Analysis
-
max time kernel
150s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
16-01-2021 07:33
Static task
static1
Behavioral task
behavioral1
Sample
5YfNeXk1f0wrxXm.exe
Resource
win7v20201028
General
-
Target
5YfNeXk1f0wrxXm.exe
-
Size
353KB
-
MD5
a6af527f30950267d700bbc88817cc3a
-
SHA1
c72623f2a24529ae9563f8b0d5a3d5171c1a8537
-
SHA256
8b8fbe6805c361f5b04a198e8549a9797233faf4b9039004ebab000de593608d
-
SHA512
5b0bbb647f4df6d14188c846947a5d0ba0da99dc8e85491c682f615a4c973dd79302c004549ed9bc3b073f8265de46e6758ffa6e60d643409c79b1bbc3d7aa50
Malware Config
Extracted
formbook
http://www.allismd.com/ur06/
philippebrooksdesign.com
cmoorestudio.com
profille-sarina23tammara.club
dqulxe.com
uiffinger.com
nolarapper.com
maconanimalexterminator.com
bisovka.com
loveisloveent.com
datication.com
spxo66.com
drhelpnow.com
ladybug-cle.com
macocome.com
thepoppysocks.com
eldritchparadox.com
mercadolibre.company
ismartfarm.com
kansascarlot.com
kevinld.com
p87mbu2ss.xyz
the-makery.info
untegoro.site
newyorkcityhemorrhoidcenter.com
crystalclearwholistics.com
iregentos.info
fullskis.com
promanconsortium.com
800029120.com
mummyisme.com
humpychocks.com
myfavestuff.store
naturalfemina.com
bimetalthermostatksd.com
draysehaniminciftligi.com
sf9820.com
4thop.com
24les.com
thepupcrew.com
strangephobias.com
hotmamabody.com
restaurantsilhouette.com
texasadultdayservices.com
binahaiat.com
nipseythegreat.com
pelisplusxd.net
mamborio.com
elitedigitalperformance.com
therileyretreat.com
aieqbgk.icu
corkboardit.net
katieberiont.com
telemedicinehamilton.com
imagistor.com
tekdesignltd.com
bmw-7979.com
animaliaartist.com
straightlineautoserviceerie.net
qoo10online.com
tesseracoffee.com
central-car-sales.com
thecleaningenthusiast.com
musicmercch.com
pearlpham.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1464-3-0x000000000041D000-mapping.dmp xloader behavioral1/memory/1464-2-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/664-4-0x0000000000000000-mapping.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 696 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5YfNeXk1f0wrxXm.exe5YfNeXk1f0wrxXm.exeraserver.exedescription pid process target process PID 844 set thread context of 1464 844 5YfNeXk1f0wrxXm.exe 5YfNeXk1f0wrxXm.exe PID 1464 set thread context of 1236 1464 5YfNeXk1f0wrxXm.exe Explorer.EXE PID 664 set thread context of 1236 664 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
5YfNeXk1f0wrxXm.exeraserver.exepid process 1464 5YfNeXk1f0wrxXm.exe 1464 5YfNeXk1f0wrxXm.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe 664 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
5YfNeXk1f0wrxXm.exeraserver.exepid process 1464 5YfNeXk1f0wrxXm.exe 1464 5YfNeXk1f0wrxXm.exe 1464 5YfNeXk1f0wrxXm.exe 664 raserver.exe 664 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5YfNeXk1f0wrxXm.exeraserver.exedescription pid process Token: SeDebugPrivilege 1464 5YfNeXk1f0wrxXm.exe Token: SeDebugPrivilege 664 raserver.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
5YfNeXk1f0wrxXm.exeExplorer.EXEraserver.exedescription pid process target process PID 844 wrote to memory of 1464 844 5YfNeXk1f0wrxXm.exe 5YfNeXk1f0wrxXm.exe PID 844 wrote to memory of 1464 844 5YfNeXk1f0wrxXm.exe 5YfNeXk1f0wrxXm.exe PID 844 wrote to memory of 1464 844 5YfNeXk1f0wrxXm.exe 5YfNeXk1f0wrxXm.exe PID 844 wrote to memory of 1464 844 5YfNeXk1f0wrxXm.exe 5YfNeXk1f0wrxXm.exe PID 844 wrote to memory of 1464 844 5YfNeXk1f0wrxXm.exe 5YfNeXk1f0wrxXm.exe PID 844 wrote to memory of 1464 844 5YfNeXk1f0wrxXm.exe 5YfNeXk1f0wrxXm.exe PID 844 wrote to memory of 1464 844 5YfNeXk1f0wrxXm.exe 5YfNeXk1f0wrxXm.exe PID 1236 wrote to memory of 664 1236 Explorer.EXE raserver.exe PID 1236 wrote to memory of 664 1236 Explorer.EXE raserver.exe PID 1236 wrote to memory of 664 1236 Explorer.EXE raserver.exe PID 1236 wrote to memory of 664 1236 Explorer.EXE raserver.exe PID 664 wrote to memory of 696 664 raserver.exe cmd.exe PID 664 wrote to memory of 696 664 raserver.exe cmd.exe PID 664 wrote to memory of 696 664 raserver.exe cmd.exe PID 664 wrote to memory of 696 664 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5YfNeXk1f0wrxXm.exe"C:\Users\Admin\AppData\Local\Temp\5YfNeXk1f0wrxXm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5YfNeXk1f0wrxXm.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\5YfNeXk1f0wrxXm.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/664-4-0x0000000000000000-mapping.dmp
-
memory/664-5-0x0000000000F90000-0x0000000000FAC000-memory.dmpFilesize
112KB
-
memory/664-7-0x0000000000E20000-0x0000000000EEB000-memory.dmpFilesize
812KB
-
memory/696-6-0x0000000000000000-mapping.dmp
-
memory/1464-3-0x000000000041D000-mapping.dmp
-
memory/1464-2-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB