Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-01-2021 17:37
Static task
static1
Behavioral task
behavioral1
Sample
eaae6c96269eff1ba5834ce343a2d1bf.exe
Resource
win7v20201028
General
-
Target
eaae6c96269eff1ba5834ce343a2d1bf.exe
-
Size
395KB
-
MD5
eaae6c96269eff1ba5834ce343a2d1bf
-
SHA1
23917bba7902c5c54f36f863b374795ac5615324
-
SHA256
57fcc02e839d4ae0b8965ed55738960a952006f5e70ee1317f2bfacb97a43a5f
-
SHA512
c494c998ff4997e72265db49d13e6ed6d5db05d36ac9ed3b19a65664b11f79f7c99ea8ad442e053eed97b14cb5cf4c329202781522de97a1ab35a143e2d5c243
Malware Config
Extracted
formbook
http://www.herbmedia.net/csv8/
slgacha.com
oohdough.com
6983ylc.com
aykassociate.com
latin-hotspot.com
starrockindia.com
beamsubway.com
queensboutique1000.com
madbaddie.com
bhoomimart.com
ankitparivar.com
aldanasanchezmx.com
citest1597669833.com
cristianofreitas.com
myplantus.com
counterfeitmilk.com
8xf39.com
pregnantwomens.com
yyyut6.com
stnanguo.com
fessusesefsee.com
logansshop.net
familydalmatianhomes.com
accessible.legal
epicmassiveconcepts.com
indianfactopedia.com
exit-divorce.com
colliapse.com
nosishop.com
hayat-aljowaily.com
soundon.events
previnacovid19-br.com
traptlongview.com
splendidhotelspa.com
masterzushop.com
ednevents.com
studentdividers.com
treningi-enduro.com
hostingcoaster.com
gourmetgroceriesfast.com
thesouthbeachlife.com
teemergin.com
fixmygearfast.com
arb-invest.com
shemaledreamz.com
1819apparel.com
thedigitalsatyam.com
alparmuhendislik.com
distinctmusicproductions.com
procreditexpert.com
insights4innovation.com
jzbtl.com
1033325.com
sorteocamper.info
scheherazadelegault.com
glowportraiture.com
cleitstaapps.com
globepublishers.com
stattests.com
brainandbodystrengthcoach.com
magenx2.info
escaparati.com
wood-decor24.com
travelnetafrica.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/280-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/280-13-0x000000000041D0C0-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
eaae6c96269eff1ba5834ce343a2d1bf.exedescription pid process target process PID 1864 set thread context of 280 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
eaae6c96269eff1ba5834ce343a2d1bf.exeeaae6c96269eff1ba5834ce343a2d1bf.exepid process 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe 280 eaae6c96269eff1ba5834ce343a2d1bf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
eaae6c96269eff1ba5834ce343a2d1bf.exedescription pid process Token: SeDebugPrivilege 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
eaae6c96269eff1ba5834ce343a2d1bf.exedescription pid process target process PID 1864 wrote to memory of 1676 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe schtasks.exe PID 1864 wrote to memory of 1676 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe schtasks.exe PID 1864 wrote to memory of 1676 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe schtasks.exe PID 1864 wrote to memory of 1676 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe schtasks.exe PID 1864 wrote to memory of 280 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1864 wrote to memory of 280 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1864 wrote to memory of 280 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1864 wrote to memory of 280 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1864 wrote to memory of 280 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1864 wrote to memory of 280 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe PID 1864 wrote to memory of 280 1864 eaae6c96269eff1ba5834ce343a2d1bf.exe eaae6c96269eff1ba5834ce343a2d1bf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eaae6c96269eff1ba5834ce343a2d1bf.exe"C:\Users\Admin\AppData\Local\Temp\eaae6c96269eff1ba5834ce343a2d1bf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CmpmdTAj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF122.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\eaae6c96269eff1ba5834ce343a2d1bf.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\windows defender\MSASCui.exe"C:\Program Files\windows defender\MSASCui.exe" -quickscan1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF122.tmpMD5
484086155035c9a51809325bf3377640
SHA1fcb92a0191ff8af9783827fa492364efceeeb290
SHA256c16daa9619c7e12b27762e45eaec88519957b7d40eb4ef09e2fa29a68a70c9a2
SHA512b6bcc95fde9669c614f4a5cb954b71345e680852d5eaf2776987e6827810857a5ba8da50b167d6219be81989ae08c815c5b1063b7dff686eedb62a962475f152
-
memory/280-12-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/280-13-0x000000000041D0C0-mapping.dmp
-
memory/280-15-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/864-7-0x000007FEFBA01000-0x000007FEFBA03000-memory.dmpFilesize
8KB
-
memory/864-8-0x0000000001D30000-0x0000000001D31000-memory.dmpFilesize
4KB
-
memory/1676-10-0x0000000000000000-mapping.dmp
-
memory/1864-2-0x00000000743D0000-0x0000000074ABE000-memory.dmpFilesize
6.9MB
-
memory/1864-3-0x0000000001040000-0x0000000001041000-memory.dmpFilesize
4KB
-
memory/1864-5-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1864-6-0x00000000003D0000-0x00000000003DE000-memory.dmpFilesize
56KB
-
memory/1864-9-0x0000000004780000-0x00000000047C8000-memory.dmpFilesize
288KB