Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 14:59
Static task
static1
Behavioral task
behavioral1
Sample
nWVjpM9ao5s78s3.exe
Resource
win7v20210408
General
-
Target
nWVjpM9ao5s78s3.exe
-
Size
875KB
-
MD5
8fc8a4252b32c8eb4b9e03b018ff72a2
-
SHA1
14a7a0b55043b430cbcb0a94b26a4f33c3f7d3d2
-
SHA256
e59a1d022c6c4f0cc7d23689004e65ea7f1f940adef98cf891a008dd9d7f66d9
-
SHA512
00b3d70f9929d76dda8c0691b394393a299446056330bf634043e88935551a49d8708a2fc0baf8ef1f5f4e3cce107ae796e4fc99ac24420052ca304e3c3f59f2
Malware Config
Extracted
xloader
2.3
http://www.panyu-qqbaby.com/weni/
sdmdwang.com
konversationswithkoshie.net
carap.club
eagldeream.com
856380585.xyz
elgallocoffee.com
magetu.info
lovertons.com
theichallenge.com
advancedautorepairsonline.com
wingsstyling.info
tapdaugusta.com
wiloasbanhsgtarewdasc.solutions
donjrisdumb.com
experienceddoctor.com
cloverhillconsultants.com
underwear.show
karensgonewild2020.com
arodsr.com
thefucktardmanual.com
712kenwood.info
telecompink.com
ebizkendra.com
kitkatmp3.com
utformehagen.com
profitsnavigator.com
kathyharvey.com
tongaoffshore.com
vrpreservation.com
hy7128.com
nicolettejohnsonphotography.com
rating.travel
visualartcr.com
nationalbarista.com
lovecartoonforever.com
koimkt.com
directpractice.pro
blockchaincloud360.com
queverenbuenosaires.com
coachmyragolden.com
awree.com
facebookipl.com
rcheapwdbuy.com
trinspinsgreen.com
voxaide.com
ecorner.online
mattvickery.com
regarta.com
fknprfct.com
theessentialstore.net
sunilpsingh.com
ovtnywveba.club
optimalgafa.com
awdjob.info
humachem.com
southeasternsteakcompany.com
centerevents.net
warrenswindowcleans.co.uk
lebullterrier.com
thecxchecker.com
formerknown.com
pupbutler.com
tincanphones.com
tgeuuy.cool
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1512-125-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/1512-126-0x000000000041D000-mapping.dmp xloader behavioral2/memory/2736-133-0x0000000000A00000-0x0000000000A28000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
nWVjpM9ao5s78s3.exeRegSvcs.exemsdt.exedescription pid process target process PID 516 set thread context of 1512 516 nWVjpM9ao5s78s3.exe RegSvcs.exe PID 1512 set thread context of 1964 1512 RegSvcs.exe Explorer.EXE PID 2736 set thread context of 1964 2736 msdt.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
RegSvcs.exemsdt.exepid process 1512 RegSvcs.exe 1512 RegSvcs.exe 1512 RegSvcs.exe 1512 RegSvcs.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe 2736 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1964 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exemsdt.exepid process 1512 RegSvcs.exe 1512 RegSvcs.exe 1512 RegSvcs.exe 2736 msdt.exe 2736 msdt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
nWVjpM9ao5s78s3.exeRegSvcs.exemsdt.exedescription pid process Token: SeDebugPrivilege 516 nWVjpM9ao5s78s3.exe Token: SeDebugPrivilege 1512 RegSvcs.exe Token: SeDebugPrivilege 2736 msdt.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1964 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
nWVjpM9ao5s78s3.exeExplorer.EXEmsdt.exedescription pid process target process PID 516 wrote to memory of 1512 516 nWVjpM9ao5s78s3.exe RegSvcs.exe PID 516 wrote to memory of 1512 516 nWVjpM9ao5s78s3.exe RegSvcs.exe PID 516 wrote to memory of 1512 516 nWVjpM9ao5s78s3.exe RegSvcs.exe PID 516 wrote to memory of 1512 516 nWVjpM9ao5s78s3.exe RegSvcs.exe PID 516 wrote to memory of 1512 516 nWVjpM9ao5s78s3.exe RegSvcs.exe PID 516 wrote to memory of 1512 516 nWVjpM9ao5s78s3.exe RegSvcs.exe PID 1964 wrote to memory of 2736 1964 Explorer.EXE msdt.exe PID 1964 wrote to memory of 2736 1964 Explorer.EXE msdt.exe PID 1964 wrote to memory of 2736 1964 Explorer.EXE msdt.exe PID 2736 wrote to memory of 1188 2736 msdt.exe cmd.exe PID 2736 wrote to memory of 1188 2736 msdt.exe cmd.exe PID 2736 wrote to memory of 1188 2736 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nWVjpM9ao5s78s3.exe"C:\Users\Admin\AppData\Local\Temp\nWVjpM9ao5s78s3.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/516-116-0x00000000049D0000-0x0000000004A25000-memory.dmpFilesize
340KB
-
memory/516-117-0x00000000093F0000-0x00000000093F1000-memory.dmpFilesize
4KB
-
memory/516-118-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/516-119-0x0000000004540000-0x0000000004541000-memory.dmpFilesize
4KB
-
memory/516-120-0x0000000004A50000-0x0000000004A51000-memory.dmpFilesize
4KB
-
memory/516-121-0x0000000005B60000-0x0000000005B62000-memory.dmpFilesize
8KB
-
memory/516-122-0x0000000006F90000-0x0000000006F91000-memory.dmpFilesize
4KB
-
memory/516-123-0x00000000050C0000-0x0000000005136000-memory.dmpFilesize
472KB
-
memory/516-124-0x0000000005030000-0x000000000505A000-memory.dmpFilesize
168KB
-
memory/516-114-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1188-131-0x0000000000000000-mapping.dmp
-
memory/1512-125-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1512-128-0x00000000005F0000-0x0000000000600000-memory.dmpFilesize
64KB
-
memory/1512-127-0x0000000001090000-0x00000000013B0000-memory.dmpFilesize
3.1MB
-
memory/1512-126-0x000000000041D000-mapping.dmp
-
memory/1964-129-0x00000000069F0000-0x0000000006B42000-memory.dmpFilesize
1.3MB
-
memory/1964-136-0x0000000009130000-0x00000000092A3000-memory.dmpFilesize
1.4MB
-
memory/2736-130-0x0000000000000000-mapping.dmp
-
memory/2736-133-0x0000000000A00000-0x0000000000A28000-memory.dmpFilesize
160KB
-
memory/2736-132-0x0000000000F70000-0x00000000010E3000-memory.dmpFilesize
1.4MB
-
memory/2736-134-0x0000000004690000-0x00000000049B0000-memory.dmpFilesize
3.1MB
-
memory/2736-135-0x0000000000DB0000-0x0000000000E3F000-memory.dmpFilesize
572KB