Analysis
-
max time kernel
5s -
max time network
13s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:09
Static task
static1
Behavioral task
behavioral1
Sample
3b8915f2201cd0d307fd89e6b0b453e9.exe
Resource
win7v20201028
General
-
Target
3b8915f2201cd0d307fd89e6b0b453e9.exe
-
Size
351KB
-
MD5
3b8915f2201cd0d307fd89e6b0b453e9
-
SHA1
c911c32eafbeab116ce976b1fac6f6fa4f7c0997
-
SHA256
b9a286880c70bf7b6b049c8be7b7b14d8318b6c38d04185eced4bc48795330ff
-
SHA512
7e58a662c6b658c8d663797747a0ff1dbd94e8e59b7cc6a48352b3f50e53a33efd4c29c5ca737244647e4ad02e0f70dbdfa277f6782a1765b22c4a71e3cec4c3
Malware Config
Extracted
formbook
http://www.inreachpt.com/gqx2/
calusaptamiami.com
starlinkwebservices.com
lakeviewbarbershonola.com
oaklandraidersjerseyspop.com
ohiotechreport.com
eligetucafetera.com
tu4343.com
abstract-elearning.com
thebabylashes.com
athleteshive.com
fanninhomesforless.com
sembracna.com
servicesyn.com
bellairechoice.com
tmpaas.com
eyepaa.com
stickerzblvd.com
rentfs.com
nadya-shanab.com
microwgreens.net
overnaut.net
edwinstowingservices.com
bonus189.space
xn--wgbp0b73b.com
trijjadigital.com
libraspeed.com
theofficialtoluwani.com
podborauto.pro
qyhualin.com
prayerswithmary.com
donboscohistorycorner.com
enlightenedsoil.com
osteopathegagny.com
lookingglassland.com
maglex.info
foxandgraceboutique.com
yourinfluencecoach.com
com-cancel-payment-id655.com
ppspiaggio.com
dbsadv.com
teamworkdash.com
washington-election-2020.info
creativehighagency.com
artisthenewmeditation.com
qsgasia.com
unseen-vision.com
beepybox.online
shaffglowing.com
teacher-retirement-info.info
muabandatdonganh.com
shuhan.design
5200853.com
shengmixiaoji.net
spiderofthesea.com
scionoflewisville.com
tpcvirtual.com
zhjiaxiang.com
thefanexam.com
kimscraftyresale.com
housvest.com
bukmyhotel.com
lacaverne.ovh
investorspredict.com
quicklogosireland.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1392-8-0x000000000041D070-mapping.dmp xloader behavioral1/memory/1392-7-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3b8915f2201cd0d307fd89e6b0b453e9.exedescription pid process target process PID 1636 set thread context of 1392 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3b8915f2201cd0d307fd89e6b0b453e9.exe3b8915f2201cd0d307fd89e6b0b453e9.exepid process 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 1392 3b8915f2201cd0d307fd89e6b0b453e9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3b8915f2201cd0d307fd89e6b0b453e9.exedescription pid process Token: SeDebugPrivilege 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
3b8915f2201cd0d307fd89e6b0b453e9.exedescription pid process target process PID 1636 wrote to memory of 1396 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe PID 1636 wrote to memory of 1396 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe PID 1636 wrote to memory of 1396 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe PID 1636 wrote to memory of 1396 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe PID 1636 wrote to memory of 1392 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe PID 1636 wrote to memory of 1392 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe PID 1636 wrote to memory of 1392 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe PID 1636 wrote to memory of 1392 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe PID 1636 wrote to memory of 1392 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe PID 1636 wrote to memory of 1392 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe PID 1636 wrote to memory of 1392 1636 3b8915f2201cd0d307fd89e6b0b453e9.exe 3b8915f2201cd0d307fd89e6b0b453e9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b8915f2201cd0d307fd89e6b0b453e9.exe"C:\Users\Admin\AppData\Local\Temp\3b8915f2201cd0d307fd89e6b0b453e9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3b8915f2201cd0d307fd89e6b0b453e9.exe"C:\Users\Admin\AppData\Local\Temp\3b8915f2201cd0d307fd89e6b0b453e9.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3b8915f2201cd0d307fd89e6b0b453e9.exe"C:\Users\Admin\AppData\Local\Temp\3b8915f2201cd0d307fd89e6b0b453e9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1392-8-0x000000000041D070-mapping.dmp
-
memory/1392-7-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1392-11-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB
-
memory/1636-2-0x00000000746F0000-0x0000000074DDE000-memory.dmpFilesize
6.9MB
-
memory/1636-3-0x0000000001040000-0x0000000001041000-memory.dmpFilesize
4KB
-
memory/1636-5-0x0000000000C90000-0x0000000000CE6000-memory.dmpFilesize
344KB
-
memory/1636-6-0x0000000000310000-0x000000000031F000-memory.dmpFilesize
60KB
-
memory/1636-9-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB