Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 13:10
Static task
static1
Behavioral task
behavioral1
Sample
Calendario dei pagamenti.exe
Resource
win7v20201028
General
-
Target
Calendario dei pagamenti.exe
-
Size
219KB
-
MD5
1a02db6595fb5471a1d91a4f51897269
-
SHA1
644069ab472309d4ecfca95de736dfb14676a776
-
SHA256
dd9c6267a87c89067d157e28d6f3ca17f958871f3d403609ed72dad80514e226
-
SHA512
ca86ca60343f96581c67ddaabd8553cfa030a1ae7cbedc0f05da403d972f7c2de9bf3048a0dbd43642c846f92f9c6f5b280f6537ef013a6d121fb70d72a2905d
Malware Config
Extracted
formbook
http://www.smallcoloradoweddings.com/kio8/
greeaircondition.com
thewilmingtonguide.com
cbluedotlivewdmall.com
globalcrime24.com
heightsplace.com
ghar.pro
asosbira.com
melolandia.com
velactun.com
erniesimms.com
nutbullet.com
drizzerstr.com
hnqym888.com
ghorowaseba.com
1317efoxchasedrive.info
stjudetroop623.com
facestaj.com
airpromaskaccessories.com
wolfetailors.com
56ohdc2016.com
estedindustries.com
magmaplant.net
tf-iot.com
jtkqmz.com
helmihendrahasilbumi.com
audiencetrust.sucks
thespiritualabolitionist.com
lauratoots.com
fantasticsgelato.com
allinoncrypto.site
youremsys.com
awesome-veganism.com
tsunrp.net
systizen.com
73gardinerdrive.com
legamedary.com
newyorkcityhemorrhoidclinic.com
ffhcompany.com
angermgmtathome.com
plantationrevival.com
utopicvibes.net
envirocare-ss.com
domentemenegi20.com
gropedais.club
thaibizgermany.com
noimagreece.com
yogabizhelp.com
sanrenzong.com
bingent.info
chinhphucphaidep.online
dubojx.com
jennaloren.com
thedesigneryshop.com
opera-historica.com
pizzaterry.com
the-aviate.com
perteprampram01.net
pastormariorondon.com
dream-case.com
ocleanwholesaler.com
masdimensiones.com
fireworkstycoons.com
porntvh.com
fixedpriceelectrician.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3224-8-0x0000000000D60000-0x0000000000D89000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Calendario dei pagamenti.exeCalendario dei pagamenti.execmmon32.exedescription pid process target process PID 644 set thread context of 2224 644 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 2224 set thread context of 2580 2224 Calendario dei pagamenti.exe Explorer.EXE PID 3224 set thread context of 2580 3224 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
Calendario dei pagamenti.execmmon32.exepid process 2224 Calendario dei pagamenti.exe 2224 Calendario dei pagamenti.exe 2224 Calendario dei pagamenti.exe 2224 Calendario dei pagamenti.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe 3224 cmmon32.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Calendario dei pagamenti.exeCalendario dei pagamenti.execmmon32.exepid process 644 Calendario dei pagamenti.exe 644 Calendario dei pagamenti.exe 2224 Calendario dei pagamenti.exe 2224 Calendario dei pagamenti.exe 2224 Calendario dei pagamenti.exe 3224 cmmon32.exe 3224 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Calendario dei pagamenti.execmmon32.exedescription pid process Token: SeDebugPrivilege 2224 Calendario dei pagamenti.exe Token: SeDebugPrivilege 3224 cmmon32.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2580 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Calendario dei pagamenti.exeExplorer.EXEcmmon32.exedescription pid process target process PID 644 wrote to memory of 2224 644 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 644 wrote to memory of 2224 644 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 644 wrote to memory of 2224 644 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 644 wrote to memory of 2224 644 Calendario dei pagamenti.exe Calendario dei pagamenti.exe PID 2580 wrote to memory of 3224 2580 Explorer.EXE cmmon32.exe PID 2580 wrote to memory of 3224 2580 Explorer.EXE cmmon32.exe PID 2580 wrote to memory of 3224 2580 Explorer.EXE cmmon32.exe PID 3224 wrote to memory of 516 3224 cmmon32.exe cmd.exe PID 3224 wrote to memory of 516 3224 cmmon32.exe cmd.exe PID 3224 wrote to memory of 516 3224 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Calendario dei pagamenti.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/516-9-0x0000000000000000-mapping.dmp
-
memory/2224-2-0x000000000018D0B0-mapping.dmp
-
memory/2224-4-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/2224-3-0x0000000000A30000-0x0000000000D50000-memory.dmpFilesize
3.1MB
-
memory/2580-5-0x0000000005210000-0x000000000537A000-memory.dmpFilesize
1.4MB
-
memory/2580-12-0x0000000002A30000-0x0000000002AE6000-memory.dmpFilesize
728KB
-
memory/3224-6-0x0000000000000000-mapping.dmp
-
memory/3224-8-0x0000000000D60000-0x0000000000D89000-memory.dmpFilesize
164KB
-
memory/3224-7-0x0000000000EF0000-0x0000000000EFC000-memory.dmpFilesize
48KB
-
memory/3224-10-0x0000000004FE0000-0x0000000005300000-memory.dmpFilesize
3.1MB
-
memory/3224-11-0x0000000004CB0000-0x0000000004D3F000-memory.dmpFilesize
572KB