Analysis
- max time kernel
146s - max time network
132s - platform
windows7_x64 - resource
win7v20201028 - submitted
11/12/2020, 20:43
Static task
static1
Behavioral task
behavioral1
Sample
4819f4e997b99896c4d3a2813d6b3525.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4819f4e997b99896c4d3a2813d6b3525.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 4819f4e997b99896c4d3a2813d6b3525.exe
- Size 1011KB
- Sample201211-blztena62j
- SHA256 268725b4599bf8e1e30e7743cc6dece666f20bd6e7522effb152365765ad8564
- MD5 4819f4e997b99896c4d3a2813d6b3525
- SHA1 d96ee7d872ba14387c78c4c1be39a65f489d7014
- SHA512 61444431dd642b4871d34346da2c3b5de79d7f24b404f5bca1e6b4ed96993b50ccc02090b9dcedc1363e72a20eaf6e657088050279ff56775d1455d1772fe8a6
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.switchtoambitwithmirtha.com/jskg/
Decoy
-
jajaten.com
-
pnorg.net
-
rccarquibogota.com
-
marcomarabiamea.com
-
theligue.com
-
mdearpet.com
-
barokahsrivillage.com
-
wisdomtoothguru.com
-
srteamsex.com
-
erotictoybox.com
-
278698.com
-
victimaccidents.com
-
bootyfashions.com
-
stomasto.site
-
canalysisconsulting.com
-
printandmail.legal
-
bestcureforbackpain.com
-
apanifitness.com
-
smartabletech.com
-
facialsteamerofficial.com
-
cookclassesfishes.com
-
ayanmobile.com
-
cannapharmaus.com
-
lactationdrink.com
-
enrgsystems.info
-
f1leghecodemasters.net
-
topazkibblez.com
-
appbecause.com
-
256barrington.com
-
snapmoneyexchangellc.com
-
kriolland.com
-
7255399.com
-
realoneathletics.info
-
illustriousevents.com
-
moonman.services
-
dog2meeting.com
-
successwithyolandafgreen.com
-
freshlookconsulting.net
-
3bcreditwatch.com
-
lacroixundkress.com
-
beaujolaisboston.com
-
breakawayfc.com
-
bollmasonry.com
-
jiujitsuspa.com
-
zirangaobai.com
-
capitalmedicalsupplies.net
-
swavhca.com
-
pereiranatalia.com
-
lbarco.com
-
revistabrasileiramarketing.info
-
carportaccessory.com
-
kvrkl.com
-
handledlife.com
-
groups-post-sales-2678493.xyz
-
rapidprintz.com
-
buzzkeel.com
-
divinityemerald.com
-
ppc-listing.info
-
coryfireshop.com
-
mimipopuppicnics.com
-
votehealey.com
-
saraadamchak.com
-
winwinwin365.net
-
tprmt.com
Signatures
- Xloader Payload 1 IoCs
resource yara_rule behavioral1/memory/760-16-0x0000000000000000-mapping.dmp xloader - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run netsh.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\LPXXV = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" netsh.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \Registry\User\S-1-5-21-3825035466-2522850611-591511364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run netsh.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1080 set thread context of 1064 1080 4819f4e997b99896c4d3a2813d6b3525.exe 33 PID 1064 set thread context of 1256 1064 ieinstal.exe 11 PID 760 set thread context of 1256 760 netsh.exe 11 - Modifies registry key 1 TTPs 3 IoCs
pid Process 1504 reg.exe 368 reg.exe 828 reg.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 4819f4e997b99896c4d3a2813d6b3525.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 4819f4e997b99896c4d3a2813d6b3525.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 4819f4e997b99896c4d3a2813d6b3525.exe - Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 1064 ieinstal.exe 1064 ieinstal.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe 760 netsh.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1064 ieinstal.exe 1064 ieinstal.exe 1064 ieinstal.exe 760 netsh.exe 760 netsh.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1064 ieinstal.exe Token: SeDebugPrivilege 760 netsh.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE - Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 1080 wrote to memory of 524 1080 4819f4e997b99896c4d3a2813d6b3525.exe 31 PID 1080 wrote to memory of 524 1080 4819f4e997b99896c4d3a2813d6b3525.exe 31 PID 1080 wrote to memory of 524 1080 4819f4e997b99896c4d3a2813d6b3525.exe 31 PID 1080 wrote to memory of 524 1080 4819f4e997b99896c4d3a2813d6b3525.exe 31 PID 1080 wrote to memory of 1064 1080 4819f4e997b99896c4d3a2813d6b3525.exe 33 PID 1080 wrote to memory of 1064 1080 4819f4e997b99896c4d3a2813d6b3525.exe 33 PID 1080 wrote to memory of 1064 1080 4819f4e997b99896c4d3a2813d6b3525.exe 33 PID 1080 wrote to memory of 1064 1080 4819f4e997b99896c4d3a2813d6b3525.exe 33 PID 1080 wrote to memory of 1064 1080 4819f4e997b99896c4d3a2813d6b3525.exe 33 PID 1080 wrote to memory of 1064 1080 4819f4e997b99896c4d3a2813d6b3525.exe 33 PID 1080 wrote to memory of 1064 1080 4819f4e997b99896c4d3a2813d6b3525.exe 33 PID 1080 wrote to memory of 1064 1080 4819f4e997b99896c4d3a2813d6b3525.exe 33 PID 1080 wrote to memory of 1064 1080 4819f4e997b99896c4d3a2813d6b3525.exe 33 PID 524 wrote to memory of 1504 524 cmd.exe 34 PID 524 wrote to memory of 1504 524 cmd.exe 34 PID 524 wrote to memory of 1504 524 cmd.exe 34 PID 524 wrote to memory of 1504 524 cmd.exe 34 PID 524 wrote to memory of 368 524 cmd.exe 35 PID 524 wrote to memory of 368 524 cmd.exe 35 PID 524 wrote to memory of 368 524 cmd.exe 35 PID 524 wrote to memory of 368 524 cmd.exe 35 PID 524 wrote to memory of 812 524 cmd.exe 36 PID 524 wrote to memory of 812 524 cmd.exe 36 PID 524 wrote to memory of 812 524 cmd.exe 36 PID 524 wrote to memory of 812 524 cmd.exe 36 PID 524 wrote to memory of 828 524 cmd.exe 37 PID 524 wrote to memory of 828 524 cmd.exe 37 PID 524 wrote to memory of 828 524 cmd.exe 37 PID 524 wrote to memory of 828 524 cmd.exe 37 PID 1256 wrote to memory of 760 1256 Explorer.EXE 38 PID 1256 wrote to memory of 760 1256 Explorer.EXE 38 PID 1256 wrote to memory of 760 1256 Explorer.EXE 38 PID 1256 wrote to memory of 760 1256 Explorer.EXE 38
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\4819f4e997b99896c4d3a2813d6b3525.exe"C:\Users\Admin\AppData\Local\Temp\4819f4e997b99896c4d3a2813d6b3525.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Public\Natso.bat3⤵
- Suspicious use of WriteProcessMemory
PID:524 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:1504
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\cde.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:368
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:812
-
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:828
-
-
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:760
-