Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
21-01-2021 10:16
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe
Resource
win7v20201028
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe
-
Size
597KB
-
MD5
5aeb0da76f99119932bf52c3eb8b0767
-
SHA1
01431acd62c2f536527dbfc7c29bd71eacaf406b
-
SHA256
b36c5718a19998ec936051a544a8831e85f7e08b4e7f9c5269e25e963ebabdd3
-
SHA512
74d54f907b1d1ce4a9e5969f7e72d03416258d6d09a83c0d629ca80b9dc720595969583c12412425922a362a2210f97017c87e482212753db42c791898849a48
Malware Config
Extracted
formbook
http://www.inreachpt.com/gqx2/
calusaptamiami.com
starlinkwebservices.com
lakeviewbarbershonola.com
oaklandraidersjerseyspop.com
ohiotechreport.com
eligetucafetera.com
tu4343.com
abstract-elearning.com
thebabylashes.com
athleteshive.com
fanninhomesforless.com
sembracna.com
servicesyn.com
bellairechoice.com
tmpaas.com
eyepaa.com
stickerzblvd.com
rentfs.com
nadya-shanab.com
microwgreens.net
overnaut.net
edwinstowingservices.com
bonus189.space
xn--wgbp0b73b.com
trijjadigital.com
libraspeed.com
theofficialtoluwani.com
podborauto.pro
qyhualin.com
prayerswithmary.com
donboscohistorycorner.com
enlightenedsoil.com
osteopathegagny.com
lookingglassland.com
maglex.info
foxandgraceboutique.com
yourinfluencecoach.com
com-cancel-payment-id655.com
ppspiaggio.com
dbsadv.com
teamworkdash.com
washington-election-2020.info
creativehighagency.com
artisthenewmeditation.com
qsgasia.com
unseen-vision.com
beepybox.online
shaffglowing.com
teacher-retirement-info.info
muabandatdonganh.com
shuhan.design
5200853.com
shengmixiaoji.net
spiderofthesea.com
scionoflewisville.com
tpcvirtual.com
zhjiaxiang.com
thefanexam.com
kimscraftyresale.com
housvest.com
bukmyhotel.com
lacaverne.ovh
investorspredict.com
quicklogosireland.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-9-0x000000000041D070-mapping.dmp xloader behavioral1/memory/2032-8-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1736-20-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exeInstallUtil.exeNAPSTAT.EXEdescription pid process target process PID 292 set thread context of 2032 292 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 2032 set thread context of 1268 2032 InstallUtil.exe Explorer.EXE PID 1736 set thread context of 1268 1736 NAPSTAT.EXE Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
InstallUtil.exeNAPSTAT.EXEpid process 2032 InstallUtil.exe 2032 InstallUtil.exe 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.exeNAPSTAT.EXEpid process 2032 InstallUtil.exe 2032 InstallUtil.exe 2032 InstallUtil.exe 1736 NAPSTAT.EXE 1736 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
InstallUtil.exeNAPSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 2032 InstallUtil.exe Token: SeDebugPrivilege 1736 NAPSTAT.EXE Token: SeShutdownPrivilege 1268 Explorer.EXE Token: SeShutdownPrivilege 1268 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 292 wrote to memory of 2032 292 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 292 wrote to memory of 2032 292 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 292 wrote to memory of 2032 292 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 292 wrote to memory of 2032 292 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 292 wrote to memory of 2032 292 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 292 wrote to memory of 2032 292 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 292 wrote to memory of 2032 292 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 292 wrote to memory of 2032 292 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 292 wrote to memory of 2032 292 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 292 wrote to memory of 2032 292 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 1268 wrote to memory of 1736 1268 Explorer.EXE NAPSTAT.EXE PID 1268 wrote to memory of 1736 1268 Explorer.EXE NAPSTAT.EXE PID 1268 wrote to memory of 1736 1268 Explorer.EXE NAPSTAT.EXE PID 1268 wrote to memory of 1736 1268 Explorer.EXE NAPSTAT.EXE PID 1736 wrote to memory of 396 1736 NAPSTAT.EXE cmd.exe PID 1736 wrote to memory of 396 1736 NAPSTAT.EXE cmd.exe PID 1736 wrote to memory of 396 1736 NAPSTAT.EXE cmd.exe PID 1736 wrote to memory of 396 1736 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/292-11-0x0000000004CF6000-0x0000000004CF7000-memory.dmpFilesize
4KB
-
memory/292-5-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/292-6-0x00000000004C0000-0x00000000004FB000-memory.dmpFilesize
236KB
-
memory/292-10-0x0000000004CE5000-0x0000000004CF6000-memory.dmpFilesize
68KB
-
memory/292-2-0x00000000748A0000-0x0000000074F8E000-memory.dmpFilesize
6.9MB
-
memory/292-3-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/292-7-0x00000000006F0000-0x00000000006FF000-memory.dmpFilesize
60KB
-
memory/292-16-0x0000000004210000-0x0000000004211000-memory.dmpFilesize
4KB
-
memory/396-18-0x0000000000000000-mapping.dmp
-
memory/1268-15-0x0000000007310000-0x0000000007466000-memory.dmpFilesize
1.3MB
-
memory/1268-23-0x0000000007470000-0x00000000075F4000-memory.dmpFilesize
1.5MB
-
memory/1736-20-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1736-21-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/1736-17-0x0000000000000000-mapping.dmp
-
memory/1736-22-0x0000000001DC0000-0x0000000001E50000-memory.dmpFilesize
576KB
-
memory/1736-19-0x0000000000180000-0x00000000001C6000-memory.dmpFilesize
280KB
-
memory/2032-9-0x000000000041D070-mapping.dmp
-
memory/2032-14-0x00000000002E0000-0x00000000002F1000-memory.dmpFilesize
68KB
-
memory/2032-13-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/2032-8-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB