Analysis
-
max time kernel
13s -
max time network
110s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:05
Static task
static1
Behavioral task
behavioral1
Sample
f0f1a843b50f76e7236cc32dedf1d65d.exe
Resource
win7v20201028
General
-
Target
f0f1a843b50f76e7236cc32dedf1d65d.exe
-
Size
276KB
-
MD5
f0f1a843b50f76e7236cc32dedf1d65d
-
SHA1
f84f30a93355d46bbdbebfedc760188879b6db0b
-
SHA256
3ed3126cfc3094e0f1a5736369cc55f68feb9bf6c9e31ba6e00e36f11917bc18
-
SHA512
f856db58b39aacbc858a248a7352ee20e63ac3a50966ebb9a95bcacad6221d98eff7a8f4024fae08badfc45396a7312a8bf70e69e5802777b7e34ef6e48342a2
Malware Config
Extracted
formbook
http://www.douzhuan168.com/o8na/
www1669099.com
digitalallserv.com
thiszzzwq.info
dallasoswalt.info
ladolcefesta.com
mariamalikially.com
origenbsas.com
antichoc.watch
tropicalbirdtoys.com
bbluedotvrwdbuy.com
racevx.xyz
ut-trustandwill.com
maximumhomeoffers.com
wrapname.com
hypelighystrip.com
oshoum2020.com
parkwestmi.com
themodumall.com
tempuslawnandsnow.com
dailypromo.xyz
prebrands.com
thejoshuareport.com
coffincouturecosmetics.com
myfreshpoultry.com
vpndojo.com
ke9s.com
thediabeticsdomain.com
ukfrtff.icu
thedesertseen.com
patasasociacioncanina.com
bmw-cdsummit.com
darrelbrodkemd.com
tequilau.com
hurricanelauraclaim.net
launchangl.com
rdcwellness.com
vannityboxx.com
engage.chat
actuallyprettycosmetics.com
obluedot3dbuy.com
beaullife.com
digitalqe.com
damgarrett.com
guojiggd.com
bolder-adventure.info
seewhitefish.com
yazaerik.com
williamswalker.com
amandaemcevoy.com
pushdabutton.com
happyparentingandfamilies.com
workinghomeparents.com
patriotpointmarina.com
montserratpages.cat
marriedtwomusic.com
satjulius.com
zachthebigbear.com
pakistanread.com
bilemedim.com
prnttees.com
fxwlk.com
thepaoluccigroup.com
tompgroup.com
costadosolff.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3528-3-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3528-4-0x000000000041D040-mapping.dmp xloader behavioral2/memory/640-6-0x00000000050C0000-0x00000000050EA000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f0f1a843b50f76e7236cc32dedf1d65d.exedescription pid process target process PID 640 set thread context of 3528 640 f0f1a843b50f76e7236cc32dedf1d65d.exe f0f1a843b50f76e7236cc32dedf1d65d.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f0f1a843b50f76e7236cc32dedf1d65d.exepid process 3528 f0f1a843b50f76e7236cc32dedf1d65d.exe 3528 f0f1a843b50f76e7236cc32dedf1d65d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
f0f1a843b50f76e7236cc32dedf1d65d.exedescription pid process target process PID 640 wrote to memory of 3528 640 f0f1a843b50f76e7236cc32dedf1d65d.exe f0f1a843b50f76e7236cc32dedf1d65d.exe PID 640 wrote to memory of 3528 640 f0f1a843b50f76e7236cc32dedf1d65d.exe f0f1a843b50f76e7236cc32dedf1d65d.exe PID 640 wrote to memory of 3528 640 f0f1a843b50f76e7236cc32dedf1d65d.exe f0f1a843b50f76e7236cc32dedf1d65d.exe PID 640 wrote to memory of 3528 640 f0f1a843b50f76e7236cc32dedf1d65d.exe f0f1a843b50f76e7236cc32dedf1d65d.exe PID 640 wrote to memory of 3528 640 f0f1a843b50f76e7236cc32dedf1d65d.exe f0f1a843b50f76e7236cc32dedf1d65d.exe PID 640 wrote to memory of 3528 640 f0f1a843b50f76e7236cc32dedf1d65d.exe f0f1a843b50f76e7236cc32dedf1d65d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f0f1a843b50f76e7236cc32dedf1d65d.exe"C:\Users\Admin\AppData\Local\Temp\f0f1a843b50f76e7236cc32dedf1d65d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f0f1a843b50f76e7236cc32dedf1d65d.exe"C:\Users\Admin\AppData\Local\Temp\f0f1a843b50f76e7236cc32dedf1d65d.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/640-2-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/640-6-0x00000000050C0000-0x00000000050EA000-memory.dmpFilesize
168KB
-
memory/640-5-0x0000000004D70000-0x0000000004D90000-memory.dmpFilesize
128KB
-
memory/3528-3-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3528-4-0x000000000041D040-mapping.dmp
-
memory/3528-8-0x0000000000A40000-0x0000000000D60000-memory.dmpFilesize
3.1MB