Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
21-01-2021 18:07
Static task
static1
Behavioral task
behavioral1
Sample
f69047c67c621e68c5b21d46fa60a629.exe
Resource
win7v20201028
General
-
Target
f69047c67c621e68c5b21d46fa60a629.exe
-
Size
596KB
-
MD5
f69047c67c621e68c5b21d46fa60a629
-
SHA1
806f17aaa650c367015db5792319650b3bd59502
-
SHA256
e29bf0082c57f6a228883a9c3c8b727dc68705f4780d6275870958c81d747290
-
SHA512
7af7fe9f4181d099afb56f7ec58d51b441738dd19be46b0e07497737cb38568cc061b41d7623df08eaf6b4b902219e220fc923aaf72da8d4567e246e0fcb6289
Malware Config
Extracted
formbook
http://www.learnhour.net/eaud/
modshiro.com
mademarketingoss.com
austinjourls.info
wayupteam.com
crossingfinger.com
interseptors.com
gigashit.com
livetigo.com
halamankuningindonesia.com
windhammills.com
aylinahmet.com
mbacexonan.website
shopboxbarcelona.com
youyeslive.com
coonlinesportsbooks.com
guorunme.com
putlocker2.site
pencueaidnetwork.com
likevector.com
vulcanudachi-proclub.com
bestcollegelms.online
bosman-smm.online
maglex.info
tolentinestore.com
layaliskincare.com
pensionbackup.com
mettyapp.com
sun-microsoft.com
cheapcialisffx.com
egio.digital
syndicatesportspicks.com
pinnacle.international
realestatejewel.com
dajiankang.love
acaijunglegroup.com
youraircases.com
cdxxcenter.com
ndblife.com
mersinsimsek.com
modernofficeaccessories.com
opioidfactswalgreens.com
yesmywigs.com
lebaronfuneraire.com
missfoxie.com
minbarlibya.com
themalaysialife.com
glz-cc.com
go892.com
eriesbestcaterer.com
geraldreed.com
casinocerto.com
beambitioussummit.com
rfs.company
juliandehaas.com
enooga.com
sulpher.network
toords.com
breaking-news4u.com
erkdigitalmarketing.com
blazorstore.com
weoneqa.com
coalitionsentiment.win
atoidejuger.com
cumbiamba.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1620-11-0x000000000041D030-mapping.dmp xloader behavioral1/memory/1620-10-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/672-21-0x0000000000090000-0x00000000000B8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f69047c67c621e68c5b21d46fa60a629.exeInstallUtil.execmstp.exedescription pid process target process PID 1908 set thread context of 1620 1908 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 1620 set thread context of 1268 1620 InstallUtil.exe Explorer.EXE PID 672 set thread context of 1268 672 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
InstallUtil.execmstp.exepid process 1620 InstallUtil.exe 1620 InstallUtil.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe 672 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.execmstp.exepid process 1620 InstallUtil.exe 1620 InstallUtil.exe 1620 InstallUtil.exe 672 cmstp.exe 672 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
InstallUtil.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1620 InstallUtil.exe Token: SeDebugPrivilege 672 cmstp.exe Token: SeShutdownPrivilege 1268 Explorer.EXE Token: SeShutdownPrivilege 1268 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
f69047c67c621e68c5b21d46fa60a629.exeExplorer.EXEcmstp.exedescription pid process target process PID 1908 wrote to memory of 1620 1908 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 1908 wrote to memory of 1620 1908 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 1908 wrote to memory of 1620 1908 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 1908 wrote to memory of 1620 1908 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 1908 wrote to memory of 1620 1908 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 1908 wrote to memory of 1620 1908 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 1908 wrote to memory of 1620 1908 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 1908 wrote to memory of 1620 1908 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 1908 wrote to memory of 1620 1908 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 1908 wrote to memory of 1620 1908 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 1268 wrote to memory of 672 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 672 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 672 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 672 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 672 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 672 1268 Explorer.EXE cmstp.exe PID 1268 wrote to memory of 672 1268 Explorer.EXE cmstp.exe PID 672 wrote to memory of 988 672 cmstp.exe cmd.exe PID 672 wrote to memory of 988 672 cmstp.exe cmd.exe PID 672 wrote to memory of 988 672 cmstp.exe cmd.exe PID 672 wrote to memory of 988 672 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f69047c67c621e68c5b21d46fa60a629.exe"C:\Users\Admin\AppData\Local\Temp\f69047c67c621e68c5b21d46fa60a629.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-23-0x00000000004F0000-0x000000000057F000-memory.dmpFilesize
572KB
-
memory/672-22-0x00000000020F0000-0x00000000023F3000-memory.dmpFilesize
3.0MB
-
memory/672-21-0x0000000000090000-0x00000000000B8000-memory.dmpFilesize
160KB
-
memory/672-20-0x0000000000B40000-0x0000000000B58000-memory.dmpFilesize
96KB
-
memory/672-18-0x0000000076271000-0x0000000076273000-memory.dmpFilesize
8KB
-
memory/672-17-0x0000000000000000-mapping.dmp
-
memory/988-19-0x0000000000000000-mapping.dmp
-
memory/1268-15-0x0000000004A80000-0x0000000004B4B000-memory.dmpFilesize
812KB
-
memory/1268-24-0x0000000006A40000-0x0000000006BB2000-memory.dmpFilesize
1.4MB
-
memory/1620-14-0x0000000000170000-0x0000000000180000-memory.dmpFilesize
64KB
-
memory/1620-13-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/1620-10-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1620-11-0x000000000041D030-mapping.dmp
-
memory/1908-2-0x00000000745B0000-0x0000000074C9E000-memory.dmpFilesize
6.9MB
-
memory/1908-16-0x00000000007C0000-0x00000000007C1000-memory.dmpFilesize
4KB
-
memory/1908-9-0x0000000005166000-0x0000000005167000-memory.dmpFilesize
4KB
-
memory/1908-8-0x0000000005155000-0x0000000005166000-memory.dmpFilesize
68KB
-
memory/1908-7-0x0000000000430000-0x000000000043F000-memory.dmpFilesize
60KB
-
memory/1908-6-0x00000000021A0000-0x00000000021DB000-memory.dmpFilesize
236KB
-
memory/1908-5-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/1908-3-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB