Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 15:54
Static task
static1
Behavioral task
behavioral1
Sample
Materials.exe
Resource
win7v20201028
General
-
Target
Materials.exe
-
Size
357KB
-
MD5
8bd9a34cf06fa228b4ccd401808723cc
-
SHA1
e17daeaf2e0dcfdbaf026866c00fefb0beb47520
-
SHA256
38f3aadc65df16aed9f5bbaa5f42598d3fd9b29811429fcddd679a40b092fca0
-
SHA512
3d3ac1d0d90125fba07ca8a6fe0bb75a95b47b1caf177854b9e476aede2cefe396c68bb68c7dde0e32b22a740708aa3f23dd3726f3789504b83fd0b195c0479e
Malware Config
Extracted
formbook
http://www.smallcoloradoweddings.com/kio8/
greeaircondition.com
thewilmingtonguide.com
cbluedotlivewdmall.com
globalcrime24.com
heightsplace.com
ghar.pro
asosbira.com
melolandia.com
velactun.com
erniesimms.com
nutbullet.com
drizzerstr.com
hnqym888.com
ghorowaseba.com
1317efoxchasedrive.info
stjudetroop623.com
facestaj.com
airpromaskaccessories.com
wolfetailors.com
56ohdc2016.com
estedindustries.com
magmaplant.net
tf-iot.com
jtkqmz.com
helmihendrahasilbumi.com
audiencetrust.sucks
thespiritualabolitionist.com
lauratoots.com
fantasticsgelato.com
allinoncrypto.site
youremsys.com
awesome-veganism.com
tsunrp.net
systizen.com
73gardinerdrive.com
legamedary.com
newyorkcityhemorrhoidclinic.com
ffhcompany.com
angermgmtathome.com
plantationrevival.com
utopicvibes.net
envirocare-ss.com
domentemenegi20.com
gropedais.club
thaibizgermany.com
noimagreece.com
yogabizhelp.com
sanrenzong.com
bingent.info
chinhphucphaidep.online
dubojx.com
jennaloren.com
thedesigneryshop.com
opera-historica.com
pizzaterry.com
the-aviate.com
perteprampram01.net
pastormariorondon.com
dream-case.com
ocleanwholesaler.com
masdimensiones.com
fireworkstycoons.com
porntvh.com
fixedpriceelectrician.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/836-4-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/836-5-0x000000000041D0B0-mapping.dmp xloader behavioral1/memory/284-6-0x0000000000000000-mapping.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1200 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Materials.exeMaterials.execmmon32.exedescription pid process target process PID 1888 set thread context of 836 1888 Materials.exe Materials.exe PID 836 set thread context of 1236 836 Materials.exe Explorer.EXE PID 284 set thread context of 1236 284 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Materials.execmmon32.exepid process 836 Materials.exe 836 Materials.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe 284 cmmon32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Materials.exeMaterials.execmmon32.exepid process 1888 Materials.exe 836 Materials.exe 836 Materials.exe 836 Materials.exe 284 cmmon32.exe 284 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Materials.execmmon32.exedescription pid process Token: SeDebugPrivilege 836 Materials.exe Token: SeDebugPrivilege 284 cmmon32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Materials.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1888 wrote to memory of 1512 1888 Materials.exe cmd.exe PID 1888 wrote to memory of 1512 1888 Materials.exe cmd.exe PID 1888 wrote to memory of 1512 1888 Materials.exe cmd.exe PID 1888 wrote to memory of 1512 1888 Materials.exe cmd.exe PID 1888 wrote to memory of 1432 1888 Materials.exe cmd.exe PID 1888 wrote to memory of 1432 1888 Materials.exe cmd.exe PID 1888 wrote to memory of 1432 1888 Materials.exe cmd.exe PID 1888 wrote to memory of 1432 1888 Materials.exe cmd.exe PID 1888 wrote to memory of 836 1888 Materials.exe Materials.exe PID 1888 wrote to memory of 836 1888 Materials.exe Materials.exe PID 1888 wrote to memory of 836 1888 Materials.exe Materials.exe PID 1888 wrote to memory of 836 1888 Materials.exe Materials.exe PID 1888 wrote to memory of 836 1888 Materials.exe Materials.exe PID 1236 wrote to memory of 284 1236 Explorer.EXE cmmon32.exe PID 1236 wrote to memory of 284 1236 Explorer.EXE cmmon32.exe PID 1236 wrote to memory of 284 1236 Explorer.EXE cmmon32.exe PID 1236 wrote to memory of 284 1236 Explorer.EXE cmmon32.exe PID 284 wrote to memory of 1200 284 cmmon32.exe cmd.exe PID 284 wrote to memory of 1200 284 cmmon32.exe cmd.exe PID 284 wrote to memory of 1200 284 cmmon32.exe cmd.exe PID 284 wrote to memory of 1200 284 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Materials.exe"C:\Users\Admin\AppData\Local\Temp\Materials.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Users\Admin\AppData\Local\Temp\Materials.exe"C:\Users\Admin\AppData\Local\Temp\Materials.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Materials.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/284-6-0x0000000000000000-mapping.dmp
-
memory/284-7-0x0000000000D30000-0x0000000000D3D000-memory.dmpFilesize
52KB
-
memory/284-9-0x0000000000C10000-0x0000000000D1F000-memory.dmpFilesize
1.1MB
-
memory/836-4-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/836-5-0x000000000041D0B0-mapping.dmp
-
memory/1200-8-0x0000000000000000-mapping.dmp
-
memory/1432-3-0x0000000000000000-mapping.dmp
-
memory/1512-2-0x0000000000000000-mapping.dmp