Analysis
-
max time kernel
38s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
18-01-2021 09:46
Static task
static1
Behavioral task
behavioral1
Sample
1c68b56f273eab047eccce3cbad492a5.exe
Resource
win7v20201028
General
-
Target
1c68b56f273eab047eccce3cbad492a5.exe
-
Size
885KB
-
MD5
1c68b56f273eab047eccce3cbad492a5
-
SHA1
76598e8315496d2bfcaa35edd12f521483ff5c31
-
SHA256
6961aeab02e7dafda1e2f16e9ec88fd5dce6199925a71f22657a2c48627ae087
-
SHA512
7f24e6f61a86314e91275d4492b74659ca34f036fb32c20eccaebd68410a228dae3d1bca2f6faa74933692b50a19aca693b3c5ca803c3717175e19b58d1ba6e6
Malware Config
Extracted
formbook
http://www.kaiyuansu.pro/incn/
1bovvfk93jd.com
enlightenedhealthcoaching.com
findthatsmartphone.com
intelligentsystemsus.com
xn--lmsealamientos-tnb.com
eot0luh5ia.men
babanewshop.com
beyond-bit.com
meritane.com
buythinsecret.com
c2ornot.com
twelvesband.com
rktlends.com
bourseandish.com
happyshop88.com
topangacanyonvintage.com
epersonalloansonline.com
roofers-anaheim.com
shanghaiys.net
bickel.wtf
macetitasdecorativas.com
maisonscoeurdepivoine.com
milano1980.com
thetealworld.com
khocam.com
electrofranco.com
biduoccotruyen.xyz
marcagrafika.com
goodgrabber.com
sentire.design
180wea.com
pnwfireextinguishers.com
paulborneo.com
potlucks.net
sdyqxx.com
pjy589.com
lovetovisit.info
vaultedslabs.com
mirrorimpact.net
americanmarketedge.com
therandstadride.com
yamadaya-online.com
stardust-cafe.com
sk375.com
abipisan.com
thesalesforceradi.computer
ronaldmorrisdc.com
thetreasurebook.com
personalruncoach.com
quba6.com
uoawrlhwg.icu
cathygass.com
tribesy.net
nishagile.com
aworldthroughhereyes.com
adeptroofmaintenance.com
jacketgraffiti.com
deeprigelphoto.com
qth.xyz
pontacols.com
sunflour-bakehouse.com
forevermesmerizedcomplexion.com
maglex.info
somright.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1660-8-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1660-9-0x000000000041D060-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1c68b56f273eab047eccce3cbad492a5.exedescription pid process target process PID 1636 set thread context of 1660 1636 1c68b56f273eab047eccce3cbad492a5.exe 1c68b56f273eab047eccce3cbad492a5.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
1c68b56f273eab047eccce3cbad492a5.exepid process 1660 1c68b56f273eab047eccce3cbad492a5.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
1c68b56f273eab047eccce3cbad492a5.exedescription pid process target process PID 1636 wrote to memory of 1660 1636 1c68b56f273eab047eccce3cbad492a5.exe 1c68b56f273eab047eccce3cbad492a5.exe PID 1636 wrote to memory of 1660 1636 1c68b56f273eab047eccce3cbad492a5.exe 1c68b56f273eab047eccce3cbad492a5.exe PID 1636 wrote to memory of 1660 1636 1c68b56f273eab047eccce3cbad492a5.exe 1c68b56f273eab047eccce3cbad492a5.exe PID 1636 wrote to memory of 1660 1636 1c68b56f273eab047eccce3cbad492a5.exe 1c68b56f273eab047eccce3cbad492a5.exe PID 1636 wrote to memory of 1660 1636 1c68b56f273eab047eccce3cbad492a5.exe 1c68b56f273eab047eccce3cbad492a5.exe PID 1636 wrote to memory of 1660 1636 1c68b56f273eab047eccce3cbad492a5.exe 1c68b56f273eab047eccce3cbad492a5.exe PID 1636 wrote to memory of 1660 1636 1c68b56f273eab047eccce3cbad492a5.exe 1c68b56f273eab047eccce3cbad492a5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c68b56f273eab047eccce3cbad492a5.exe"C:\Users\Admin\AppData\Local\Temp\1c68b56f273eab047eccce3cbad492a5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1c68b56f273eab047eccce3cbad492a5.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1636-2-0x00000000746F0000-0x0000000074DDE000-memory.dmpFilesize
6.9MB
-
memory/1636-3-0x0000000000BF0000-0x0000000000BF1000-memory.dmpFilesize
4KB
-
memory/1636-5-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/1636-6-0x0000000000690000-0x000000000069E000-memory.dmpFilesize
56KB
-
memory/1636-7-0x0000000002200000-0x0000000002255000-memory.dmpFilesize
340KB
-
memory/1660-8-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1660-9-0x000000000041D060-mapping.dmp
-
memory/1660-11-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB