrote to memory of 668 1236 Explorer.EXE 32 PID 1236 wrote to memory of 668 1236 Explorer.EXE 32 PID 1236 wrote to memory of 668 1236 Explorer.EXE 32 PID 668 wrote to memory of 1052 668 raserver.exe 33 PID 668 wrote to memory of 1052 668 raserver.exe 33 PID 668 wrote to memory of 1052 668 raserver.exe 33 PID 668 wrote to memory of 1052 668 raserver.exe 33
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\anthony.exe"C:\Users\Admin\AppData\Local\Temp\anthony.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Formicarium,Chechako3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1520
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\cmd.exe"3⤵PID:1052
-
-