Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 08:26
Static task
static1
Behavioral task
behavioral1
Sample
9tyZf93qRdNHfVw.exe
Resource
win7v20201028
General
-
Target
9tyZf93qRdNHfVw.exe
-
Size
930KB
-
MD5
2967ace274e8984c8543c386a8d0f3e2
-
SHA1
aba6f9d379b6a75b84e1a03ea7cc89d13c952b55
-
SHA256
00b4306bf3aa94183358ece86c01bb245ca2e39ba0a2d56f5b9d8b50c3ba3e91
-
SHA512
88fd9f24c435bcc411a705f4e262ca8ff44ab8df555fb0653cb110769820155c73901ab06784777974e18abaeba58ad97ad12319cb7d68d3128dda7228162d4f
Malware Config
Extracted
formbook
http://www.besteprobioticakopen.online/uszn/
animegriptape.com
pcpnetworks.com
putupmybabyforadoption.com
xn--jvrr98g37n88d.com
fertinvitro.doctor
undonethread.com
avoleague.com
sissysundays.com
guilhermeoliveiro.site
catholicon-bespeckle.info
mardesuenosfundacion.com
songkhoe24.site
shoecityindia.com
smallbathroomdecor.info
tskusa.com
prairiespringsllc.com
kegncoffee.com
clicklounge.xyz
catholicendoflifeplanning.com
steelobzee.com
xiknekiterapia.com
whereinthezooareyou.com
maglex.info
dango3.net
sqjqw4.com
theparadisogroup.com
karthikeyainfraindia.com
luewevedre.com
helpwithmynutrition.com
lengyue.cool
pbipropertiesllc.com
glidedisc.com
sz-rhwjkj.com
776fx.com
kamanantzin.com
grandwhale.com
trump2020shop.net
gentilelibri.com
jarliciouslounge.com
dgcsales.net
hypno.doctor
holidayinnindyairportnorth.com
buysellleasewithlisa.com
girishastore.com
tinynucleargenerators.com
crystalphoenixltd.com
lapplify.com
bailbondinazusa.com
michaelmery.com
tripleecoaching.com
fastenerspelosato.net
horisan-touki.com
marketingavacado.com
centrebiozeina.com
xn--3etz63bc5ck9c.com
rhemachurch4u.com
homeschoolangel.com
romeysworld.com
themixedveggies.com
queendreea.club
epedalflorida.com
blutreemg.com
nongfupingtai.com
shikshs.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3192-13-0x000000000041D0F0-mapping.dmp xloader behavioral2/memory/3192-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/680-22-0x0000000000140000-0x0000000000169000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
9tyZf93qRdNHfVw.exe9tyZf93qRdNHfVw.exewlanext.exedescription pid process target process PID 4808 set thread context of 3192 4808 9tyZf93qRdNHfVw.exe 9tyZf93qRdNHfVw.exe PID 3192 set thread context of 3152 3192 9tyZf93qRdNHfVw.exe Explorer.EXE PID 680 set thread context of 3152 680 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
9tyZf93qRdNHfVw.exe9tyZf93qRdNHfVw.exewlanext.exepid process 4808 9tyZf93qRdNHfVw.exe 4808 9tyZf93qRdNHfVw.exe 4808 9tyZf93qRdNHfVw.exe 3192 9tyZf93qRdNHfVw.exe 3192 9tyZf93qRdNHfVw.exe 3192 9tyZf93qRdNHfVw.exe 3192 9tyZf93qRdNHfVw.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe 680 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
9tyZf93qRdNHfVw.exewlanext.exepid process 3192 9tyZf93qRdNHfVw.exe 3192 9tyZf93qRdNHfVw.exe 3192 9tyZf93qRdNHfVw.exe 680 wlanext.exe 680 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
9tyZf93qRdNHfVw.exe9tyZf93qRdNHfVw.exewlanext.exedescription pid process Token: SeDebugPrivilege 4808 9tyZf93qRdNHfVw.exe Token: SeDebugPrivilege 3192 9tyZf93qRdNHfVw.exe Token: SeDebugPrivilege 680 wlanext.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3152 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
