Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 18:07
Static task
static1
Behavioral task
behavioral1
Sample
f69047c67c621e68c5b21d46fa60a629.exe
Resource
win7v20201028
General
-
Target
f69047c67c621e68c5b21d46fa60a629.exe
-
Size
596KB
-
MD5
f69047c67c621e68c5b21d46fa60a629
-
SHA1
806f17aaa650c367015db5792319650b3bd59502
-
SHA256
e29bf0082c57f6a228883a9c3c8b727dc68705f4780d6275870958c81d747290
-
SHA512
7af7fe9f4181d099afb56f7ec58d51b441738dd19be46b0e07497737cb38568cc061b41d7623df08eaf6b4b902219e220fc923aaf72da8d4567e246e0fcb6289
Malware Config
Extracted
formbook
http://www.learnhour.net/eaud/
modshiro.com
mademarketingoss.com
austinjourls.info
wayupteam.com
crossingfinger.com
interseptors.com
gigashit.com
livetigo.com
halamankuningindonesia.com
windhammills.com
aylinahmet.com
mbacexonan.website
shopboxbarcelona.com
youyeslive.com
coonlinesportsbooks.com
guorunme.com
putlocker2.site
pencueaidnetwork.com
likevector.com
vulcanudachi-proclub.com
bestcollegelms.online
bosman-smm.online
maglex.info
tolentinestore.com
layaliskincare.com
pensionbackup.com
mettyapp.com
sun-microsoft.com
cheapcialisffx.com
egio.digital
syndicatesportspicks.com
pinnacle.international
realestatejewel.com
dajiankang.love
acaijunglegroup.com
youraircases.com
cdxxcenter.com
ndblife.com
mersinsimsek.com
modernofficeaccessories.com
opioidfactswalgreens.com
yesmywigs.com
lebaronfuneraire.com
missfoxie.com
minbarlibya.com
themalaysialife.com
glz-cc.com
go892.com
eriesbestcaterer.com
geraldreed.com
casinocerto.com
beambitioussummit.com
rfs.company
juliandehaas.com
enooga.com
sulpher.network
toords.com
breaking-news4u.com
erkdigitalmarketing.com
blazorstore.com
weoneqa.com
coalitionsentiment.win
atoidejuger.com
cumbiamba.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3596-15-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3596-16-0x000000000041D030-mapping.dmp xloader behavioral2/memory/2764-27-0x0000000003030000-0x0000000003058000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f69047c67c621e68c5b21d46fa60a629.exeInstallUtil.exeraserver.exedescription pid process target process PID 3300 set thread context of 3596 3300 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 3596 set thread context of 3020 3596 InstallUtil.exe Explorer.EXE PID 2764 set thread context of 3020 2764 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
InstallUtil.exeraserver.exepid process 3596 InstallUtil.exe 3596 InstallUtil.exe 3596 InstallUtil.exe 3596 InstallUtil.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe 2764 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.exeraserver.exepid process 3596 InstallUtil.exe 3596 InstallUtil.exe 3596 InstallUtil.exe 2764 raserver.exe 2764 raserver.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
InstallUtil.exeraserver.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3596 InstallUtil.exe Token: SeDebugPrivilege 2764 raserver.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f69047c67c621e68c5b21d46fa60a629.exeExplorer.EXEraserver.exedescription pid process target process PID 3300 wrote to memory of 3596 3300 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 3300 wrote to memory of 3596 3300 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 3300 wrote to memory of 3596 3300 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 3300 wrote to memory of 3596 3300 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 3300 wrote to memory of 3596 3300 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 3300 wrote to memory of 3596 3300 f69047c67c621e68c5b21d46fa60a629.exe InstallUtil.exe PID 3020 wrote to memory of 2764 3020 Explorer.EXE raserver.exe PID 3020 wrote to memory of 2764 3020 Explorer.EXE raserver.exe PID 3020 wrote to memory of 2764 3020 Explorer.EXE raserver.exe PID 2764 wrote to memory of 3876 2764 raserver.exe cmd.exe PID 2764 wrote to memory of 3876 2764 raserver.exe cmd.exe PID 2764 wrote to memory of 3876 2764 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f69047c67c621e68c5b21d46fa60a629.exe"C:\Users\Admin\AppData\Local\Temp\f69047c67c621e68c5b21d46fa60a629.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2764-30-0x0000000004A10000-0x0000000004A9F000-memory.dmpFilesize
572KB
-
memory/2764-29-0x0000000004CC0000-0x0000000004FE0000-memory.dmpFilesize
3.1MB
-
memory/2764-27-0x0000000003030000-0x0000000003058000-memory.dmpFilesize
160KB
-
memory/2764-26-0x00000000008F0000-0x000000000090F000-memory.dmpFilesize
124KB
-
memory/2764-25-0x0000000000000000-mapping.dmp
-
memory/3020-21-0x0000000005180000-0x0000000005302000-memory.dmpFilesize
1.5MB
-
memory/3020-31-0x0000000005310000-0x000000000541F000-memory.dmpFilesize
1.1MB
-
memory/3300-10-0x0000000009010000-0x0000000009011000-memory.dmpFilesize
4KB
-
memory/3300-3-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB
-
memory/3300-12-0x0000000005963000-0x0000000005965000-memory.dmpFilesize
8KB
-
memory/3300-13-0x0000000009470000-0x0000000009471000-memory.dmpFilesize
4KB
-
memory/3300-14-0x0000000008F60000-0x0000000008F6F000-memory.dmpFilesize
60KB
-
memory/3300-32-0x0000000005965000-0x0000000005966000-memory.dmpFilesize
4KB
-
memory/3300-11-0x0000000009120000-0x0000000009121000-memory.dmpFilesize
4KB
-
memory/3300-6-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/3300-5-0x0000000005B40000-0x0000000005B41000-memory.dmpFilesize
4KB
-
memory/3300-2-0x0000000073300000-0x00000000739EE000-memory.dmpFilesize
6.9MB
-
memory/3300-22-0x0000000007330000-0x0000000007331000-memory.dmpFilesize
4KB
-
memory/3300-23-0x00000000073C0000-0x00000000073C1000-memory.dmpFilesize
4KB
-
memory/3300-24-0x0000000007380000-0x0000000007381000-memory.dmpFilesize
4KB
-
memory/3300-9-0x0000000008EC0000-0x0000000008EFB000-memory.dmpFilesize
236KB
-
memory/3300-8-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/3300-7-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB
-
memory/3596-16-0x000000000041D030-mapping.dmp
-
memory/3596-20-0x0000000000E10000-0x0000000000E20000-memory.dmpFilesize
64KB
-
memory/3596-19-0x00000000010C0000-0x00000000013E0000-memory.dmpFilesize
3.1MB
-
memory/3596-15-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3876-28-0x0000000000000000-mapping.dmp