Analysis
-
max time kernel
146s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
20-01-2021 15:56
Static task
static1
Behavioral task
behavioral1
Sample
dira2.exe
Resource
win7v20201028
General
-
Target
dira2.exe
-
Size
914KB
-
MD5
7f67485d2d0a280dce0e66d24fa97972
-
SHA1
508369a537e7db8b44505f2d2d55f57ddefad947
-
SHA256
1e0ffffac4a1077450af5cd08414d45c275605cdedd7a3138a863b96ea3624ab
-
SHA512
f614fc558d676510958a64dd2c83edd280dce713a28e3276b3d840f20b39a816e4175d5cd53e4830cf36c425cb3d2951f63e19b977d889c22b5a7a3a34b7e2f3
Malware Config
Extracted
formbook
http://www.rizrvd.com/bw82/
fundamentaliemef.com
gallerybrows.com
leadeligey.com
octoberx2.online
climaxnovels.com
gdsjgf.com
curateherstories.com
blacksailus.com
yjpps.com
gmobilet.com
fcoins.club
foreverlive2027.com
healthyfifties.com
wmarquezy.com
housebulb.com
thebabyfriendly.com
primajayaintiperkasa.com
learnplaychess.com
chrisbubser.digital
xn--avenr-wsa.com
exlineinsurance.com
thrivezi.com
tuvandadayvitos24h.online
illfingers.com
usmedicarenow.com
pandabutik.com
engageautism.info
magnabeautystyle.com
texasdryroof.com
woodlandpizzahartford.com
dameadamea.com
sedaskincare.com
ruaysatu99.com
mybestaide.com
nikolaichan.com
mrcabinetkitchenandbath.com
ondemandbarbering.com
activagebenefits.net
srcsvcs.com
cbrealvitalize.com
ismaelworks.com
medkomp.online
ninasangtani.com
h2oturkiye.com
kolamart.com
acdfr.com
twistedtailgatesweeps1.com
ramjamdee.com
thedancehalo.com
joeisono.com
glasshouseroadtrip.com
okcpp.com
riggsfarmfenceservices.com
mgg360.com
xn--oi2b190cymc.com
ctfocbdwholesale.com
openspiers.com
rumblingrambles.com
thepoetrictedstudio.com
magiclabs.media
wellnesssensation.com
lakegastonautoparts.com
dealsonwheeeles.com
semenboostplus.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1648-8-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1648-9-0x000000000041CFF0-mapping.dmp xloader behavioral1/memory/1552-16-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1456 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
dira2.exedira2.exewlanext.exedescription pid process target process PID 1924 set thread context of 1648 1924 dira2.exe dira2.exe PID 1648 set thread context of 1276 1648 dira2.exe Explorer.EXE PID 1552 set thread context of 1276 1552 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
dira2.exedira2.exewlanext.exepid process 1924 dira2.exe 1924 dira2.exe 1924 dira2.exe 1924 dira2.exe 1924 dira2.exe 1924 dira2.exe 1648 dira2.exe 1648 dira2.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe 1552 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
dira2.exewlanext.exepid process 1648 dira2.exe 1648 dira2.exe 1648 dira2.exe 1552 wlanext.exe 1552 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
dira2.exedira2.exewlanext.exedescription pid process Token: SeDebugPrivilege 1924 dira2.exe Token: SeDebugPrivilege 1648 dira2.exe Token: SeDebugPrivilege 1552 wlanext.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
dira2.exeExplorer.EXEwlanext.exedescription pid process target process PID 1924 wrote to memory of 1804 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1804 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1804 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1804 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1668 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1668 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1668 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1668 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1628 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1628 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1628 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1628 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1648 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1648 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1648 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1648 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1648 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1648 1924 dira2.exe dira2.exe PID 1924 wrote to memory of 1648 1924 dira2.exe dira2.exe PID 1276 wrote to memory of 1552 1276 Explorer.EXE wlanext.exe PID 1276 wrote to memory of 1552 1276 Explorer.EXE wlanext.exe PID 1276 wrote to memory of 1552 1276 Explorer.EXE wlanext.exe PID 1276 wrote to memory of 1552 1276 Explorer.EXE wlanext.exe PID 1552 wrote to memory of 1456 1552 wlanext.exe cmd.exe PID 1552 wrote to memory of 1456 1552 wlanext.exe cmd.exe PID 1552 wrote to memory of 1456 1552 wlanext.exe cmd.exe PID 1552 wrote to memory of 1456 1552 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dira2.exe"C:\Users\Admin\AppData\Local\Temp\dira2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dira2.exe"C:\Users\Admin\AppData\Local\Temp\dira2.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\dira2.exe"C:\Users\Admin\AppData\Local\Temp\dira2.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\dira2.exe"C:\Users\Admin\AppData\Local\Temp\dira2.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\dira2.exe"C:\Users\Admin\AppData\Local\Temp\dira2.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\dira2.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1276-13-0x0000000003E60000-0x0000000003F48000-memory.dmpFilesize
928KB
-
memory/1456-18-0x0000000000000000-mapping.dmp
-
memory/1552-19-0x0000000000930000-0x00000000009BF000-memory.dmpFilesize
572KB
-
memory/1552-15-0x0000000000FC0000-0x0000000000FD6000-memory.dmpFilesize
88KB
-
memory/1552-17-0x0000000000BB0000-0x0000000000EB3000-memory.dmpFilesize
3.0MB
-
memory/1552-16-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/1552-14-0x0000000000000000-mapping.dmp
-
memory/1648-12-0x0000000000170000-0x0000000000180000-memory.dmpFilesize
64KB
-
memory/1648-11-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/1648-9-0x000000000041CFF0-mapping.dmp
-
memory/1648-8-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1924-2-0x00000000742C0000-0x00000000749AE000-memory.dmpFilesize
6.9MB
-
memory/1924-7-0x00000000074C0000-0x0000000007521000-memory.dmpFilesize
388KB
-
memory/1924-6-0x00000000072F0000-0x00000000072F1000-memory.dmpFilesize
4KB
-
memory/1924-5-0x0000000001DF0000-0x0000000001E13000-memory.dmpFilesize
140KB
-
memory/1924-3-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB