Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:33
Static task
static1
Behavioral task
behavioral1
Sample
FHT210995.exe
Resource
win7v20201028
General
-
Target
FHT210995.exe
-
Size
350KB
-
MD5
c8f1dc4896822a9c3bbfbd1880f4fc1b
-
SHA1
41f803431c6a5dcc062a8c8cf8ba80e90a09f717
-
SHA256
c2aa09fda8ed6089db384994dc58fe814ff5a725ea05cd1ccca910b0d901301a
-
SHA512
dcdaacdbb766d976750ce7053b271292169263bc4deb4f49189e365f475695ece10ad63955acb526db754b5b6ab08573e8be5ce4d42ada1e7834ea5a3b3a4f75
Malware Config
Extracted
formbook
http://www.tzmm.net/wpsb/
0817ls.com
drawbeirut.com
respiteready.com
yufkayurek.com
poss-plus.com
distributesimilar.com
mcmendzlawns.com
bingent.info
wellnessandcomfort.com
humilityhope.com
recetasfes.com
olala.asia
epochryphal.com
room-lettings-onlines.club
lvc.xyz
reicolee.com
davidmarkphotovideo.photography
corpuschristicarbuyers.com
tutorialyoutube.com
ativ.pro
shopzayeska.com
collegeedgecoach.com
russillo.net
lxl-express.com
zadslogistics.com
newimpressionlighting.com
propertiesbyjose.com
potikha.com
phoenixoh.net
pogo-case.com
jordankylebowman.com
2020falafelburger.com
medicinas-enlinea.com
atypicaldesigncollective.com
aureliachic.com
woyaozijiawang.com
adrianapsicanalise.com
bubee-studio.com
musicalprofits.com
cafereuben.com
htxmobilewashndetail.com
hedgeanything.com
newbridgeclothing.com
3c.fitness
fastcincincinnatioffer.com
tiantipaihangbang.com
standupmankato.com
juggernautsbaseball.com
landoflostengineers.com
official-mr-bit-casino.com
hhzxwh.com
muafollow.com
realestatebymel.com
welvasq.com
medicalaccount.club
healthgain.online
xn--mkainternational-w3b.com
parkcrow.com
bazi45b.com
greenmatamp.com
zjksxy.com
homeinspectorbook.com
shelvesthatslude.com
smorapicnic.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4040-3-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3220-10-0x00000000007B0000-0x00000000007D8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
FHT210995.exeFHT210995.exehelp.exedescription pid process target process PID 724 set thread context of 4040 724 FHT210995.exe FHT210995.exe PID 4040 set thread context of 3028 4040 FHT210995.exe Explorer.EXE PID 3220 set thread context of 3028 3220 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
FHT210995.exehelp.exepid process 4040 FHT210995.exe 4040 FHT210995.exe 4040 FHT210995.exe 4040 FHT210995.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe 3220 help.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
FHT210995.exeFHT210995.exehelp.exepid process 724 FHT210995.exe 4040 FHT210995.exe 4040 FHT210995.exe 4040 FHT210995.exe 3220 help.exe 3220 help.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
FHT210995.exeExplorer.EXEhelp.exedescription pid process Token: SeDebugPrivilege 4040 FHT210995.exe Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeShutdownPrivilege 3028 Explorer.EXE Token: SeCreatePagefilePrivilege 3028 Explorer.EXE Token: SeDebugPrivilege 3220 help.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
FHT210995.exeExplorer.EXEhelp.exedescription pid process target process PID 724 wrote to memory of 4040 724 FHT210995.exe FHT210995.exe PID 724 wrote to memory of 4040 724 FHT210995.exe FHT210995.exe PID 724 wrote to memory of 4040 724 FHT210995.exe FHT210995.exe PID 724 wrote to memory of 4040 724 FHT210995.exe FHT210995.exe PID 3028 wrote to memory of 3220 3028 Explorer.EXE help.exe PID 3028 wrote to memory of 3220 3028 Explorer.EXE help.exe PID 3028 wrote to memory of 3220 3028 Explorer.EXE help.exe PID 3220 wrote to memory of 1196 3220 help.exe cmd.exe PID 3220 wrote to memory of 1196 3220 help.exe cmd.exe PID 3220 wrote to memory of 1196 3220 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FHT210995.exe"C:\Users\Admin\AppData\Local\Temp\FHT210995.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FHT210995.exe"C:\Users\Admin\AppData\Local\Temp\FHT210995.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\FHT210995.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1196-8-0x0000000000000000-mapping.dmp
-
memory/3028-6-0x0000000006600000-0x0000000006732000-memory.dmpFilesize
1.2MB
-
memory/3028-13-0x0000000006000000-0x00000000060F4000-memory.dmpFilesize
976KB
-
memory/3220-7-0x0000000000000000-mapping.dmp
-
memory/3220-10-0x00000000007B0000-0x00000000007D8000-memory.dmpFilesize
160KB
-
memory/3220-9-0x0000000000BE0000-0x0000000000BE7000-memory.dmpFilesize
28KB
-
memory/3220-11-0x0000000002BF0000-0x0000000002F10000-memory.dmpFilesize
3.1MB
-
memory/3220-12-0x0000000002F10000-0x0000000002F9F000-memory.dmpFilesize
572KB
-
memory/4040-2-0x000000000041D040-mapping.dmp
-
memory/4040-3-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4040-4-0x00000000018F0000-0x0000000001C10000-memory.dmpFilesize
3.1MB
-
memory/4040-5-0x0000000000FF0000-0x0000000001000000-memory.dmpFilesize
64KB