9tyZf93qRdNHfVw.exeExplorer.EXEwlanext.exedescription pid process target process PID 4808 wrote to memory of 64 4808 9tyZf93qRdNHfVw.exe 9tyZf93qRdNHfVw.exe PID 4808 wrote to memory of 64 4808 9tyZf93qRdNHfVw.exe 9tyZf93qRdNHfVw.exe PID 4808 wrote to memory of 64 4808 9tyZf93qRdNHfVw.exe 9tyZf93qRdNHfVw.exe PID 4808 wrote to memory of 3192 4808 9tyZf93qRdNHfVw.exe 9tyZf93qRdNHfVw.exe PID 4808 wrote to memory of 3192 4808 9tyZf93qRdNHfVw.exe 9tyZf93qRdNHfVw.exe PID 4808 wrote to memory of 3192 4808 9tyZf93qRdNHfVw.exe 9tyZf93qRdNHfVw.exe PID 4808 wrote to memory of 3192 4808 9tyZf93qRdNHfVw.exe 9tyZf93qRdNHfVw.exe PID 4808 wrote to memory of 3192 4808 9tyZf93qRdNHfVw.exe 9tyZf93qRdNHfVw.exe PID 4808 wrote to memory of 3192 4808 9tyZf93qRdNHfVw.exe 9tyZf93qRdNHfVw.exe PID 3152 wrote to memory of 680 3152 Explorer.EXE wlanext.exe PID 3152 wrote to memory of 680 3152 Explorer.EXE wlanext.exe PID 3152 wrote to memory of 680 3152 Explorer.EXE wlanext.exe PID 680 wrote to memory of 940 680 wlanext.exe cmd.exe PID 680 wrote to memory of 940 680 wlanext.exe cmd.exe PID 680 wrote to memory of 940 680 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9tyZf93qRdNHfVw.exe"C:\Users\Admin\AppData\Local\Temp\9tyZf93qRdNHfVw.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9tyZf93qRdNHfVw.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\9tyZf93qRdNHfVw.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\9tyZf93qRdNHfVw.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/680-24-0x00000000009A0000-0x0000000000A2F000-memory.dmpFilesize
572KB
-
memory/680-23-0x0000000002D50000-0x0000000003070000-memory.dmpFilesize
3.1MB
-
memory/680-21-0x0000000000D30000-0x0000000000D47000-memory.dmpFilesize
92KB
-
memory/680-22-0x0000000000140000-0x0000000000169000-memory.dmpFilesize
164KB
-
memory/680-19-0x0000000000000000-mapping.dmp
-
memory/940-20-0x0000000000000000-mapping.dmp
-
memory/3152-18-0x0000000003040000-0x000000000310F000-memory.dmpFilesize
828KB
-
memory/3152-25-0x00000000056F0000-0x0000000005802000-memory.dmpFilesize
1.1MB
-
memory/3192-12-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3192-13-0x000000000041D0F0-mapping.dmp
-
memory/3192-15-0x00000000011B0000-0x00000000014D0000-memory.dmpFilesize
3.1MB
-
memory/3192-16-0x0000000000B70000-0x0000000000B80000-memory.dmpFilesize
64KB
-
memory/4808-2-0x00000000739D0000-0x00000000740BE000-memory.dmpFilesize
6.9MB
-
memory/4808-11-0x00000000076A0000-0x00000000076A1000-memory.dmpFilesize
4KB
-
memory/4808-10-0x00000000075A0000-0x00000000075F6000-memory.dmpFilesize
344KB
-
memory/4808-9-0x0000000005510000-0x000000000551E000-memory.dmpFilesize
56KB
-
memory/4808-8-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/4808-7-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/4808-6-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/4808-5-0x00000000058E0000-0x00000000058E1000-memory.dmpFilesize
4KB
-
memory/4808-3-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB