Analysis
-
max time kernel
151s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
13-01-2021 20:17
Static task
static1
Behavioral task
behavioral1
Sample
JdtN8nIcLi8RQOi.exe
Resource
win7v20201028
General
-
Target
JdtN8nIcLi8RQOi.exe
-
Size
822KB
-
MD5
aee550440966b0bd34d9ccb2b1f7f146
-
SHA1
14125d61fbcf4b63cb9c9ad82a60be3ad9aa2a3d
-
SHA256
d31340f14a66b43a1f5cf461cf48278bb97bfc33ef5a8bd0b29d0a3e6f315895
-
SHA512
7a81e4fec8c21339eb051205ad5a84fd3db07b4e330b9911b740d1382f4a084b812217312ec3e97a63ffc22ea260a7f2a2d9c8fc463881cabf7d2392e038d894
Malware Config
Extracted
formbook
http://www.allismd.com/ur06/
philippebrooksdesign.com
cmoorestudio.com
profille-sarina23tammara.club
dqulxe.com
uiffinger.com
nolarapper.com
maconanimalexterminator.com
bisovka.com
loveisloveent.com
datication.com
spxo66.com
drhelpnow.com
ladybug-cle.com
macocome.com
thepoppysocks.com
eldritchparadox.com
mercadolibre.company
ismartfarm.com
kansascarlot.com
kevinld.com
p87mbu2ss.xyz
the-makery.info
untegoro.site
newyorkcityhemorrhoidcenter.com
crystalclearwholistics.com
iregentos.info
fullskis.com
promanconsortium.com
800029120.com
mummyisme.com
humpychocks.com
myfavestuff.store
naturalfemina.com
bimetalthermostatksd.com
draysehaniminciftligi.com
sf9820.com
4thop.com
24les.com
thepupcrew.com
strangephobias.com
hotmamabody.com
restaurantsilhouette.com
texasadultdayservices.com
binahaiat.com
nipseythegreat.com
pelisplusxd.net
mamborio.com
elitedigitalperformance.com
therileyretreat.com
aieqbgk.icu
corkboardit.net
katieberiont.com
telemedicinehamilton.com
imagistor.com
tekdesignltd.com
bmw-7979.com
animaliaartist.com
straightlineautoserviceerie.net
qoo10online.com
tesseracoffee.com
central-car-sales.com
thecleaningenthusiast.com
musicmercch.com
pearlpham.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/776-3-0x000000000041D000-mapping.dmp xloader behavioral1/memory/776-2-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/292-4-0x0000000000000000-mapping.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1820 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
JdtN8nIcLi8RQOi.exeJdtN8nIcLi8RQOi.execolorcpl.exedescription pid process target process PID 1944 set thread context of 776 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 776 set thread context of 1236 776 JdtN8nIcLi8RQOi.exe Explorer.EXE PID 292 set thread context of 1236 292 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
JdtN8nIcLi8RQOi.exeJdtN8nIcLi8RQOi.execolorcpl.exepid process 1944 JdtN8nIcLi8RQOi.exe 1944 JdtN8nIcLi8RQOi.exe 776 JdtN8nIcLi8RQOi.exe 776 JdtN8nIcLi8RQOi.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe 292 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
JdtN8nIcLi8RQOi.execolorcpl.exepid process 776 JdtN8nIcLi8RQOi.exe 776 JdtN8nIcLi8RQOi.exe 776 JdtN8nIcLi8RQOi.exe 292 colorcpl.exe 292 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
JdtN8nIcLi8RQOi.exeJdtN8nIcLi8RQOi.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1944 JdtN8nIcLi8RQOi.exe Token: SeDebugPrivilege 776 JdtN8nIcLi8RQOi.exe Token: SeDebugPrivilege 292 colorcpl.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
JdtN8nIcLi8RQOi.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1944 wrote to memory of 1600 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 1944 wrote to memory of 1600 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 1944 wrote to memory of 1600 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 1944 wrote to memory of 1600 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 1944 wrote to memory of 776 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 1944 wrote to memory of 776 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 1944 wrote to memory of 776 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 1944 wrote to memory of 776 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 1944 wrote to memory of 776 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 1944 wrote to memory of 776 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 1944 wrote to memory of 776 1944 JdtN8nIcLi8RQOi.exe JdtN8nIcLi8RQOi.exe PID 1236 wrote to memory of 292 1236 Explorer.EXE colorcpl.exe PID 1236 wrote to memory of 292 1236 Explorer.EXE colorcpl.exe PID 1236 wrote to memory of 292 1236 Explorer.EXE colorcpl.exe PID 1236 wrote to memory of 292 1236 Explorer.EXE colorcpl.exe PID 292 wrote to memory of 1820 292 colorcpl.exe cmd.exe PID 292 wrote to memory of 1820 292 colorcpl.exe cmd.exe PID 292 wrote to memory of 1820 292 colorcpl.exe cmd.exe PID 292 wrote to memory of 1820 292 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JdtN8nIcLi8RQOi.exe"C:\Users\Admin\AppData\Local\Temp\JdtN8nIcLi8RQOi.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\JdtN8nIcLi8RQOi.exe"C:\Users\Admin\AppData\Local\Temp\JdtN8nIcLi8RQOi.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\JdtN8nIcLi8RQOi.exe"C:\Users\Admin\AppData\Local\Temp\JdtN8nIcLi8RQOi.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\JdtN8nIcLi8RQOi.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/292-4-0x0000000000000000-mapping.dmp
-
memory/292-5-0x0000000000DB0000-0x0000000000DC8000-memory.dmpFilesize
96KB
-
memory/292-7-0x0000000004340000-0x0000000004492000-memory.dmpFilesize
1.3MB
-
memory/776-3-0x000000000041D000-mapping.dmp
-
memory/776-2-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1820-6-0x0000000000000000-mapping.dmp