Analysis
-
max time kernel
148s -
max time network
115s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:55
Static task
static1
Behavioral task
behavioral1
Sample
DEX182020.exe
Resource
win7v20201028
General
-
Target
DEX182020.exe
-
Size
1.2MB
-
MD5
66293734d46edcbe3ff8c366c9fc1553
-
SHA1
d2012092877e4b81935eaa73c10b34b2776905f6
-
SHA256
521da6e78157628ac55eb060e5596f98387fd4659e291ff72f56efc9a0734022
-
SHA512
5f84ba1f96eb3f928988802bb3c092fa639abfbe58311525182c3786a979ce1aa3fe8292ac99ae48e1b15bd82a812ca9a21a011c69bea4ea372e884c5a2e0518
Malware Config
Extracted
formbook
http://www.a-emeservice.com/m8ec/
thomascraigwealth.com
melbournemedicalhealth.net
tdxcoin.com
lukassbprojects.net
aldemallc.com
moqawalat-kuwait.com
txcsco.com
jobcarepro.com
sedotwcmedanmurah.com
niconthenine.com
radliffrehab.com
infiniteechogroup.com
stellantis-luxury-rent.com
ibusehat.info
resellerauctions.com
softwarexprogrammers.com
bumpnlifestyle.com
mintmacher.com
partapprintercare.com
justrightinsurance.com
beyond-ml.com
mikrotandborste.com
madisonmeadowsseniorliving.com
smart14day.com
fiftyfivetwelve.com
respectinvestadvance.com
shelleylutherfortexas.com
kunst-stueck-chen.com
adastraperaspera.xyz
aletheaastraea.info
zhghzlg.com
cameroncooperar.com
inrushconsulting.com
oldeny.com
foggardens.com
bubbygoobers.com
apartmentnegotiator.com
iregentos.info
charlesadoptionhome.com
sugawara-garasu.com
insidescripps.net
offerlamp.com
flagpeel.com
tb1919.com
estherneil.com
greatunsearchablethings.com
jeunetherapie.com
ricardoinman.com
sbq58.com
morifan.com
foodpukka.com
onewaytaxi.club
ksolves-vendor.com
ashleighemmaboyle.com
hbseelong.com
vanotti-watches.com
faizulrahmanmusafir.com
cb5677.com
gcasservices.com
perteprampram01.com
308hamlinloop.com
machkind.com
cwpdhambers.xyz
glenwoodsteak.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1428-14-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1428-15-0x000000000041D0A0-mapping.dmp xloader behavioral2/memory/1152-23-0x0000000002790000-0x00000000027B9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
DEX182020.exeDEX182020.exeexplorer.exedescription pid process target process PID 4092 set thread context of 1428 4092 DEX182020.exe DEX182020.exe PID 1428 set thread context of 2756 1428 DEX182020.exe Explorer.EXE PID 1152 set thread context of 2756 1152 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
DEX182020.exeexplorer.exepid process 1428 DEX182020.exe 1428 DEX182020.exe 1428 DEX182020.exe 1428 DEX182020.exe 1152 explorer.exe 1152 explorer.exe 1152 explorer.exe 1152 explorer.exe 1152 explorer.exe 1152 explorer.exe 1152 explorer.exe 1152 explorer.exe 1152 explorer.exe 1152 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DEX182020.exeexplorer.exepid process 1428 DEX182020.exe 1428 DEX182020.exe 1428 DEX182020.exe 1152 explorer.exe 1152 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DEX182020.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1428 DEX182020.exe Token: SeDebugPrivilege 1152 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
DEX182020.exeExplorer.EXEexplorer.exedescription pid process target process PID 4092 wrote to memory of 1428 4092 DEX182020.exe DEX182020.exe PID 4092 wrote to memory of 1428 4092 DEX182020.exe DEX182020.exe PID 4092 wrote to memory of 1428 4092 DEX182020.exe DEX182020.exe PID 4092 wrote to memory of 1428 4092 DEX182020.exe DEX182020.exe PID 4092 wrote to memory of 1428 4092 DEX182020.exe DEX182020.exe PID 4092 wrote to memory of 1428 4092 DEX182020.exe DEX182020.exe PID 2756 wrote to memory of 1152 2756 Explorer.EXE explorer.exe PID 2756 wrote to memory of 1152 2756 Explorer.EXE explorer.exe PID 2756 wrote to memory of 1152 2756 Explorer.EXE explorer.exe PID 1152 wrote to memory of 3900 1152 explorer.exe cmd.exe PID 1152 wrote to memory of 3900 1152 explorer.exe cmd.exe PID 1152 wrote to memory of 3900 1152 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DEX182020.exe"C:\Users\Admin\AppData\Local\Temp\DEX182020.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DEX182020.exe"C:\Users\Admin\AppData\Local\Temp\DEX182020.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DEX182020.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1152-25-0x0000000004930000-0x00000000049C0000-memory.dmpFilesize
576KB
-
memory/1152-24-0x0000000004B30000-0x0000000004E50000-memory.dmpFilesize
3.1MB
-
memory/1152-22-0x0000000000350000-0x000000000078F000-memory.dmpFilesize
4.2MB
-
memory/1152-23-0x0000000002790000-0x00000000027B9000-memory.dmpFilesize
164KB
-
memory/1152-20-0x0000000000000000-mapping.dmp
-
memory/1428-14-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1428-18-0x0000000001A20000-0x0000000001A31000-memory.dmpFilesize
68KB
-
memory/1428-17-0x0000000001A40000-0x0000000001D60000-memory.dmpFilesize
3.1MB
-
memory/1428-15-0x000000000041D0A0-mapping.dmp
-
memory/2756-19-0x00000000065A0000-0x0000000006715000-memory.dmpFilesize
1.5MB
-
memory/3900-21-0x0000000000000000-mapping.dmp
-
memory/4092-8-0x0000000005720000-0x0000000005721000-memory.dmpFilesize
4KB
-
memory/4092-13-0x00000000014E0000-0x0000000001588000-memory.dmpFilesize
672KB
-
memory/4092-12-0x0000000005A80000-0x0000000005A93000-memory.dmpFilesize
76KB
-
memory/4092-11-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/4092-10-0x00000000061A0000-0x00000000061A1000-memory.dmpFilesize
4KB
-
memory/4092-9-0x00000000059A0000-0x00000000059A1000-memory.dmpFilesize
4KB
-
memory/4092-2-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/4092-7-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/4092-6-0x0000000005CA0000-0x0000000005CA1000-memory.dmpFilesize
4KB
-
memory/4092-5-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/4092-3-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB