Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
23-02-2021 12:54
Static task
static1
Behavioral task
behavioral1
Sample
0O9BJfVJi6fEMoS.exe
Resource
win7v20201028
General
-
Target
0O9BJfVJi6fEMoS.exe
-
Size
797KB
-
MD5
18ec78e09155c046a203fb4dcbc3593f
-
SHA1
40e67eef7c001a8752763616fc9a58170721c27a
-
SHA256
01c5ac824171a164473d92187f8031f2bc7103397fe534f56771d8e9589445e0
-
SHA512
28801c6b546515f4fb67f199f70b160dffb41434bcb465f92d3f20dbad698194f162b443571ea267a1dd7c7ef0bcaf4bb82116c37d3a83433f9d3de28083234e
Malware Config
Extracted
formbook
http://www.besteprobioticakopen.online/uszn/
animegriptape.com
pcpnetworks.com
putupmybabyforadoption.com
xn--jvrr98g37n88d.com
fertinvitro.doctor
undonethread.com
avoleague.com
sissysundays.com
guilhermeoliveiro.site
catholicon-bespeckle.info
mardesuenosfundacion.com
songkhoe24.site
shoecityindia.com
smallbathroomdecor.info
tskusa.com
prairiespringsllc.com
kegncoffee.com
clicklounge.xyz
catholicendoflifeplanning.com
steelobzee.com
xiknekiterapia.com
whereinthezooareyou.com
maglex.info
dango3.net
sqjqw4.com
theparadisogroup.com
karthikeyainfraindia.com
luewevedre.com
helpwithmynutrition.com
lengyue.cool
pbipropertiesllc.com
glidedisc.com
sz-rhwjkj.com
776fx.com
kamanantzin.com
grandwhale.com
trump2020shop.net
gentilelibri.com
jarliciouslounge.com
dgcsales.net
hypno.doctor
holidayinnindyairportnorth.com
buysellleasewithlisa.com
girishastore.com
tinynucleargenerators.com
crystalphoenixltd.com
lapplify.com
bailbondinazusa.com
michaelmery.com
tripleecoaching.com
fastenerspelosato.net
horisan-touki.com
marketingavacado.com
centrebiozeina.com
xn--3etz63bc5ck9c.com
rhemachurch4u.com
homeschoolangel.com
romeysworld.com
themixedveggies.com
queendreea.club
epedalflorida.com
blutreemg.com
nongfupingtai.com
shikshs.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2800-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2800-13-0x000000000041D0F0-mapping.dmp xloader behavioral2/memory/1452-22-0x00000000001B0000-0x00000000001D9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
0O9BJfVJi6fEMoS.exe0O9BJfVJi6fEMoS.exenetsh.exedescription pid process target process PID 1404 set thread context of 2800 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 2800 set thread context of 3024 2800 0O9BJfVJi6fEMoS.exe Explorer.EXE PID 2800 set thread context of 3024 2800 0O9BJfVJi6fEMoS.exe Explorer.EXE PID 1452 set thread context of 3024 1452 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
0O9BJfVJi6fEMoS.exe0O9BJfVJi6fEMoS.exenetsh.exepid process 1404 0O9BJfVJi6fEMoS.exe 1404 0O9BJfVJi6fEMoS.exe 1404 0O9BJfVJi6fEMoS.exe 1404 0O9BJfVJi6fEMoS.exe 1404 0O9BJfVJi6fEMoS.exe 2800 0O9BJfVJi6fEMoS.exe 2800 0O9BJfVJi6fEMoS.exe 2800 0O9BJfVJi6fEMoS.exe 2800 0O9BJfVJi6fEMoS.exe 2800 0O9BJfVJi6fEMoS.exe 2800 0O9BJfVJi6fEMoS.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe 1452 netsh.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
0O9BJfVJi6fEMoS.exenetsh.exepid process 2800 0O9BJfVJi6fEMoS.exe 2800 0O9BJfVJi6fEMoS.exe 2800 0O9BJfVJi6fEMoS.exe 2800 0O9BJfVJi6fEMoS.exe 1452 netsh.exe 1452 netsh.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
0O9BJfVJi6fEMoS.exe0O9BJfVJi6fEMoS.exenetsh.exedescription pid process Token: SeDebugPrivilege 1404 0O9BJfVJi6fEMoS.exe Token: SeDebugPrivilege 2800 0O9BJfVJi6fEMoS.exe Token: SeDebugPrivilege 1452 netsh.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
0O9BJfVJi6fEMoS.exeExplorer.EXEnetsh.exedescription pid process target process PID 1404 wrote to memory of 3836 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 1404 wrote to memory of 3836 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 1404 wrote to memory of 3836 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 1404 wrote to memory of 852 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 1404 wrote to memory of 852 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 1404 wrote to memory of 852 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 1404 wrote to memory of 2800 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 1404 wrote to memory of 2800 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 1404 wrote to memory of 2800 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 1404 wrote to memory of 2800 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 1404 wrote to memory of 2800 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 1404 wrote to memory of 2800 1404 0O9BJfVJi6fEMoS.exe 0O9BJfVJi6fEMoS.exe PID 3024 wrote to memory of 1452 3024 Explorer.EXE netsh.exe PID 3024 wrote to memory of 1452 3024 Explorer.EXE netsh.exe PID 3024 wrote to memory of 1452 3024 Explorer.EXE netsh.exe PID 1452 wrote to memory of 2172 1452 netsh.exe cmd.exe PID 1452 wrote to memory of 2172 1452 netsh.exe cmd.exe PID 1452 wrote to memory of 2172 1452 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0O9BJfVJi6fEMoS.exe"C:\Users\Admin\AppData\Local\Temp\0O9BJfVJi6fEMoS.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0O9BJfVJi6fEMoS.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\0O9BJfVJi6fEMoS.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\0O9BJfVJi6fEMoS.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\0O9BJfVJi6fEMoS.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1404-9-0x0000000008B00000-0x0000000008B01000-memory.dmpFilesize
4KB
-
memory/1404-11-0x0000000006F00000-0x0000000006F56000-memory.dmpFilesize
344KB
-
memory/1404-5-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/1404-6-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/1404-7-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/1404-8-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/1404-3-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/1404-10-0x0000000008A60000-0x0000000008A6B000-memory.dmpFilesize
44KB
-
memory/1404-2-0x0000000073550000-0x0000000073C3E000-memory.dmpFilesize
6.9MB
-
memory/1452-26-0x0000000002C80000-0x0000000002D0F000-memory.dmpFilesize
572KB
-
memory/1452-20-0x0000000000000000-mapping.dmp
-
memory/1452-24-0x0000000002DF0000-0x0000000003110000-memory.dmpFilesize
3.1MB
-
memory/1452-21-0x0000000000970000-0x000000000098E000-memory.dmpFilesize
120KB
-
memory/1452-22-0x00000000001B0000-0x00000000001D9000-memory.dmpFilesize
164KB
-
memory/2172-23-0x0000000000000000-mapping.dmp
-
memory/2800-13-0x000000000041D0F0-mapping.dmp
-
memory/2800-18-0x00000000018C0000-0x00000000018D0000-memory.dmpFilesize
64KB
-
memory/2800-16-0x0000000001880000-0x0000000001890000-memory.dmpFilesize
64KB
-
memory/2800-15-0x0000000001560000-0x0000000001880000-memory.dmpFilesize
3.1MB
-
memory/2800-12-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3024-19-0x0000000002810000-0x0000000002905000-memory.dmpFilesize
980KB
-
memory/3024-17-0x0000000006830000-0x000000000693E000-memory.dmpFilesize
1.1MB
-
memory/3024-27-0x0000000006940000-0x0000000006A87000-memory.dmpFilesize
1.3MB