Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-01-2021 10:16
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe
Resource
win7v20201028
General
-
Target
SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe
-
Size
597KB
-
MD5
5aeb0da76f99119932bf52c3eb8b0767
-
SHA1
01431acd62c2f536527dbfc7c29bd71eacaf406b
-
SHA256
b36c5718a19998ec936051a544a8831e85f7e08b4e7f9c5269e25e963ebabdd3
-
SHA512
74d54f907b1d1ce4a9e5969f7e72d03416258d6d09a83c0d629ca80b9dc720595969583c12412425922a362a2210f97017c87e482212753db42c791898849a48
Malware Config
Extracted
formbook
http://www.inreachpt.com/gqx2/
calusaptamiami.com
starlinkwebservices.com
lakeviewbarbershonola.com
oaklandraidersjerseyspop.com
ohiotechreport.com
eligetucafetera.com
tu4343.com
abstract-elearning.com
thebabylashes.com
athleteshive.com
fanninhomesforless.com
sembracna.com
servicesyn.com
bellairechoice.com
tmpaas.com
eyepaa.com
stickerzblvd.com
rentfs.com
nadya-shanab.com
microwgreens.net
overnaut.net
edwinstowingservices.com
bonus189.space
xn--wgbp0b73b.com
trijjadigital.com
libraspeed.com
theofficialtoluwani.com
podborauto.pro
qyhualin.com
prayerswithmary.com
donboscohistorycorner.com
enlightenedsoil.com
osteopathegagny.com
lookingglassland.com
maglex.info
foxandgraceboutique.com
yourinfluencecoach.com
com-cancel-payment-id655.com
ppspiaggio.com
dbsadv.com
teamworkdash.com
washington-election-2020.info
creativehighagency.com
artisthenewmeditation.com
qsgasia.com
unseen-vision.com
beepybox.online
shaffglowing.com
teacher-retirement-info.info
muabandatdonganh.com
shuhan.design
5200853.com
shengmixiaoji.net
spiderofthesea.com
scionoflewisville.com
tpcvirtual.com
zhjiaxiang.com
thefanexam.com
kimscraftyresale.com
housvest.com
bukmyhotel.com
lacaverne.ovh
investorspredict.com
quicklogosireland.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3824-15-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3824-16-0x000000000041D070-mapping.dmp xloader behavioral2/memory/2060-28-0x00000000030C0000-0x00000000030E9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exeInstallUtil.exeraserver.exedescription pid process target process PID 496 set thread context of 3824 496 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 3824 set thread context of 3048 3824 InstallUtil.exe Explorer.EXE PID 2060 set thread context of 3048 2060 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
InstallUtil.exeraserver.exepid process 3824 InstallUtil.exe 3824 InstallUtil.exe 3824 InstallUtil.exe 3824 InstallUtil.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe 2060 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.exeraserver.exepid process 3824 InstallUtil.exe 3824 InstallUtil.exe 3824 InstallUtil.exe 2060 raserver.exe 2060 raserver.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
InstallUtil.exeraserver.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3824 InstallUtil.exe Token: SeDebugPrivilege 2060 raserver.exe Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exeExplorer.EXEraserver.exedescription pid process target process PID 496 wrote to memory of 3824 496 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 496 wrote to memory of 3824 496 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 496 wrote to memory of 3824 496 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 496 wrote to memory of 3824 496 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 496 wrote to memory of 3824 496 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 496 wrote to memory of 3824 496 SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe InstallUtil.exe PID 3048 wrote to memory of 2060 3048 Explorer.EXE raserver.exe PID 3048 wrote to memory of 2060 3048 Explorer.EXE raserver.exe PID 3048 wrote to memory of 2060 3048 Explorer.EXE raserver.exe PID 2060 wrote to memory of 1908 2060 raserver.exe cmd.exe PID 2060 wrote to memory of 1908 2060 raserver.exe cmd.exe PID 2060 wrote to memory of 1908 2060 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PackedNET.507.15470.27981.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/496-11-0x00000000059D3000-0x00000000059D5000-memory.dmpFilesize
8KB
-
memory/496-9-0x0000000008E90000-0x0000000008ECB000-memory.dmpFilesize
236KB
-
memory/496-5-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB
-
memory/496-6-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/496-22-0x0000000007370000-0x0000000007371000-memory.dmpFilesize
4KB
-
memory/496-8-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/496-3-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/496-10-0x0000000008FE0000-0x0000000008FE1000-memory.dmpFilesize
4KB
-
memory/496-7-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/496-12-0x00000000090F0000-0x00000000090F1000-memory.dmpFilesize
4KB
-
memory/496-13-0x0000000009440000-0x0000000009441000-memory.dmpFilesize
4KB
-
memory/496-14-0x0000000008F30000-0x0000000008F3F000-memory.dmpFilesize
60KB
-
memory/496-31-0x00000000059D5000-0x00000000059D6000-memory.dmpFilesize
4KB
-
memory/496-2-0x0000000073360000-0x0000000073A4E000-memory.dmpFilesize
6.9MB
-
memory/496-24-0x00000000073C0000-0x00000000073C1000-memory.dmpFilesize
4KB
-
memory/496-23-0x0000000007400000-0x0000000007401000-memory.dmpFilesize
4KB
-
memory/1908-26-0x0000000000000000-mapping.dmp
-
memory/2060-25-0x0000000000000000-mapping.dmp
-
memory/2060-27-0x0000000000320000-0x000000000033F000-memory.dmpFilesize
124KB
-
memory/2060-28-0x00000000030C0000-0x00000000030E9000-memory.dmpFilesize
164KB
-
memory/2060-29-0x00000000045F0000-0x0000000004910000-memory.dmpFilesize
3.1MB
-
memory/2060-30-0x00000000049A0000-0x0000000004A30000-memory.dmpFilesize
576KB
-
memory/3048-21-0x00000000030B0000-0x000000000315F000-memory.dmpFilesize
700KB
-
memory/3048-32-0x0000000006AD0000-0x0000000006C08000-memory.dmpFilesize
1.2MB
-
memory/3824-19-0x00000000016C0000-0x00000000019E0000-memory.dmpFilesize
3.1MB
-
memory/3824-20-0x0000000001260000-0x0000000001271000-memory.dmpFilesize
68KB
-
memory/3824-16-0x000000000041D070-mapping.dmp
-
memory/3824-15-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB