Analysis
-
max time kernel
149s -
max time network
174s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 17:02
Static task
static1
Behavioral task
behavioral1
Sample
lono.exe
Resource
win7v20210408
General
-
Target
lono.exe
-
Size
960KB
-
MD5
3dd87d18a1e0e5d97de8b77458d18f74
-
SHA1
ab1538aa18a14156ac7e20bba7329bac26216745
-
SHA256
d050c9c41083b76f378f09e9c5394cfef4a18d7de11a87720b2e5e3cf704330b
-
SHA512
d0dd1b6e6acded09d8783389a5fab9e503cd37ac4759fd3b1f714ff1d103ee858d43dc558503545b6e5a2545383ba47ed91b44953207107b616a79ae30d2fcd2
Malware Config
Extracted
xloader
2.3
http://www.jantesetaccessoires.com/p6f2/
redsnews.com
vr859.com
postmasterstudios.com
hampsteadorganizer.com
hangshop.net
maheshwaramlawcollege.com
5156087.com
gtaaddict.com
faj.xyz
drivechicagoillinois.com
neerutech.com
b2brahmas.com
freshlookks.com
propertyparallel.tech
tlwbyads.com
sellektorkids.com
dexs.fyi
kileybrock.com
nervstudio.com
tosg-ltd.com
admibd.com
hilariousfakenews.com
lub-additive.com
securecloudinfo.com
xn--jde.com
andtheskywentred.com
nearestgreenbeverage.net
tipthemusician.com
koziolwojciech.com
ryosecurity.com
cosypromotion.com
qvvn.life
emcelt.com
ersatzair.com
blassmail.online
florianlecerf.com
shannonsmithcounseling.com
litorin.com
plusproduce.net
sandersonfarnns.com
medicservic.com
mostmegaproductions.com
eldorado88casino.com
hordlife.com
drgunjankumaribhagwat.com
iregentos.info
lifeonprimroselane.com
playstoreaddps.com
anacquiredtastepodcast.com
chinachaohuo.com
xn--80aafif4agv1ai.xn--p1acf
flmoisture.com
framebooth.net
wildhare.media
1000praises.com
tna.zone
kravmagatacticalacademy.com
jasonwang.online
suruyorum.com
concretepill.com
alfarouqco.com
reliefpaypal.com
xn--fujtherma-xpb.com
petgsafetyseal.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1976-65-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1976-66-0x000000000041D050-mapping.dmp xloader behavioral1/memory/524-73-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1208 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
lono.exelono.exeNETSTAT.EXEdescription pid process target process PID 1832 set thread context of 1976 1832 lono.exe lono.exe PID 1976 set thread context of 1212 1976 lono.exe Explorer.EXE PID 524 set thread context of 1212 524 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 524 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
lono.exeNETSTAT.EXEpid process 1976 lono.exe 1976 lono.exe 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE 524 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
lono.exeNETSTAT.EXEpid process 1976 lono.exe 1976 lono.exe 1976 lono.exe 524 NETSTAT.EXE 524 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
lono.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1976 lono.exe Token: SeDebugPrivilege 524 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
lono.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1832 wrote to memory of 1976 1832 lono.exe lono.exe PID 1832 wrote to memory of 1976 1832 lono.exe lono.exe PID 1832 wrote to memory of 1976 1832 lono.exe lono.exe PID 1832 wrote to memory of 1976 1832 lono.exe lono.exe PID 1832 wrote to memory of 1976 1832 lono.exe lono.exe PID 1832 wrote to memory of 1976 1832 lono.exe lono.exe PID 1832 wrote to memory of 1976 1832 lono.exe lono.exe PID 1212 wrote to memory of 524 1212 Explorer.EXE NETSTAT.EXE PID 1212 wrote to memory of 524 1212 Explorer.EXE NETSTAT.EXE PID 1212 wrote to memory of 524 1212 Explorer.EXE NETSTAT.EXE PID 1212 wrote to memory of 524 1212 Explorer.EXE NETSTAT.EXE PID 524 wrote to memory of 1208 524 NETSTAT.EXE cmd.exe PID 524 wrote to memory of 1208 524 NETSTAT.EXE cmd.exe PID 524 wrote to memory of 1208 524 NETSTAT.EXE cmd.exe PID 524 wrote to memory of 1208 524 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lono.exe"C:\Users\Admin\AppData\Local\Temp\lono.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lono.exe"C:\Users\Admin\AppData\Local\Temp\lono.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\lono.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-70-0x0000000000000000-mapping.dmp
-
memory/524-75-0x0000000000B80000-0x0000000000C0F000-memory.dmpFilesize
572KB
-
memory/524-74-0x0000000002190000-0x0000000002493000-memory.dmpFilesize
3.0MB
-
memory/524-73-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/524-72-0x0000000000D80000-0x0000000000D89000-memory.dmpFilesize
36KB
-
memory/1208-71-0x0000000000000000-mapping.dmp
-
memory/1212-69-0x0000000004F90000-0x00000000050BB000-memory.dmpFilesize
1.2MB
-
memory/1212-76-0x0000000003E20000-0x0000000003EEC000-memory.dmpFilesize
816KB
-
memory/1832-60-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB
-
memory/1832-64-0x00000000008A0000-0x00000000008AF000-memory.dmpFilesize
60KB
-
memory/1832-63-0x0000000000820000-0x000000000089B000-memory.dmpFilesize
492KB
-
memory/1832-62-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/1976-68-0x00000000000F0000-0x0000000000100000-memory.dmpFilesize
64KB
-
memory/1976-67-0x0000000000B40000-0x0000000000E43000-memory.dmpFilesize
3.0MB
-
memory/1976-66-0x000000000041D050-mapping.dmp
-
memory/1976-65-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB