Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
21-01-2021 10:15
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe
Resource
win7v20201028
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe
-
Size
597KB
-
MD5
1931f5b75ae8d9c14ec61cdd53e70f21
-
SHA1
2a8925ba90f3972a93b0db7882c9f060a51a114d
-
SHA256
391e2aae0e6a27817a8a57c87e89b08e69226fe11bc5b75a78dcc45597a9fcf7
-
SHA512
8a469dd82cce2fe09dbb4111fe9c98b8595e31e9d7f783ace3c0009eda314b47cd4f0485f39c949e97e3f6f83795cb2d596fd89967bbff84234ad0c6015e76d5
Malware Config
Extracted
formbook
http://www.kaiyuansu.pro/incn/
1bovvfk93jd.com
enlightenedhealthcoaching.com
findthatsmartphone.com
intelligentsystemsus.com
xn--lmsealamientos-tnb.com
eot0luh5ia.men
babanewshop.com
beyond-bit.com
meritane.com
buythinsecret.com
c2ornot.com
twelvesband.com
rktlends.com
bourseandish.com
happyshop88.com
topangacanyonvintage.com
epersonalloansonline.com
roofers-anaheim.com
shanghaiys.net
bickel.wtf
macetitasdecorativas.com
maisonscoeurdepivoine.com
milano1980.com
thetealworld.com
khocam.com
electrofranco.com
biduoccotruyen.xyz
marcagrafika.com
goodgrabber.com
sentire.design
180wea.com
pnwfireextinguishers.com
paulborneo.com
potlucks.net
sdyqxx.com
pjy589.com
lovetovisit.info
vaultedslabs.com
mirrorimpact.net
americanmarketedge.com
therandstadride.com
yamadaya-online.com
stardust-cafe.com
sk375.com
abipisan.com
thesalesforceradi.computer
ronaldmorrisdc.com
thetreasurebook.com
personalruncoach.com
quba6.com
uoawrlhwg.icu
cathygass.com
tribesy.net
nishagile.com
aworldthroughhereyes.com
adeptroofmaintenance.com
jacketgraffiti.com
deeprigelphoto.com
qth.xyz
pontacols.com
sunflour-bakehouse.com
forevermesmerizedcomplexion.com
maglex.info
somright.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1328-9-0x000000000041D060-mapping.dmp xloader behavioral1/memory/1328-8-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1080-21-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exeInstallUtil.exechkdsk.exedescription pid process target process PID 1604 set thread context of 1328 1604 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 1328 set thread context of 1272 1328 InstallUtil.exe Explorer.EXE PID 1328 set thread context of 1272 1328 InstallUtil.exe Explorer.EXE PID 1080 set thread context of 1272 1080 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
InstallUtil.exechkdsk.exepid process 1328 InstallUtil.exe 1328 InstallUtil.exe 1328 InstallUtil.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe 1080 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
InstallUtil.exechkdsk.exepid process 1328 InstallUtil.exe 1328 InstallUtil.exe 1328 InstallUtil.exe 1328 InstallUtil.exe 1080 chkdsk.exe 1080 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
InstallUtil.exechkdsk.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1328 InstallUtil.exe Token: SeDebugPrivilege 1080 chkdsk.exe Token: SeShutdownPrivilege 1272 Explorer.EXE Token: SeShutdownPrivilege 1272 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1604 wrote to memory of 1328 1604 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 1604 wrote to memory of 1328 1604 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 1604 wrote to memory of 1328 1604 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 1604 wrote to memory of 1328 1604 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 1604 wrote to memory of 1328 1604 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 1604 wrote to memory of 1328 1604 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 1604 wrote to memory of 1328 1604 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 1604 wrote to memory of 1328 1604 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 1604 wrote to memory of 1328 1604 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 1604 wrote to memory of 1328 1604 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 1272 wrote to memory of 1080 1272 Explorer.EXE chkdsk.exe PID 1272 wrote to memory of 1080 1272 Explorer.EXE chkdsk.exe PID 1272 wrote to memory of 1080 1272 Explorer.EXE chkdsk.exe PID 1272 wrote to memory of 1080 1272 Explorer.EXE chkdsk.exe PID 1080 wrote to memory of 844 1080 chkdsk.exe cmd.exe PID 1080 wrote to memory of 844 1080 chkdsk.exe cmd.exe PID 1080 wrote to memory of 844 1080 chkdsk.exe cmd.exe PID 1080 wrote to memory of 844 1080 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/844-22-0x0000000000000000-mapping.dmp
-
memory/1080-24-0x0000000000530000-0x00000000005C0000-memory.dmpFilesize
576KB
-
memory/1080-23-0x0000000001F80000-0x0000000002283000-memory.dmpFilesize
3.0MB
-
memory/1080-21-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1080-20-0x0000000000260000-0x0000000000267000-memory.dmpFilesize
28KB
-
memory/1080-19-0x0000000000000000-mapping.dmp
-
memory/1272-15-0x0000000006480000-0x00000000065A8000-memory.dmpFilesize
1.2MB
-
memory/1272-25-0x0000000006A70000-0x0000000006BB1000-memory.dmpFilesize
1.3MB
-
memory/1272-18-0x0000000005020000-0x0000000005101000-memory.dmpFilesize
900KB
-
memory/1328-9-0x000000000041D060-mapping.dmp
-
memory/1328-14-0x00000000002E0000-0x00000000002F1000-memory.dmpFilesize
68KB
-
memory/1328-13-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/1328-17-0x0000000000590000-0x00000000005A1000-memory.dmpFilesize
68KB
-
memory/1328-8-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1604-16-0x0000000001FE0000-0x0000000001FE1000-memory.dmpFilesize
4KB
-
memory/1604-11-0x00000000006E6000-0x00000000006E7000-memory.dmpFilesize
4KB
-
memory/1604-10-0x00000000006D5000-0x00000000006E6000-memory.dmpFilesize
68KB
-
memory/1604-2-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/1604-7-0x0000000000790000-0x000000000079F000-memory.dmpFilesize
60KB
-
memory/1604-6-0x0000000000690000-0x00000000006CB000-memory.dmpFilesize
236KB
-
memory/1604-5-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/1604-3-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB