Analysis
-
max time kernel
38s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
16-01-2021 07:26
Static task
static1
Behavioral task
behavioral1
Sample
eaae6c96269eff1ba5834ce343a2d1bf.exe
Resource
win7v20201028
General
-
Target
eaae6c96269eff1ba5834ce343a2d1bf.exe
-
Size
395KB
-
MD5
eaae6c96269eff1ba5834ce343a2d1bf
-
SHA1
23917bba7902c5c54f36f863b374795ac5615324
-
SHA256
57fcc02e839d4ae0b8965ed55738960a952006f5e70ee1317f2bfacb97a43a5f
-
SHA512
c494c998ff4997e72265db49d13e6ed6d5db05d36ac9ed3b19a65664b11f79f7c99ea8ad442e053eed97b14cb5cf4c329202781522de97a1ab35a143e2d5c243
Malware Config
Extracted
formbook
http://www.herbmedia.net/csv8/
slgacha.com
oohdough.com
6983ylc.com
aykassociate.com
latin-hotspot.com
starrockindia.com
beamsubway.com
queensboutique1000.com
madbaddie.com
bhoomimart.com
ankitparivar.com
aldanasanchezmx.com
citest1597669833.com
cristianofreitas.com
myplantus.com
counterfeitmilk.com
8xf39.com
pregnantwomens.com
yyyut6.com
stnanguo.com
fessusesefsee.com
logansshop.net
familydalmatianhomes.com
accessible.legal
epicmassiveconcepts.com
indianfactopedia.com
exit-divorce.com
colliapse.com
nosishop.com
hayat-aljowaily.com
soundon.events
previnacovid19-br.com
traptlongview.com
splendidhotelspa.com
masterzushop.com
ednevents.com
studentdividers.com
treningi-enduro.com
hostingcoaster.com
gourmetgroceriesfast.com
thesouthbeachlife.com
teemergin.com
fixmygearfast.com
arb-invest.com
shemaledreamz.com
1819apparel.com
thedigitalsatyam.com
alparmuhendislik.com
distinctmusicproductions.com
procreditexpert.com
insights4innovation.com
jzbtl.com
1033325.com
sorteocamper.info
scheherazadelegault.com
glowportraiture.com
cleitstaapps.com
globepublishers.com
stattests.com
brainandbodystrengthcoach.com
magenx2.info
escaparati.com
wood-decor24.com
travelnetafrica.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1640-9-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1640-10-0x000000000041D0C0-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
eaae6c96269eff1ba5834ce343a2d1bf.exedescription pid process target process PID 1696 set thread context of 1640 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
eaae6c96269eff1ba5834ce343a2d1bf.exeeaae6c96269eff1ba5834ce343a2d1bf.exepid process 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe 1640 eaae6c96269eff1ba5834ce343a2d1bf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
eaae6c96269eff1ba5834ce343a2d1bf.exedescription pid process Token: SeDebugPrivilege 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
eaae6c96269eff1ba5834ce343a2d1bf.exedescription pid process target process PID 1696 wrote to memory of 1216 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe schtasks.exe PID 1696 wrote to memory of 1216 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe schtasks.exe PID 1696 wrote to memory of 1216 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe schtasks.exe PID 1696 wrote to memory of 1216 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe schtasks.exe PID 1696 wrote to memory of 1688 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1696 wrote to memory of 1688 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1696 wrote to memory of 1688 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1696 wrote to memory of 1688 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1696 wrote to memory of 1640 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1696 wrote to memory of 1640 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1696 wrote to memory of 1640 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1696 wrote to memory of 1640 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1696 wrote to memory of 1640 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1696 wrote to memory of 1640 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1696 wrote to memory of 1640 1696 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaae6c96269eff1ba5834ce343a2d1bf.exe"C:\Users\Admin\AppData\Local\Temp\eaae6c96269eff1ba5834ce343a2d1bf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmpmdTAj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBCAB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\eaae6c96269eff1ba5834ce343a2d1bf.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\eaae6c96269eff1ba5834ce343a2d1bf.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpBCAB.tmpMD5
4f032319b43f3c72da762b076ad551a2
SHA11cfb5ac7492c557e61d25b454551ddadbc1e7bfd
SHA256a80d74e8efc74d57f255d6252b70dd2a53f0de04ae422e62c3a32f005396edbe
SHA51258999ff5646fb65c61eae2944b1e0ed3a5672c59d813ebe892cafe71fb0362eed88743f63e3c0429de175e91e38433faf7df41b36d42da57e90efde888cbd713
-
memory/1216-7-0x0000000000000000-mapping.dmp
-
memory/1640-9-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1640-10-0x000000000041D0C0-mapping.dmp
-
memory/1696-2-0x0000000074D20000-0x000000007540E000-memory.dmpFilesize
6.9MB
-
memory/1696-3-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/1696-5-0x0000000000640000-0x000000000064E000-memory.dmpFilesize
56KB
-
memory/1696-6-0x0000000005100000-0x0000000005148000-memory.dmpFilesize
288KB