Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 06:06
Static task
static1
Behavioral task
behavioral1
Sample
moni.exe
Resource
win7v20210408
General
-
Target
moni.exe
-
Size
606KB
-
MD5
7b2f837b3a3f8980901ca3a6f624d8d2
-
SHA1
7e0b1aabde14b6c64f8553d1d7e3499af79d2448
-
SHA256
3a4677dc6f14f38983af15458b11d5f92e71dea8d5cd0e5b263c50d211a72621
-
SHA512
677237124810c3cb0d35af23a2b9c0167d7b31dc0862bd7523841cdbc4c5209e5a71f8af8294f97e2bfa24f7d6984b00c695f0a5a5e1747833301b90fa1a46fe
Malware Config
Extracted
xloader
2.3
http://www.panyu-qqbaby.com/weni/
sdmdwang.com
konversationswithkoshie.net
carap.club
eagldeream.com
856380585.xyz
elgallocoffee.com
magetu.info
lovertons.com
theichallenge.com
advancedautorepairsonline.com
wingsstyling.info
tapdaugusta.com
wiloasbanhsgtarewdasc.solutions
donjrisdumb.com
experienceddoctor.com
cloverhillconsultants.com
underwear.show
karensgonewild2020.com
arodsr.com
thefucktardmanual.com
712kenwood.info
telecompink.com
ebizkendra.com
kitkatmp3.com
utformehagen.com
profitsnavigator.com
kathyharvey.com
tongaoffshore.com
vrpreservation.com
hy7128.com
nicolettejohnsonphotography.com
rating.travel
visualartcr.com
nationalbarista.com
lovecartoonforever.com
koimkt.com
directpractice.pro
blockchaincloud360.com
queverenbuenosaires.com
coachmyragolden.com
awree.com
facebookipl.com
rcheapwdbuy.com
trinspinsgreen.com
voxaide.com
ecorner.online
mattvickery.com
regarta.com
fknprfct.com
theessentialstore.net
sunilpsingh.com
ovtnywveba.club
optimalgafa.com
awdjob.info
humachem.com
southeasternsteakcompany.com
centerevents.net
warrenswindowcleans.co.uk
lebullterrier.com
thecxchecker.com
formerknown.com
pupbutler.com
tincanphones.com
tgeuuy.cool
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/1908-121-0x0000000003030000-0x000000000303B000-memory.dmp CustAttr -
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1584-124-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/1584-125-0x000000000041D000-mapping.dmp xloader behavioral2/memory/2764-132-0x0000000003200000-0x0000000003228000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
moni.exeRegSvcs.execmmon32.exedescription pid process target process PID 1908 set thread context of 1584 1908 moni.exe RegSvcs.exe PID 1584 set thread context of 2460 1584 RegSvcs.exe Explorer.EXE PID 2764 set thread context of 2460 2764 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
moni.exeRegSvcs.execmmon32.exepid process 1908 moni.exe 1584 RegSvcs.exe 1584 RegSvcs.exe 1584 RegSvcs.exe 1584 RegSvcs.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe 2764 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2460 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.execmmon32.exepid process 1584 RegSvcs.exe 1584 RegSvcs.exe 1584 RegSvcs.exe 2764 cmmon32.exe 2764 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
moni.exeRegSvcs.execmmon32.exedescription pid process Token: SeDebugPrivilege 1908 moni.exe Token: SeDebugPrivilege 1584 RegSvcs.exe Token: SeDebugPrivilege 2764 cmmon32.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2460 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
moni.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1908 wrote to memory of 1584 1908 moni.exe RegSvcs.exe PID 1908 wrote to memory of 1584 1908 moni.exe RegSvcs.exe PID 1908 wrote to memory of 1584 1908 moni.exe RegSvcs.exe PID 1908 wrote to memory of 1584 1908 moni.exe RegSvcs.exe PID 1908 wrote to memory of 1584 1908 moni.exe RegSvcs.exe PID 1908 wrote to memory of 1584 1908 moni.exe RegSvcs.exe PID 2460 wrote to memory of 2764 2460 Explorer.EXE cmmon32.exe PID 2460 wrote to memory of 2764 2460 Explorer.EXE cmmon32.exe PID 2460 wrote to memory of 2764 2460 Explorer.EXE cmmon32.exe PID 2764 wrote to memory of 3416 2764 cmmon32.exe cmd.exe PID 2764 wrote to memory of 3416 2764 cmmon32.exe cmd.exe PID 2764 wrote to memory of 3416 2764 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\moni.exe"C:\Users\Admin\AppData\Local\Temp\moni.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1584-124-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1584-126-0x0000000001370000-0x0000000001690000-memory.dmpFilesize
3.1MB
-
memory/1584-127-0x0000000000DF0000-0x0000000000E00000-memory.dmpFilesize
64KB
-
memory/1584-125-0x000000000041D000-mapping.dmp
-
memory/1908-120-0x0000000005750000-0x0000000005C4E000-memory.dmpFilesize
5.0MB
-
memory/1908-114-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/1908-121-0x0000000003030000-0x000000000303B000-memory.dmpFilesize
44KB
-
memory/1908-122-0x0000000007E10000-0x0000000007E83000-memory.dmpFilesize
460KB
-
memory/1908-123-0x0000000007EA0000-0x0000000007ECF000-memory.dmpFilesize
188KB
-
memory/1908-119-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/1908-118-0x00000000057F0000-0x00000000057F1000-memory.dmpFilesize
4KB
-
memory/1908-117-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/1908-116-0x0000000005C50000-0x0000000005C51000-memory.dmpFilesize
4KB
-
memory/2460-128-0x0000000005F50000-0x0000000006095000-memory.dmpFilesize
1.3MB
-
memory/2460-135-0x00000000026D0000-0x00000000027A1000-memory.dmpFilesize
836KB
-
memory/2764-129-0x0000000000000000-mapping.dmp
-
memory/2764-132-0x0000000003200000-0x0000000003228000-memory.dmpFilesize
160KB
-
memory/2764-133-0x0000000004730000-0x0000000004A50000-memory.dmpFilesize
3.1MB
-
memory/2764-131-0x0000000000880000-0x000000000088C000-memory.dmpFilesize
48KB
-
memory/2764-134-0x0000000004AE0000-0x0000000004B6F000-memory.dmpFilesize
572KB
-
memory/3416-130-0x0000000000000000-mapping.dmp