Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 13:10
Static task
static1
Behavioral task
behavioral1
Sample
Calendario dei pagamenti.exe
Resource
win7v20201028
General
-
Target
Calendario dei pagamenti.exe
-
Size
219KB
-
MD5
1a02db6595fb5471a1d91a4f51897269
-
SHA1
644069ab472309d4ecfca95de736dfb14676a776
-
SHA256
dd9c6267a87c89067d157e28d6f3ca17f958871f3d403609ed72dad80514e226
-
SHA512
ca86ca60343f96581c67ddaabd8553cfa030a1ae7cbedc0f05da403d972f7c2de9bf3048a0dbd43642c846f92f9c6f5b280f6537ef013a6d121fb70d72a2905d
Malware Config
Extracted
formbook
http://www.smallcoloradoweddings.com/kio8/
greeaircondition.com
thewilmingtonguide.com
cbluedotlivewdmall.com
globalcrime24.com
heightsplace.com
ghar.pro
asosbira.com
melolandia.com
velactun.com
erniesimms.com
nutbullet.com
drizzerstr.com
hnqym888.com
ghorowaseba.com
1317efoxchasedrive.info
stjudetroop623.com
facestaj.com
airpromaskaccessories.com
wolfetailors.com
56ohdc2016.com
estedindustries.com
magmaplant.net
tf-iot.com
jtkqmz.com
helmihendrahasilbumi.com
audiencetrust.sucks
thespiritualabolitionist.com
lauratoots.com
fantasticsgelato.com
allinoncrypto.site
youremsys.com
awesome-veganism.com
tsunrp.net
systizen.com
73gardinerdrive.com
legamedary.com
newyorkcityhemorrhoidclinic.com
ffhcompany.com
angermgmtathome.com
plantationrevival.com
utopicvibes.net
envirocare-ss.com
domentemenegi20.com
gropedais.club
thaibizgermany.com
noimagreece.com
yogabizhelp.com
sanrenzong.com
bingent.info
chinhphucphaidep.online
dubojx.com
jennaloren.com
thedesigneryshop.com
opera-historica.com
pizzaterry.com
the-aviate.com
perteprampram01.net
pastormariorondon.com
dream-case.com
ocleanwholesaler.com
masdimensiones.com
fireworkstycoons.com
porntvh.com
fixedpriceelectrician.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1112-4-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1996-14-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1016 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Calendario dei pagamenti.exeCalendario dei pagamenti.exeraserver.exedescription pid process target process PID 2044 set thread context of 1112 2044 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 1112 set thread context of 1268 1112 Calendario dei pagamenti.exe Explorer.EXE PID 1112 set thread context of 1268 1112 Calendario dei pagamenti.exe Explorer.EXE PID 1996 set thread context of 1268 1996 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
Calendario dei pagamenti.exeraserver.exepid process 1112 Calendario dei pagamenti.exe 1112 Calendario dei pagamenti.exe 1112 Calendario dei pagamenti.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe 1996 raserver.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Calendario dei pagamenti.exeCalendario dei pagamenti.exeraserver.exepid process 2044 Calendario dei pagamenti.exe 1112 Calendario dei pagamenti.exe 1112 Calendario dei pagamenti.exe 1112 Calendario dei pagamenti.exe 1112 Calendario dei pagamenti.exe 1996 raserver.exe 1996 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Calendario dei pagamenti.exeraserver.exedescription pid process Token: SeDebugPrivilege 1112 Calendario dei pagamenti.exe Token: SeDebugPrivilege 1996 raserver.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Calendario dei pagamenti.exeExplorer.EXEraserver.exedescription pid process target process PID 2044 wrote to memory of 1112 2044 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 2044 wrote to memory of 1112 2044 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 2044 wrote to memory of 1112 2044 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 2044 wrote to memory of 1112 2044 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 2044 wrote to memory of 1112 2044 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 1268 wrote to memory of 1996 1268 Explorer.EXE raserver.exe PID 1268 wrote to memory of 1996 1268 Explorer.EXE raserver.exe PID 1268 wrote to memory of 1996 1268 Explorer.EXE raserver.exe PID 1268 wrote to memory of 1996 1268 Explorer.EXE raserver.exe PID 1996 wrote to memory of 1016 1996 raserver.exe cmd.exe PID 1996 wrote to memory of 1016 1996 raserver.exe cmd.exe PID 1996 wrote to memory of 1016 1996 raserver.exe cmd.exe PID 1996 wrote to memory of 1016 1996 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1016-12-0x0000000000000000-mapping.dmp
-
memory/1112-3-0x000000000041D0B0-mapping.dmp
-
memory/1112-4-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1112-5-0x00000000009D0000-0x0000000000CD3000-memory.dmpFilesize
3.0MB
-
memory/1112-6-0x00000000000A0000-0x00000000000B0000-memory.dmpFilesize
64KB
-
memory/1112-8-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/1120-18-0x000007FEF77C0000-0x000007FEF7A3A000-memory.dmpFilesize
2.5MB
-
memory/1268-17-0x00000000091C0000-0x0000000009327000-memory.dmpFilesize
1.4MB
-
memory/1268-7-0x00000000042C0000-0x0000000004390000-memory.dmpFilesize
832KB
-
memory/1268-9-0x00000000074E0000-0x0000000007652000-memory.dmpFilesize
1.4MB
-
memory/1996-10-0x0000000000000000-mapping.dmp
-
memory/1996-15-0x0000000002030000-0x0000000002333000-memory.dmpFilesize
3.0MB
-
memory/1996-13-0x0000000000C10000-0x0000000000C2C000-memory.dmpFilesize
112KB
-
memory/1996-16-0x0000000000820000-0x00000000008AF000-memory.dmpFilesize
572KB
-
memory/1996-14-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/2044-2-0x0000000075251000-0x0000000075253000-memory.dmpFilesize
8KB