Analysis
-
max time kernel
39s -
max time network
9s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:09
Static task
static1
Behavioral task
behavioral1
Sample
2d6580e78be6580bf89ed5e9e13f14e0.exe
Resource
win7v20201028
General
-
Target
2d6580e78be6580bf89ed5e9e13f14e0.exe
-
Size
1.4MB
-
MD5
2d6580e78be6580bf89ed5e9e13f14e0
-
SHA1
3f5153f7da3338d61164df6944b01a0666396517
-
SHA256
a38cbbb16b9dda3d7aebcdcd033a8f5e56f17257c060859a3cdd2e1a8bb27ab9
-
SHA512
c58a9f97990e255afd7b6f5538a95d132e0ad00d204b6f3de32e1d675a45d99397e098fe9515081d13eb9ba3491d8cea294f19c7392563212549fc8a739a37bb
Malware Config
Extracted
formbook
http://www.inreachpt.com/gqx2/
calusaptamiami.com
starlinkwebservices.com
lakeviewbarbershonola.com
oaklandraidersjerseyspop.com
ohiotechreport.com
eligetucafetera.com
tu4343.com
abstract-elearning.com
thebabylashes.com
athleteshive.com
fanninhomesforless.com
sembracna.com
servicesyn.com
bellairechoice.com
tmpaas.com
eyepaa.com
stickerzblvd.com
rentfs.com
nadya-shanab.com
microwgreens.net
overnaut.net
edwinstowingservices.com
bonus189.space
xn--wgbp0b73b.com
trijjadigital.com
libraspeed.com
theofficialtoluwani.com
podborauto.pro
qyhualin.com
prayerswithmary.com
donboscohistorycorner.com
enlightenedsoil.com
osteopathegagny.com
lookingglassland.com
maglex.info
foxandgraceboutique.com
yourinfluencecoach.com
com-cancel-payment-id655.com
ppspiaggio.com
dbsadv.com
teamworkdash.com
washington-election-2020.info
creativehighagency.com
artisthenewmeditation.com
qsgasia.com
unseen-vision.com
beepybox.online
shaffglowing.com
teacher-retirement-info.info
muabandatdonganh.com
shuhan.design
5200853.com
shengmixiaoji.net
spiderofthesea.com
scionoflewisville.com
tpcvirtual.com
zhjiaxiang.com
thefanexam.com
kimscraftyresale.com
housvest.com
bukmyhotel.com
lacaverne.ovh
investorspredict.com
quicklogosireland.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1088-10-0x000000000041D070-mapping.dmp xloader behavioral1/memory/1088-9-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2d6580e78be6580bf89ed5e9e13f14e0.exedescription pid process target process PID 1604 set thread context of 1088 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 2d6580e78be6580bf89ed5e9e13f14e0.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
2d6580e78be6580bf89ed5e9e13f14e0.exe2d6580e78be6580bf89ed5e9e13f14e0.exepid process 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 1088 2d6580e78be6580bf89ed5e9e13f14e0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2d6580e78be6580bf89ed5e9e13f14e0.exedescription pid process Token: SeDebugPrivilege 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
2d6580e78be6580bf89ed5e9e13f14e0.exedescription pid process target process PID 1604 wrote to memory of 1088 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 2d6580e78be6580bf89ed5e9e13f14e0.exe PID 1604 wrote to memory of 1088 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 2d6580e78be6580bf89ed5e9e13f14e0.exe PID 1604 wrote to memory of 1088 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 2d6580e78be6580bf89ed5e9e13f14e0.exe PID 1604 wrote to memory of 1088 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 2d6580e78be6580bf89ed5e9e13f14e0.exe PID 1604 wrote to memory of 1088 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 2d6580e78be6580bf89ed5e9e13f14e0.exe PID 1604 wrote to memory of 1088 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 2d6580e78be6580bf89ed5e9e13f14e0.exe PID 1604 wrote to memory of 1088 1604 2d6580e78be6580bf89ed5e9e13f14e0.exe 2d6580e78be6580bf89ed5e9e13f14e0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d6580e78be6580bf89ed5e9e13f14e0.exe"C:\Users\Admin\AppData\Local\Temp\2d6580e78be6580bf89ed5e9e13f14e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2d6580e78be6580bf89ed5e9e13f14e0.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1088-10-0x000000000041D070-mapping.dmp
-
memory/1088-9-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1088-12-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/1604-2-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/1604-3-0x0000000001260000-0x0000000001261000-memory.dmpFilesize
4KB
-
memory/1604-5-0x0000000000390000-0x0000000000408000-memory.dmpFilesize
480KB
-
memory/1604-6-0x0000000005D50000-0x0000000005D51000-memory.dmpFilesize
4KB
-
memory/1604-7-0x0000000000510000-0x000000000051E000-memory.dmpFilesize
56KB
-
memory/1604-8-0x0000000005F60000-0x0000000005FB6000-memory.dmpFilesize
344KB