Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 08:14
Static task
static1
Behavioral task
behavioral1
Sample
winlog.exe
Resource
win7v20201028
General
-
Target
winlog.exe
-
Size
931KB
-
MD5
b75247013200d602f98dc3801d2bde2f
-
SHA1
3327c5cd3ecd636b72c335166fe709b955a32285
-
SHA256
8fe13da45a5732ae42c27687b9cf9105a3f2028857729bdfbe3ae31514a6b298
-
SHA512
aa0b977c81b0e97433e61e21cc1e13cbc8821b5ff4d0b3e7554519051139dc661b4c9c0d8e99a6ff4148968d9f04653c85b411944f42fec29bdd4c70228229f9
Malware Config
Extracted
formbook
http://www.learnhour.net/eaud/
modshiro.com
mademarketingoss.com
austinjourls.info
wayupteam.com
crossingfinger.com
interseptors.com
gigashit.com
livetigo.com
halamankuningindonesia.com
windhammills.com
aylinahmet.com
mbacexonan.website
shopboxbarcelona.com
youyeslive.com
coonlinesportsbooks.com
guorunme.com
putlocker2.site
pencueaidnetwork.com
likevector.com
vulcanudachi-proclub.com
bestcollegelms.online
bosman-smm.online
maglex.info
tolentinestore.com
layaliskincare.com
pensionbackup.com
mettyapp.com
sun-microsoft.com
cheapcialisffx.com
egio.digital
syndicatesportspicks.com
pinnacle.international
realestatejewel.com
dajiankang.love
acaijunglegroup.com
youraircases.com
cdxxcenter.com
ndblife.com
mersinsimsek.com
modernofficeaccessories.com
opioidfactswalgreens.com
yesmywigs.com
lebaronfuneraire.com
missfoxie.com
minbarlibya.com
themalaysialife.com
glz-cc.com
go892.com
eriesbestcaterer.com
geraldreed.com
casinocerto.com
beambitioussummit.com
rfs.company
juliandehaas.com
enooga.com
sulpher.network
toords.com
breaking-news4u.com
erkdigitalmarketing.com
blazorstore.com
weoneqa.com
coalitionsentiment.win
atoidejuger.com
cumbiamba.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1528-12-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/1528-13-0x000000000041D030-mapping.dmp xloader behavioral2/memory/3404-22-0x0000000000AE0000-0x0000000000B08000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
winlog.exewinlog.exehelp.exedescription pid process target process PID 1048 set thread context of 1528 1048 winlog.exe winlog.exe PID 1528 set thread context of 3012 1528 winlog.exe Explorer.EXE PID 3404 set thread context of 3012 3404 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
winlog.exehelp.exepid process 1528 winlog.exe 1528 winlog.exe 1528 winlog.exe 1528 winlog.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe 3404 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
winlog.exehelp.exepid process 1528 winlog.exe 1528 winlog.exe 1528 winlog.exe 3404 help.exe 3404 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
winlog.exehelp.exedescription pid process Token: SeDebugPrivilege 1528 winlog.exe Token: SeDebugPrivilege 3404 help.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3012 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
winlog.exeExplorer.EXEhelp.exedescription pid process target process PID 1048 wrote to memory of 1528 1048 winlog.exe winlog.exe PID 1048 wrote to memory of 1528 1048 winlog.exe winlog.exe PID 1048 wrote to memory of 1528 1048 winlog.exe winlog.exe PID 1048 wrote to memory of 1528 1048 winlog.exe winlog.exe PID 1048 wrote to memory of 1528 1048 winlog.exe winlog.exe PID 1048 wrote to memory of 1528 1048 winlog.exe winlog.exe PID 3012 wrote to memory of 3404 3012 Explorer.EXE help.exe PID 3012 wrote to memory of 3404 3012 Explorer.EXE help.exe PID 3012 wrote to memory of 3404 3012 Explorer.EXE help.exe PID 3404 wrote to memory of 1344 3404 help.exe cmd.exe PID 3404 wrote to memory of 1344 3404 help.exe cmd.exe PID 3404 wrote to memory of 1344 3404 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winlog.exe"C:\Users\Admin\AppData\Local\Temp\winlog.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\winlog.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\winlog.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1048-2-0x0000000073A30000-0x000000007411E000-memory.dmpFilesize
6.9MB
-
memory/1048-3-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1048-5-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/1048-6-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/1048-7-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/1048-8-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/1048-9-0x0000000005300000-0x000000000530E000-memory.dmpFilesize
56KB
-
memory/1048-10-0x0000000007450000-0x0000000007498000-memory.dmpFilesize
288KB
-
memory/1048-11-0x0000000007540000-0x0000000007541000-memory.dmpFilesize
4KB
-
memory/1344-20-0x0000000000000000-mapping.dmp
-
memory/1528-13-0x000000000041D030-mapping.dmp
-
memory/1528-15-0x0000000001530000-0x0000000001850000-memory.dmpFilesize
3.1MB
-
memory/1528-17-0x00000000010D0000-0x00000000010E0000-memory.dmpFilesize
64KB
-
memory/1528-12-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3012-18-0x00000000052B0000-0x00000000053FE000-memory.dmpFilesize
1.3MB
-
memory/3012-25-0x0000000002C70000-0x0000000002D66000-memory.dmpFilesize
984KB
-
memory/3404-19-0x0000000000000000-mapping.dmp
-
memory/3404-22-0x0000000000AE0000-0x0000000000B08000-memory.dmpFilesize
160KB
-
memory/3404-21-0x0000000000BB0000-0x0000000000BB7000-memory.dmpFilesize
28KB
-
memory/3404-23-0x0000000003190000-0x00000000034B0000-memory.dmpFilesize
3.1MB
-
memory/3404-24-0x00000000034B0000-0x000000000353F000-memory.dmpFilesize
572KB