Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-07-2021 06:06
Static task
static1
Behavioral task
behavioral1
Sample
moni.exe
Resource
win7v20210408
General
-
Target
moni.exe
-
Size
606KB
-
MD5
7b2f837b3a3f8980901ca3a6f624d8d2
-
SHA1
7e0b1aabde14b6c64f8553d1d7e3499af79d2448
-
SHA256
3a4677dc6f14f38983af15458b11d5f92e71dea8d5cd0e5b263c50d211a72621
-
SHA512
677237124810c3cb0d35af23a2b9c0167d7b31dc0862bd7523841cdbc4c5209e5a71f8af8294f97e2bfa24f7d6984b00c695f0a5a5e1747833301b90fa1a46fe
Malware Config
Extracted
xloader
2.3
http://www.panyu-qqbaby.com/weni/
sdmdwang.com
konversationswithkoshie.net
carap.club
eagldeream.com
856380585.xyz
elgallocoffee.com
magetu.info
lovertons.com
theichallenge.com
advancedautorepairsonline.com
wingsstyling.info
tapdaugusta.com
wiloasbanhsgtarewdasc.solutions
donjrisdumb.com
experienceddoctor.com
cloverhillconsultants.com
underwear.show
karensgonewild2020.com
arodsr.com
thefucktardmanual.com
712kenwood.info
telecompink.com
ebizkendra.com
kitkatmp3.com
utformehagen.com
profitsnavigator.com
kathyharvey.com
tongaoffshore.com
vrpreservation.com
hy7128.com
nicolettejohnsonphotography.com
rating.travel
visualartcr.com
nationalbarista.com
lovecartoonforever.com
koimkt.com
directpractice.pro
blockchaincloud360.com
queverenbuenosaires.com
coachmyragolden.com
awree.com
facebookipl.com
rcheapwdbuy.com
trinspinsgreen.com
voxaide.com
ecorner.online
mattvickery.com
regarta.com
fknprfct.com
theessentialstore.net
sunilpsingh.com
ovtnywveba.club
optimalgafa.com
awdjob.info
humachem.com
southeasternsteakcompany.com
centerevents.net
warrenswindowcleans.co.uk
lebullterrier.com
thecxchecker.com
formerknown.com
pupbutler.com
tincanphones.com
tgeuuy.cool
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/360-63-0x0000000000310000-0x000000000031B000-memory.dmp CustAttr -
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/320-66-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/320-67-0x000000000041D000-mapping.dmp xloader behavioral1/memory/864-74-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
moni.exeRegSvcs.exesvchost.exedescription pid process target process PID 360 set thread context of 320 360 moni.exe RegSvcs.exe PID 320 set thread context of 1200 320 RegSvcs.exe Explorer.EXE PID 864 set thread context of 1200 864 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
moni.exeRegSvcs.exesvchost.exepid process 360 moni.exe 320 RegSvcs.exe 320 RegSvcs.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe 864 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exesvchost.exepid process 320 RegSvcs.exe 320 RegSvcs.exe 320 RegSvcs.exe 864 svchost.exe 864 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
moni.exeRegSvcs.exesvchost.exedescription pid process Token: SeDebugPrivilege 360 moni.exe Token: SeDebugPrivilege 320 RegSvcs.exe Token: SeDebugPrivilege 864 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
moni.exeExplorer.EXEsvchost.exedescription pid process target process PID 360 wrote to memory of 320 360 moni.exe RegSvcs.exe PID 360 wrote to memory of 320 360 moni.exe RegSvcs.exe PID 360 wrote to memory of 320 360 moni.exe RegSvcs.exe PID 360 wrote to memory of 320 360 moni.exe RegSvcs.exe PID 360 wrote to memory of 320 360 moni.exe RegSvcs.exe PID 360 wrote to memory of 320 360 moni.exe RegSvcs.exe PID 360 wrote to memory of 320 360 moni.exe RegSvcs.exe PID 360 wrote to memory of 320 360 moni.exe RegSvcs.exe PID 360 wrote to memory of 320 360 moni.exe RegSvcs.exe PID 360 wrote to memory of 320 360 moni.exe RegSvcs.exe PID 1200 wrote to memory of 864 1200 Explorer.EXE svchost.exe PID 1200 wrote to memory of 864 1200 Explorer.EXE svchost.exe PID 1200 wrote to memory of 864 1200 Explorer.EXE svchost.exe PID 1200 wrote to memory of 864 1200 Explorer.EXE svchost.exe PID 864 wrote to memory of 1632 864 svchost.exe cmd.exe PID 864 wrote to memory of 1632 864 svchost.exe cmd.exe PID 864 wrote to memory of 1632 864 svchost.exe cmd.exe PID 864 wrote to memory of 1632 864 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\moni.exe"C:\Users\Admin\AppData\Local\Temp\moni.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-66-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/320-69-0x00000000000D0000-0x00000000000E0000-memory.dmpFilesize
64KB
-
memory/320-68-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/320-67-0x000000000041D000-mapping.dmp
-
memory/360-65-0x0000000000650000-0x000000000067F000-memory.dmpFilesize
188KB
-
memory/360-60-0x0000000001060000-0x0000000001061000-memory.dmpFilesize
4KB
-
memory/360-64-0x0000000005320000-0x0000000005393000-memory.dmpFilesize
460KB
-
memory/360-63-0x0000000000310000-0x000000000031B000-memory.dmpFilesize
44KB
-
memory/360-62-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/864-71-0x0000000000000000-mapping.dmp
-
memory/864-72-0x00000000007F0000-0x00000000007F8000-memory.dmpFilesize
32KB
-
memory/864-73-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/864-74-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/864-76-0x00000000004A0000-0x000000000052F000-memory.dmpFilesize
572KB
-
memory/1200-70-0x0000000003DF0000-0x0000000003ECC000-memory.dmpFilesize
880KB
-
memory/1200-77-0x0000000006080000-0x00000000061E9000-memory.dmpFilesize
1.4MB
-
memory/1632-75-0x0000000000000000-mapping.dmp