Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 18:32
Static task
static1
Behavioral task
behavioral1
Sample
Materials.exe
Resource
win7v20201028
General
-
Target
Materials.exe
-
Size
550KB
-
MD5
3fa32441cdf20f227676163f2ddd66c4
-
SHA1
7b6bf423286a2096449015602d4d5db258866da6
-
SHA256
fe7c717b3f64d3c721f760c5d62cf09b7bfcdb8fcbf163e7958907a3d7b2dfad
-
SHA512
20985ad52ee625f6ded7a45f2a83f57ebf1db97abd10959d6cd30f1e404da7879cbf34630f3be70679183bf1dbd46795991c5a68f9c1eb9dd9bfb7a980b9da48
Malware Config
Extracted
formbook
http://www.smallcoloradoweddings.com/kio8/
greeaircondition.com
thewilmingtonguide.com
cbluedotlivewdmall.com
globalcrime24.com
heightsplace.com
ghar.pro
asosbira.com
melolandia.com
velactun.com
erniesimms.com
nutbullet.com
drizzerstr.com
hnqym888.com
ghorowaseba.com
1317efoxchasedrive.info
stjudetroop623.com
facestaj.com
airpromaskaccessories.com
wolfetailors.com
56ohdc2016.com
estedindustries.com
magmaplant.net
tf-iot.com
jtkqmz.com
helmihendrahasilbumi.com
audiencetrust.sucks
thespiritualabolitionist.com
lauratoots.com
fantasticsgelato.com
allinoncrypto.site
youremsys.com
awesome-veganism.com
tsunrp.net
systizen.com
73gardinerdrive.com
legamedary.com
newyorkcityhemorrhoidclinic.com
ffhcompany.com
angermgmtathome.com
plantationrevival.com
utopicvibes.net
envirocare-ss.com
domentemenegi20.com
gropedais.club
thaibizgermany.com
noimagreece.com
yogabizhelp.com
sanrenzong.com
bingent.info
chinhphucphaidep.online
dubojx.com
jennaloren.com
thedesigneryshop.com
opera-historica.com
pizzaterry.com
the-aviate.com
perteprampram01.net
pastormariorondon.com
dream-case.com
ocleanwholesaler.com
masdimensiones.com
fireworkstycoons.com
porntvh.com
fixedpriceelectrician.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3160-8-0x0000000003000000-0x0000000003029000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Materials.exeMaterials.exemsdt.exedescription pid process target process PID 640 set thread context of 4060 640 Materials.exe Materials.exe PID 4060 set thread context of 2868 4060 Materials.exe Explorer.EXE PID 3160 set thread context of 2868 3160 msdt.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Materials.exemsdt.exepid process 4060 Materials.exe 4060 Materials.exe 4060 Materials.exe 4060 Materials.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe 3160 msdt.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Materials.exeMaterials.exemsdt.exepid process 640 Materials.exe 640 Materials.exe 4060 Materials.exe 4060 Materials.exe 4060 Materials.exe 3160 msdt.exe 3160 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Materials.exemsdt.exedescription pid process Token: SeDebugPrivilege 4060 Materials.exe Token: SeDebugPrivilege 3160 msdt.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2868 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Materials.exeExplorer.EXEmsdt.exedescription pid process target process PID 640 wrote to memory of 4060 640 Materials.exe Materials.exe PID 640 wrote to memory of 4060 640 Materials.exe Materials.exe PID 640 wrote to memory of 4060 640 Materials.exe Materials.exe PID 640 wrote to memory of 4060 640 Materials.exe Materials.exe PID 2868 wrote to memory of 3160 2868 Explorer.EXE msdt.exe PID 2868 wrote to memory of 3160 2868 Explorer.EXE msdt.exe PID 2868 wrote to memory of 3160 2868 Explorer.EXE msdt.exe PID 3160 wrote to memory of 936 3160 msdt.exe cmd.exe PID 3160 wrote to memory of 936 3160 msdt.exe cmd.exe PID 3160 wrote to memory of 936 3160 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\Materials.exe"C:\Users\Admin\AppData\Local\Temp\Materials.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\Temp\Materials.exe"C:\Users\Admin\AppData\Local\Temp\Materials.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4060 -
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Materials.exe"3⤵PID:936
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/936-10-0x0000000000000000-mapping.dmp
-
memory/2868-5-0x0000000004BD0000-0x0000000004D02000-memory.dmpFilesize
1.2MB
-
memory/2868-12-0x0000000004D10000-0x0000000004E9F000-memory.dmpFilesize
1.6MB
-
memory/3160-6-0x0000000000000000-mapping.dmp
-
memory/3160-7-0x00000000002E0000-0x0000000000453000-memory.dmpFilesize
1.4MB
-
memory/3160-9-0x00000000045B0000-0x00000000048D0000-memory.dmpFilesize
3.1MB
-
memory/3160-8-0x0000000003000000-0x0000000003029000-memory.dmpFilesize
164KB
-
memory/3160-11-0x0000000004960000-0x00000000049EF000-memory.dmpFilesize
572KB
-
memory/4060-2-0x000000000014D0B0-mapping.dmp
-
memory/4060-4-0x0000000000530000-0x0000000000540000-memory.dmpFilesize
64KB
-
memory/4060-3-0x0000000000BA0000-0x0000000000EC0000-memory.dmpFilesize
3.1MB