Analysis
-
max time kernel
148s -
max time network
194s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 16:50
Static task
static1
Behavioral task
behavioral1
Sample
PO#2005042020.exe
Resource
win7v20210410
General
-
Target
PO#2005042020.exe
-
Size
1011KB
-
MD5
a6be00db2846375bca4609defecd7bf5
-
SHA1
b942941deafa2af11fd59731a4bb84808601ef29
-
SHA256
72f524700194c68a6f78f7d0d984e579b736d328ef5900d34f26773855f25d42
-
SHA512
deab5d2aeffd5b7f022bcafe686844845a191f39bb9157d4a6d053e9e4de134dc3cd479badc3f3a0ab3526711429f9b4353f066adccc1cbe6992d900e8294a2a
Malware Config
Extracted
xloader
2.3
http://www.ameri.loans/dt9v/
scandinavianview.com
120x600businessskyscraper.fail
livebigrace.com
fussygang.net
afiyetmarket.com
shopcerygensan.com
iregentos.info
anidonia.com
vtnywvebm.club
envcons.com
blackpharaohbeards.com
shortsnsuits.com
digitalvv.com
czechagents.com
texasadvancedsurgery.com
erhob.com
fastypro.com
singlemomsurvival.com
mohitiitr.com
airsoftoutlet.store
respondnetwork.com
gaessl.com
karyigit.com
nyprfirm.com
skinpubgmsx.com
transworld-pictures.uk
affiiliate.com
iamidealbeauty.com
appcps.com
raadiance-films.com
wineclubwebinar.com
cashcampfire.com
nkw.cool
cheapasdutch.com
dlsscd.com
a1classicfordparts.com
tellesfreitaspartners.com
active-measurement-tool.com
pasarmurah.net
wild0utkingz.com
breathepilatesyoga.kiwi
authenticmediaholdings.com
webforall.net
christaswart.com
no-reply-icloud.com
jogocertoptjc.com
amsterdamtownstoronto.com
kiralikmanliftkocaeli.com
vybrantjewels.com
zvgty-kgbh.xyz
christakimlickojones.com
machida-fuuzoku.info
betbasketballrich.com
creativeinkpress.com
ecoleibtissama.com
turvaisi.com
cho-ass.net
bellatalksmedia.com
on-your-left.com
ssgasi.com
funif.icu
thanksgivingalkathon2020.com
thehiltz.team
casinovulkan.bid
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1652-67-0x000000000041D020-mapping.dmp xloader behavioral1/memory/1652-66-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/756-76-0x00000000000C0000-0x00000000000E8000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 576 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO#2005042020.exePO#2005042020.exeipconfig.exedescription pid process target process PID 1808 set thread context of 1652 1808 PO#2005042020.exe PO#2005042020.exe PID 1652 set thread context of 1220 1652 PO#2005042020.exe Explorer.EXE PID 1652 set thread context of 1220 1652 PO#2005042020.exe Explorer.EXE PID 756 set thread context of 1220 756 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 756 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
PO#2005042020.exeipconfig.exepid process 1652 PO#2005042020.exe 1652 PO#2005042020.exe 1652 PO#2005042020.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe 756 ipconfig.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO#2005042020.exeipconfig.exepid process 1652 PO#2005042020.exe 1652 PO#2005042020.exe 1652 PO#2005042020.exe 1652 PO#2005042020.exe 756 ipconfig.exe 756 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO#2005042020.exeipconfig.exedescription pid process Token: SeDebugPrivilege 1652 PO#2005042020.exe Token: SeDebugPrivilege 756 ipconfig.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PO#2005042020.exeExplorer.EXEipconfig.exedescription pid process target process PID 1808 wrote to memory of 1652 1808 PO#2005042020.exe PO#2005042020.exe PID 1808 wrote to memory of 1652 1808 PO#2005042020.exe PO#2005042020.exe PID 1808 wrote to memory of 1652 1808 PO#2005042020.exe PO#2005042020.exe PID 1808 wrote to memory of 1652 1808 PO#2005042020.exe PO#2005042020.exe PID 1808 wrote to memory of 1652 1808 PO#2005042020.exe PO#2005042020.exe PID 1808 wrote to memory of 1652 1808 PO#2005042020.exe PO#2005042020.exe PID 1808 wrote to memory of 1652 1808 PO#2005042020.exe PO#2005042020.exe PID 1220 wrote to memory of 756 1220 Explorer.EXE ipconfig.exe PID 1220 wrote to memory of 756 1220 Explorer.EXE ipconfig.exe PID 1220 wrote to memory of 756 1220 Explorer.EXE ipconfig.exe PID 1220 wrote to memory of 756 1220 Explorer.EXE ipconfig.exe PID 756 wrote to memory of 576 756 ipconfig.exe cmd.exe PID 756 wrote to memory of 576 756 ipconfig.exe cmd.exe PID 756 wrote to memory of 576 756 ipconfig.exe cmd.exe PID 756 wrote to memory of 576 756 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO#2005042020.exe"C:\Users\Admin\AppData\Local\Temp\PO#2005042020.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO#2005042020.exe"C:\Users\Admin\AppData\Local\Temp\PO#2005042020.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO#2005042020.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/576-77-0x0000000000000000-mapping.dmp
-
memory/756-79-0x0000000001F00000-0x0000000001F8F000-memory.dmpFilesize
572KB
-
memory/756-78-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/756-76-0x00000000000C0000-0x00000000000E8000-memory.dmpFilesize
160KB
-
memory/756-75-0x0000000000650000-0x000000000065A000-memory.dmpFilesize
40KB
-
memory/756-74-0x0000000075631000-0x0000000075633000-memory.dmpFilesize
8KB
-
memory/756-73-0x0000000000000000-mapping.dmp
-
memory/1220-72-0x0000000006E40000-0x0000000006FD7000-memory.dmpFilesize
1.6MB
-
memory/1220-80-0x00000000070A0000-0x00000000071D3000-memory.dmpFilesize
1.2MB
-
memory/1220-70-0x0000000004B10000-0x0000000004C72000-memory.dmpFilesize
1.4MB
-
memory/1652-67-0x000000000041D020-mapping.dmp
-
memory/1652-71-0x00000000001A0000-0x00000000001B0000-memory.dmpFilesize
64KB
-
memory/1652-68-0x0000000000C80000-0x0000000000F83000-memory.dmpFilesize
3.0MB
-
memory/1652-69-0x0000000000160000-0x0000000000170000-memory.dmpFilesize
64KB
-
memory/1652-66-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1808-60-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/1808-65-0x0000000004960000-0x000000000498B000-memory.dmpFilesize
172KB
-
memory/1808-64-0x0000000005080000-0x00000000050EE000-memory.dmpFilesize
440KB
-
memory/1808-63-0x0000000000590000-0x00000000005AB000-memory.dmpFilesize
108KB
-
memory/1808-62-0x00000000021B0000-0x00000000021B1000-memory.dmpFilesize
4KB