Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 08:14
Static task
static1
Behavioral task
behavioral1
Sample
winlog.exe
Resource
win7v20201028
General
-
Target
winlog.exe
-
Size
931KB
-
MD5
b75247013200d602f98dc3801d2bde2f
-
SHA1
3327c5cd3ecd636b72c335166fe709b955a32285
-
SHA256
8fe13da45a5732ae42c27687b9cf9105a3f2028857729bdfbe3ae31514a6b298
-
SHA512
aa0b977c81b0e97433e61e21cc1e13cbc8821b5ff4d0b3e7554519051139dc661b4c9c0d8e99a6ff4148968d9f04653c85b411944f42fec29bdd4c70228229f9
Malware Config
Extracted
formbook
http://www.learnhour.net/eaud/
modshiro.com
mademarketingoss.com
austinjourls.info
wayupteam.com
crossingfinger.com
interseptors.com
gigashit.com
livetigo.com
halamankuningindonesia.com
windhammills.com
aylinahmet.com
mbacexonan.website
shopboxbarcelona.com
youyeslive.com
coonlinesportsbooks.com
guorunme.com
putlocker2.site
pencueaidnetwork.com
likevector.com
vulcanudachi-proclub.com
bestcollegelms.online
bosman-smm.online
maglex.info
tolentinestore.com
layaliskincare.com
pensionbackup.com
mettyapp.com
sun-microsoft.com
cheapcialisffx.com
egio.digital
syndicatesportspicks.com
pinnacle.international
realestatejewel.com
dajiankang.love
acaijunglegroup.com
youraircases.com
cdxxcenter.com
ndblife.com
mersinsimsek.com
modernofficeaccessories.com
opioidfactswalgreens.com
yesmywigs.com
lebaronfuneraire.com
missfoxie.com
minbarlibya.com
themalaysialife.com
glz-cc.com
go892.com
eriesbestcaterer.com
geraldreed.com
casinocerto.com
beambitioussummit.com
rfs.company
juliandehaas.com
enooga.com
sulpher.network
toords.com
breaking-news4u.com
erkdigitalmarketing.com
blazorstore.com
weoneqa.com
coalitionsentiment.win
atoidejuger.com
cumbiamba.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1676-8-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1676-9-0x000000000041D030-mapping.dmp xloader behavioral1/memory/1020-16-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 772 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
winlog.exewinlog.exechkdsk.exedescription pid process target process PID 296 set thread context of 1676 296 winlog.exe winlog.exe PID 1676 set thread context of 1244 1676 winlog.exe Explorer.EXE PID 1020 set thread context of 1244 1020 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
winlog.exechkdsk.exepid process 1676 winlog.exe 1676 winlog.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe 1020 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
winlog.exechkdsk.exepid process 1676 winlog.exe 1676 winlog.exe 1676 winlog.exe 1020 chkdsk.exe 1020 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
winlog.exechkdsk.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1676 winlog.exe Token: SeDebugPrivilege 1020 chkdsk.exe Token: SeShutdownPrivilege 1244 Explorer.EXE Token: SeShutdownPrivilege 1244 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
winlog.exeExplorer.EXEchkdsk.exedescription pid process target process PID 296 wrote to memory of 1676 296 winlog.exe winlog.exe PID 296 wrote to memory of 1676 296 winlog.exe winlog.exe PID 296 wrote to memory of 1676 296 winlog.exe winlog.exe PID 296 wrote to memory of 1676 296 winlog.exe winlog.exe PID 296 wrote to memory of 1676 296 winlog.exe winlog.exe PID 296 wrote to memory of 1676 296 winlog.exe winlog.exe PID 296 wrote to memory of 1676 296 winlog.exe winlog.exe PID 1244 wrote to memory of 1020 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 1020 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 1020 1244 Explorer.EXE chkdsk.exe PID 1244 wrote to memory of 1020 1244 Explorer.EXE chkdsk.exe PID 1020 wrote to memory of 772 1020 chkdsk.exe cmd.exe PID 1020 wrote to memory of 772 1020 chkdsk.exe cmd.exe PID 1020 wrote to memory of 772 1020 chkdsk.exe cmd.exe PID 1020 wrote to memory of 772 1020 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winlog.exe"C:\Users\Admin\AppData\Local\Temp\winlog.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winlog.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\winlog.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/296-2-0x00000000748D0000-0x0000000074FBE000-memory.dmpFilesize
6.9MB
-
memory/296-3-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/296-5-0x00000000043C0000-0x00000000043C1000-memory.dmpFilesize
4KB
-
memory/296-6-0x0000000000640000-0x000000000064E000-memory.dmpFilesize
56KB
-
memory/296-7-0x0000000004B90000-0x0000000004BD8000-memory.dmpFilesize
288KB
-
memory/772-17-0x0000000000000000-mapping.dmp
-
memory/1020-16-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/1020-14-0x0000000000000000-mapping.dmp
-
memory/1020-15-0x0000000000570000-0x0000000000577000-memory.dmpFilesize
28KB
-
memory/1020-18-0x00000000020B0000-0x00000000023B3000-memory.dmpFilesize
3.0MB
-
memory/1020-19-0x0000000000340000-0x00000000003CF000-memory.dmpFilesize
572KB
-
memory/1244-13-0x0000000006F90000-0x000000000710A000-memory.dmpFilesize
1.5MB
-
memory/1244-20-0x00000000074B0000-0x0000000007603000-memory.dmpFilesize
1.3MB
-
memory/1676-11-0x0000000000160000-0x0000000000170000-memory.dmpFilesize
64KB
-
memory/1676-12-0x0000000000C10000-0x0000000000F13000-memory.dmpFilesize
3.0MB
-
memory/1676-9-0x000000000041D030-mapping.dmp
-
memory/1676-8-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB