Analysis
- max time kernel
149s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
16/12/2020, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
SKM_C3350191107102300.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target SKM_C3350191107102300.exe
- Size 349KB
- Sample201216-h396vtmf9x
- SHA256 574e414e22746d7781bd6ca6f4cc64be417b65696104dda71b037c9584cea01f
- MD5 6f5d2b42f4a74886ac3284fa9a414a87
- SHA1 c843fa55b16548ff0378194993e873a0b1b31a31
- SHA512 098c318b5d87bb02ccf462f45e1eac3834a238be1363d53b3222d83fada64bddd5de3a3a8705bb1b6beea2fb269dac8cc7faacc79df6f412e7e7bf3997c0d328
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.4mzn-l1mit.com/x2ee/
Decoy
-
imarrawk.com
-
focusonyouwa.com
-
thedallygrind.com
-
hexa4shop.com
-
rebeccaroni.com
-
rocketmortgageliar.net
-
roomkoala.com
-
zewkr.com
-
gighomesale.com
-
xenonsunglasses.com
-
clqck.com
-
alittlereward.com
-
neuroeka.digital
-
gadgetsat.online
-
steigersteel.com
-
fsjdc.com
-
realnie-svingeri.site
-
directcare.pro
-
mo-kita.com
-
faxbbs.com
-
magenx2.info
-
alrihabexpress.com
-
mandarinorientalcondosboca.com
-
submitahero.com
-
bloglifeme.com
-
31camillestreet.com
-
christinemchughic.com
-
dingtaifeng.ltd
-
sculpturepaintingvietnam.com
-
maga-tramontina.com
-
hotelmeriya.com
-
genumkm-pertamina.com
-
vihaanmoorthy.com
-
putramandiricyber.com
-
gzlydt.com
-
ahlussunnahfortaleza.com
-
suksuk.net
-
matilier.com
-
housepopup.com
-
pro-traffic.group
-
gentsclubdubai.com
-
saideheng.com
-
artsfam.com
-
garimaproperties.com
-
waf.design
-
ugcfashion.com
-
sieuthiansach.com
-
herbcraze420.com
-
ninetydollarwebsites.com
-
sutiabodybeauty.com
-
wy113l.com
-
myenterprisedesk.com
-
theskinnyspritz.com
-
datasoma.digital
-
wefixpclaptop.com
-
kathleendenese.com
-
thehuntingandfishingshow.com
-
puequefun.com
-
markenvandrerhjem.com
-
greenvillehorticulturellc.com
-
annmargaretkeller.com
-
treasurespoint.com
-
chegemblocsbattle.com
-
biciesentieri.com
Signatures
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/2408-3-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/2408-4-0x000000000041D010-mapping.dmp xloader behavioral2/memory/216-8-0x0000000000000000-mapping.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 756 set thread context of 2408 756 SKM_C3350191107102300.exe 75 PID 2408 set thread context of 2756 2408 SKM_C3350191107102300.exe 49 PID 216 set thread context of 2756 216 cmd.exe 49 - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2484 schtasks.exe - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2408 SKM_C3350191107102300.exe 2408 SKM_C3350191107102300.exe 2408 SKM_C3350191107102300.exe 2408 SKM_C3350191107102300.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe 216 cmd.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 756 SKM_C3350191107102300.exe 2408 SKM_C3350191107102300.exe 2408 SKM_C3350191107102300.exe 2408 SKM_C3350191107102300.exe 216 cmd.exe 216 cmd.exe - Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 2408 SKM_C3350191107102300.exe Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeDebugPrivilege 216 cmd.exe Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE Token: SeShutdownPrivilege 2756 Explorer.EXE Token: SeCreatePagefilePrivilege 2756 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2756 Explorer.EXE - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 756 wrote to memory of 2216 756 SKM_C3350191107102300.exe 74 PID 756 wrote to memory of 2216 756 SKM_C3350191107102300.exe 74 PID 756 wrote to memory of 2216 756 SKM_C3350191107102300.exe 74 PID 756 wrote to memory of 2408 756 SKM_C3350191107102300.exe 75 PID 756 wrote to memory of 2408 756 SKM_C3350191107102300.exe 75 PID 756 wrote to memory of 2408 756 SKM_C3350191107102300.exe 75 PID 756 wrote to memory of 2408 756 SKM_C3350191107102300.exe 75 PID 2216 wrote to memory of 2484 2216 cmd.exe 77 PID 2216 wrote to memory of 2484 2216 cmd.exe 77 PID 2216 wrote to memory of 2484 2216 cmd.exe 77 PID 2756 wrote to memory of 216 2756 Explorer.EXE 79 PID 2756 wrote to memory of 216 2756 Explorer.EXE 79 PID 2756 wrote to memory of 216 2756 Explorer.EXE 79 PID 216 wrote to memory of 2136 216 cmd.exe 83 PID 216 wrote to memory of 2136 216 cmd.exe 83 PID 216 wrote to memory of 2136 216 cmd.exe 83
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe"C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.execmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1f5539868fdb4da9bb066ca38b887f0a.xml"3⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\1f5539868fdb4da9bb066ca38b887f0a.xml"4⤵
- Creates scheduled task(s)
PID:2484
-
-
-
C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe"C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SKM_C3350191107102300.exe"3⤵PID:2136
-
-