Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 10:15
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe
Resource
win7v20201028
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe
-
Size
597KB
-
MD5
1931f5b75ae8d9c14ec61cdd53e70f21
-
SHA1
2a8925ba90f3972a93b0db7882c9f060a51a114d
-
SHA256
391e2aae0e6a27817a8a57c87e89b08e69226fe11bc5b75a78dcc45597a9fcf7
-
SHA512
8a469dd82cce2fe09dbb4111fe9c98b8595e31e9d7f783ace3c0009eda314b47cd4f0485f39c949e97e3f6f83795cb2d596fd89967bbff84234ad0c6015e76d5
Malware Config
Extracted
formbook
http://www.kaiyuansu.pro/incn/
1bovvfk93jd.com
enlightenedhealthcoaching.com
findthatsmartphone.com
intelligentsystemsus.com
xn--lmsealamientos-tnb.com
eot0luh5ia.men
babanewshop.com
beyond-bit.com
meritane.com
buythinsecret.com
c2ornot.com
twelvesband.com
rktlends.com
bourseandish.com
happyshop88.com
topangacanyonvintage.com
epersonalloansonline.com
roofers-anaheim.com
shanghaiys.net
bickel.wtf
macetitasdecorativas.com
maisonscoeurdepivoine.com
milano1980.com
thetealworld.com
khocam.com
electrofranco.com
biduoccotruyen.xyz
marcagrafika.com
goodgrabber.com
sentire.design
180wea.com
pnwfireextinguishers.com
paulborneo.com
potlucks.net
sdyqxx.com
pjy589.com
lovetovisit.info
vaultedslabs.com
mirrorimpact.net
americanmarketedge.com
therandstadride.com
yamadaya-online.com
stardust-cafe.com
sk375.com
abipisan.com
thesalesforceradi.computer
ronaldmorrisdc.com
thetreasurebook.com
personalruncoach.com
quba6.com
uoawrlhwg.icu
cathygass.com
tribesy.net
nishagile.com
aworldthroughhereyes.com
adeptroofmaintenance.com
jacketgraffiti.com
deeprigelphoto.com
qth.xyz
pontacols.com
sunflour-bakehouse.com
forevermesmerizedcomplexion.com
maglex.info
somright.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3436-15-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3436-16-0x000000000041D060-mapping.dmp xloader behavioral2/memory/2832-27-0x0000000000110000-0x0000000000139000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exeInstallUtil.execontrol.exedescription pid process target process PID 3928 set thread context of 3436 3928 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 3436 set thread context of 2908 3436 InstallUtil.exe Explorer.EXE PID 2832 set thread context of 2908 2832 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
InstallUtil.execontrol.exepid process 3436 InstallUtil.exe 3436 InstallUtil.exe 3436 InstallUtil.exe 3436 InstallUtil.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe 2832 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.execontrol.exepid process 3436 InstallUtil.exe 3436 InstallUtil.exe 3436 InstallUtil.exe 2832 control.exe 2832 control.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
Processes:
InstallUtil.execontrol.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3436 InstallUtil.exe Token: SeDebugPrivilege 2832 control.exe Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE Token: SeShutdownPrivilege 2908 Explorer.EXE Token: SeCreatePagefilePrivilege 2908 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2908 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exeExplorer.EXEcontrol.exedescription pid process target process PID 3928 wrote to memory of 3436 3928 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 3928 wrote to memory of 3436 3928 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 3928 wrote to memory of 3436 3928 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 3928 wrote to memory of 3436 3928 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 3928 wrote to memory of 3436 3928 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 3928 wrote to memory of 3436 3928 SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe InstallUtil.exe PID 2908 wrote to memory of 2832 2908 Explorer.EXE control.exe PID 2908 wrote to memory of 2832 2908 Explorer.EXE control.exe PID 2908 wrote to memory of 2832 2908 Explorer.EXE control.exe PID 2832 wrote to memory of 2680 2832 control.exe cmd.exe PID 2832 wrote to memory of 2680 2832 control.exe cmd.exe PID 2832 wrote to memory of 2680 2832 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.507.23078.3745.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2680-28-0x0000000000000000-mapping.dmp
-
memory/2832-30-0x0000000000C80000-0x0000000000D10000-memory.dmpFilesize
576KB
-
memory/2832-29-0x00000000044E0000-0x0000000004800000-memory.dmpFilesize
3.1MB
-
memory/2832-27-0x0000000000110000-0x0000000000139000-memory.dmpFilesize
164KB
-
memory/2832-26-0x00000000010C0000-0x00000000010E0000-memory.dmpFilesize
128KB
-
memory/2832-25-0x0000000000000000-mapping.dmp
-
memory/2908-21-0x0000000005750000-0x00000000058BE000-memory.dmpFilesize
1.4MB
-
memory/2908-31-0x00000000058C0000-0x000000000596B000-memory.dmpFilesize
684KB
-
memory/3436-20-0x0000000000BE0000-0x0000000000BF1000-memory.dmpFilesize
68KB
-
memory/3436-15-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3436-19-0x0000000001110000-0x0000000001430000-memory.dmpFilesize
3.1MB
-
memory/3436-16-0x000000000041D060-mapping.dmp
-
memory/3928-22-0x0000000006720000-0x0000000006721000-memory.dmpFilesize
4KB
-
memory/3928-24-0x0000000006770000-0x0000000006771000-memory.dmpFilesize
4KB
-
memory/3928-2-0x0000000073BA0000-0x000000007428E000-memory.dmpFilesize
6.9MB
-
memory/3928-13-0x0000000008870000-0x0000000008871000-memory.dmpFilesize
4KB
-
memory/3928-11-0x0000000008520000-0x0000000008521000-memory.dmpFilesize
4KB
-
memory/3928-12-0x0000000004A83000-0x0000000004A85000-memory.dmpFilesize
8KB
-
memory/3928-23-0x00000000067B0000-0x00000000067B1000-memory.dmpFilesize
4KB
-
memory/3928-14-0x0000000008360000-0x000000000836F000-memory.dmpFilesize
60KB
-
memory/3928-10-0x0000000008410000-0x0000000008411000-memory.dmpFilesize
4KB
-
memory/3928-9-0x00000000081C0000-0x00000000081FB000-memory.dmpFilesize
236KB
-
memory/3928-8-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/3928-7-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/3928-6-0x0000000004B30000-0x0000000004B31000-memory.dmpFilesize
4KB
-
memory/3928-5-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/3928-3-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/3928-32-0x0000000004A85000-0x0000000004A86000-memory.dmpFilesize
4KB