Analysis
-
max time kernel
37s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
20-01-2021 14:53
Static task
static1
Behavioral task
behavioral1
Sample
a29e2e6bcd5193f8fc813605d8f5970b.exe
Resource
win7v20201028
General
-
Target
a29e2e6bcd5193f8fc813605d8f5970b.exe
-
Size
1.4MB
-
MD5
a29e2e6bcd5193f8fc813605d8f5970b
-
SHA1
b6cd7db78451f4300b1e0ce62aa546862f9e4d5e
-
SHA256
285b8a6638f87b87204ba68570315a41570229ce3f7ecb2014437aee9e0d5875
-
SHA512
3d78118075a37bb50eea14b55aca605f985945cfca9a472a80f7da5ec5feeccaa220700223fcf7e2d7d20374d4d6a4424ab52bd513fc20f6aad857f233abbb18
Malware Config
Extracted
formbook
http://www.herbmedia.net/csv8/
slgacha.com
oohdough.com
6983ylc.com
aykassociate.com
latin-hotspot.com
starrockindia.com
beamsubway.com
queensboutique1000.com
madbaddie.com
bhoomimart.com
ankitparivar.com
aldanasanchezmx.com
citest1597669833.com
cristianofreitas.com
myplantus.com
counterfeitmilk.com
8xf39.com
pregnantwomens.com
yyyut6.com
stnanguo.com
fessusesefsee.com
logansshop.net
familydalmatianhomes.com
accessible.legal
epicmassiveconcepts.com
indianfactopedia.com
exit-divorce.com
colliapse.com
nosishop.com
hayat-aljowaily.com
soundon.events
previnacovid19-br.com
traptlongview.com
splendidhotelspa.com
masterzushop.com
ednevents.com
studentdividers.com
treningi-enduro.com
hostingcoaster.com
gourmetgroceriesfast.com
thesouthbeachlife.com
teemergin.com
fixmygearfast.com
arb-invest.com
shemaledreamz.com
1819apparel.com
thedigitalsatyam.com
alparmuhendislik.com
distinctmusicproductions.com
procreditexpert.com
insights4innovation.com
jzbtl.com
1033325.com
sorteocamper.info
scheherazadelegault.com
glowportraiture.com
cleitstaapps.com
globepublishers.com
stattests.com
brainandbodystrengthcoach.com
magenx2.info
escaparati.com
wood-decor24.com
travelnetafrica.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3576-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3576-14-0x000000000041D0C0-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a29e2e6bcd5193f8fc813605d8f5970b.exedescription pid process target process PID 3976 set thread context of 3576 3976 a29e2e6bcd5193f8fc813605d8f5970b.exe a29e2e6bcd5193f8fc813605d8f5970b.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
a29e2e6bcd5193f8fc813605d8f5970b.exea29e2e6bcd5193f8fc813605d8f5970b.exepid process 3976 a29e2e6bcd5193f8fc813605d8f5970b.exe 3976 a29e2e6bcd5193f8fc813605d8f5970b.exe 3976 a29e2e6bcd5193f8fc813605d8f5970b.exe 3576 a29e2e6bcd5193f8fc813605d8f5970b.exe 3576 a29e2e6bcd5193f8fc813605d8f5970b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a29e2e6bcd5193f8fc813605d8f5970b.exedescription pid process Token: SeDebugPrivilege 3976 a29e2e6bcd5193f8fc813605d8f5970b.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a29e2e6bcd5193f8fc813605d8f5970b.exedescription pid process target process PID 3976 wrote to memory of 3576 3976 a29e2e6bcd5193f8fc813605d8f5970b.exe a29e2e6bcd5193f8fc813605d8f5970b.exe PID 3976 wrote to memory of 3576 3976 a29e2e6bcd5193f8fc813605d8f5970b.exe a29e2e6bcd5193f8fc813605d8f5970b.exe PID 3976 wrote to memory of 3576 3976 a29e2e6bcd5193f8fc813605d8f5970b.exe a29e2e6bcd5193f8fc813605d8f5970b.exe PID 3976 wrote to memory of 3576 3976 a29e2e6bcd5193f8fc813605d8f5970b.exe a29e2e6bcd5193f8fc813605d8f5970b.exe PID 3976 wrote to memory of 3576 3976 a29e2e6bcd5193f8fc813605d8f5970b.exe a29e2e6bcd5193f8fc813605d8f5970b.exe PID 3976 wrote to memory of 3576 3976 a29e2e6bcd5193f8fc813605d8f5970b.exe a29e2e6bcd5193f8fc813605d8f5970b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a29e2e6bcd5193f8fc813605d8f5970b.exe"C:\Users\Admin\AppData\Local\Temp\a29e2e6bcd5193f8fc813605d8f5970b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a29e2e6bcd5193f8fc813605d8f5970b.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3576-13-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3576-16-0x00000000014C0000-0x00000000017E0000-memory.dmpFilesize
3.1MB
-
memory/3576-14-0x000000000041D0C0-mapping.dmp
-
memory/3976-9-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/3976-7-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/3976-8-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/3976-2-0x00000000733A0000-0x0000000073A8E000-memory.dmpFilesize
6.9MB
-
memory/3976-10-0x0000000005190000-0x000000000519E000-memory.dmpFilesize
56KB
-
memory/3976-11-0x0000000005C30000-0x0000000005C77000-memory.dmpFilesize
284KB
-
memory/3976-12-0x0000000008700000-0x0000000008701000-memory.dmpFilesize
4KB
-
memory/3976-6-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/3976-5-0x0000000004AF0000-0x0000000004B71000-memory.dmpFilesize
516KB
-
memory/3976-3-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB