Analysis
-
max time kernel
35s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 06:44
Static task
static1
Behavioral task
behavioral1
Sample
70747f5955df1f8a7012cbe5d37c516f.exe
Resource
win7v20201028
General
-
Target
70747f5955df1f8a7012cbe5d37c516f.exe
-
Size
644KB
-
MD5
70747f5955df1f8a7012cbe5d37c516f
-
SHA1
8a4edf21b160f31bc6d9b1d02d343e3bf5fcfd2e
-
SHA256
6a042012f4233929b8f5fbf73f4b958e39f2fb60d73c1d758753dd07508ef8e1
-
SHA512
0d84482c736c33eb5e8fc48ef1350dde530b6fbc76440dde906e31cf681631581642cd601bffbaab31fd54296489754814548f56d6c3e2a2c532b1af37309a90
Malware Config
Extracted
formbook
http://www.thejusticeadvantageseminars.com/qccq/
webuynyhouses.com
love-nepal.com
gardening-mistakes.com
495honda.com
newcuus.com
alefinvest.com
delhikigully.com
aznri4z9gtky4.net
hanswiemannbyaderans.com
mecaldiesel.com
akshen.net
y-agency.net
ahrohishrestha.com
arthalvorsonforcongress.com
mvmcompany.net
qyjjsk.com
yescoop.com
esergedrghwebrgqrq.xyz
kellyharmonedconsulting.com
deliciosatentacion.com
digihomepro.com
northchinatogo.com
intimatemomentsbtq.com
rtinvestorsolutions.com
maglex.info
tudo-a-toda-hora.com
redpriestapprel.com
screenminimum.icu
reading571.com
phoenixsommer.net
kofccouncil10004.com
ngayo.com
deborahfcasey.com
junktothedumpseattle.com
ditessili.com
houserbuilders.com
new-venice-homes.com
surrealmstudios.xyz
boldercoach.com
bigblockofcheeseday.com
magicdfw.com
centralarchery.com
sentryhilllegal.com
knowledge-noodle.com
innergardenacupuncture.com
kenneyrealtyinterest.com
newdirection4nm.com
rujgyolhb.icu
rootkit.global
vendorsforproductions.com
cryptogas.net
crucifux.com
modumbasket.com
todayluckyvisitors.com
tmfacecosmetics.com
asmmacademy.com
utocloud.com
loitethirdact.com
emfsens.com
vantaihoanganh.online
icampus.info
greenearthgator.com
iwin5588.com
bax84d.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3340-11-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3340-12-0x000000000041D100-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
70747f5955df1f8a7012cbe5d37c516f.exedescription pid process target process PID 4636 set thread context of 3340 4636 70747f5955df1f8a7012cbe5d37c516f.exe 70747f5955df1f8a7012cbe5d37c516f.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
70747f5955df1f8a7012cbe5d37c516f.exepid process 3340 70747f5955df1f8a7012cbe5d37c516f.exe 3340 70747f5955df1f8a7012cbe5d37c516f.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
70747f5955df1f8a7012cbe5d37c516f.exedescription pid process target process PID 4636 wrote to memory of 3340 4636 70747f5955df1f8a7012cbe5d37c516f.exe 70747f5955df1f8a7012cbe5d37c516f.exe PID 4636 wrote to memory of 3340 4636 70747f5955df1f8a7012cbe5d37c516f.exe 70747f5955df1f8a7012cbe5d37c516f.exe PID 4636 wrote to memory of 3340 4636 70747f5955df1f8a7012cbe5d37c516f.exe 70747f5955df1f8a7012cbe5d37c516f.exe PID 4636 wrote to memory of 3340 4636 70747f5955df1f8a7012cbe5d37c516f.exe 70747f5955df1f8a7012cbe5d37c516f.exe PID 4636 wrote to memory of 3340 4636 70747f5955df1f8a7012cbe5d37c516f.exe 70747f5955df1f8a7012cbe5d37c516f.exe PID 4636 wrote to memory of 3340 4636 70747f5955df1f8a7012cbe5d37c516f.exe 70747f5955df1f8a7012cbe5d37c516f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70747f5955df1f8a7012cbe5d37c516f.exe"C:\Users\Admin\AppData\Local\Temp\70747f5955df1f8a7012cbe5d37c516f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70747f5955df1f8a7012cbe5d37c516f.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3340-11-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3340-12-0x000000000041D100-mapping.dmp
-
memory/4636-2-0x0000000073D60000-0x000000007444E000-memory.dmpFilesize
6.9MB
-
memory/4636-3-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/4636-5-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/4636-6-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/4636-7-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/4636-8-0x0000000004C30000-0x0000000004C3E000-memory.dmpFilesize
56KB
-
memory/4636-9-0x0000000006F60000-0x0000000006FED000-memory.dmpFilesize
564KB
-
memory/4636-10-0x00000000070A0000-0x00000000070A1000-memory.dmpFilesize
4KB