Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 07:36
Static task
static1
Behavioral task
behavioral1
Sample
PO#218740.exe
Resource
win7v20201028
General
-
Target
PO#218740.exe
-
Size
210KB
-
MD5
f12ead1a33327f7919a71b0aa86fb073
-
SHA1
d4aea16dff8ff036a5135e40ed40c5d2ecee7806
-
SHA256
ceb2632fac30996ac58a50455d968873321f7a18972db02e9535b485a3b0e2f7
-
SHA512
61fbe590c3f394ad3d89922c5e510e468e54e7bd0433d804f309d34eb3d1a94b0eaa92a7c634e9cc2de6b640fd70b5e4ff758939bf1c9af2c651ca069d8b46e5
Malware Config
Extracted
formbook
http://www.tzmm.net/wpsb/
0817ls.com
drawbeirut.com
respiteready.com
yufkayurek.com
poss-plus.com
distributesimilar.com
mcmendzlawns.com
bingent.info
wellnessandcomfort.com
humilityhope.com
recetasfes.com
olala.asia
epochryphal.com
room-lettings-onlines.club
lvc.xyz
reicolee.com
davidmarkphotovideo.photography
corpuschristicarbuyers.com
tutorialyoutube.com
ativ.pro
shopzayeska.com
collegeedgecoach.com
russillo.net
lxl-express.com
zadslogistics.com
newimpressionlighting.com
propertiesbyjose.com
potikha.com
phoenixoh.net
pogo-case.com
jordankylebowman.com
2020falafelburger.com
medicinas-enlinea.com
atypicaldesigncollective.com
aureliachic.com
woyaozijiawang.com
adrianapsicanalise.com
bubee-studio.com
musicalprofits.com
cafereuben.com
htxmobilewashndetail.com
hedgeanything.com
newbridgeclothing.com
3c.fitness
fastcincincinnatioffer.com
tiantipaihangbang.com
standupmankato.com
juggernautsbaseball.com
landoflostengineers.com
official-mr-bit-casino.com
hhzxwh.com
muafollow.com
realestatebymel.com
welvasq.com
medicalaccount.club
healthgain.online
xn--mkainternational-w3b.com
parkcrow.com
bazi45b.com
greenmatamp.com
zjksxy.com
homeinspectorbook.com
shelvesthatslude.com
smorapicnic.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3792-2-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3792-3-0x000000000041D040-mapping.dmp xloader behavioral2/memory/4176-5-0x0000000000000000-mapping.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO#218740.exePO#218740.exemstsc.exedescription pid process target process PID 4700 set thread context of 3792 4700 PO#218740.exe PO#218740.exe PID 3792 set thread context of 2300 3792 PO#218740.exe Explorer.EXE PID 3792 set thread context of 2300 3792 PO#218740.exe Explorer.EXE PID 4176 set thread context of 2300 4176 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
PO#218740.exemstsc.exepid process 3792 PO#218740.exe 3792 PO#218740.exe 3792 PO#218740.exe 3792 PO#218740.exe 3792 PO#218740.exe 3792 PO#218740.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe 4176 mstsc.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
PO#218740.exePO#218740.exemstsc.exepid process 4700 PO#218740.exe 3792 PO#218740.exe 3792 PO#218740.exe 3792 PO#218740.exe 3792 PO#218740.exe 4176 mstsc.exe 4176 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO#218740.exemstsc.exedescription pid process Token: SeDebugPrivilege 3792 PO#218740.exe Token: SeDebugPrivilege 4176 mstsc.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2300 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
PO#218740.exePO#218740.exemstsc.exedescription pid process target process PID 4700 wrote to memory of 3792 4700 PO#218740.exe PO#218740.exe PID 4700 wrote to memory of 3792 4700 PO#218740.exe PO#218740.exe PID 4700 wrote to memory of 3792 4700 PO#218740.exe PO#218740.exe PID 4700 wrote to memory of 3792 4700 PO#218740.exe PO#218740.exe PID 3792 wrote to memory of 4176 3792 PO#218740.exe mstsc.exe PID 3792 wrote to memory of 4176 3792 PO#218740.exe mstsc.exe PID 3792 wrote to memory of 4176 3792 PO#218740.exe mstsc.exe PID 4176 wrote to memory of 3812 4176 mstsc.exe cmd.exe PID 4176 wrote to memory of 3812 4176 mstsc.exe cmd.exe PID 4176 wrote to memory of 3812 4176 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\PO#218740.exe"C:\Users\Admin\AppData\Local\Temp\PO#218740.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO#218740.exe"C:\Users\Admin\AppData\Local\Temp\PO#218740.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO#218740.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2300-10-0x0000000005C40000-0x0000000005D7F000-memory.dmpFilesize
1.2MB
-
memory/3792-2-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3792-3-0x000000000041D040-mapping.dmp
-
memory/3812-8-0x0000000000000000-mapping.dmp
-
memory/4176-5-0x0000000000000000-mapping.dmp
-
memory/4176-6-0x0000000001130000-0x000000000142C000-memory.dmpFilesize
3.0MB
-
memory/4176-7-0x0000000001130000-0x000000000142C000-memory.dmpFilesize
3.0MB
-
memory/4176-9-0x00000000068B0000-0x00000000069E2000-memory.dmpFilesize
1.2MB