Analysis
-
max time kernel
147s -
max time network
170s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-07-2021 17:03
Static task
static1
Behavioral task
behavioral1
Sample
SOA.exe
Resource
win7v20210408
General
-
Target
SOA.exe
-
Size
896KB
-
MD5
23d890e7a25c8a51bfcec1939a20a7e9
-
SHA1
0193e5561521c2beac81ef0e3141fe0f93f7e9b7
-
SHA256
ddc1d5dd3d2d2a64d1d3e7586023715a1da59c30af9682843d326e0f16f12632
-
SHA512
fcb819f6537a4829b2a5d3e605370c6991bfbd189abcc8cc786ef446060e5ced93da6f38a2b4dd6477ac6ad5712ece89bae495bbfc52debb1889f0f4a69c6c8e
Malware Config
Extracted
xloader
2.3
http://www.cannabisoutletonline.com/n86i/
purpose-guide.com
averyshairco.com
blockchain-365.com
jismlmuu.icu
famosobambino.com
firstclasstruckingny.com
oracleoftheinternet.com
alliesdispatchlogistics.com
salten2.com
bfactivator.com
jgc40.com
nanninghao.com
eigorilla.info
predies.com
dmzg-cn.net
registratetexas.com
maxifina-aprovado.com
mdqqy-dliv.xyz
annurenterprise.com
dongtrunghathaovanphuc.com
fdshomes.com
tringband.com
thesawfam.com
medsbest.rest
aingus.com
carlfbrothersauthor.com
behind7.com
karigeddes.com
gteana.com
afepcfmcb.icu
bluebuilddesign.com
soliyamalimited.com
peterchengrealty.com
dearth22717.info
a-v-r.com
moybaun.com
dhaliatus.online
luxtoyou.com
dallasresidentialpainters.com
bajakubajaringan.com
writinginstructionforkids.com
cocorelaxmassage.com
evvivastocazzo.com
airpound.com
legacyazschoolagy.com
nlsapparel.com
rafsdoorservice.com
babelbuilders.com
2006almadenrd.com
emergelifelegacy.com
hanafelixart.com
magistrydev.com
grupomediaye.com
severfounsvisn.com
yhdz188.com
lisn.club
friendsofericorts.com
amoelectric1997.com
lifecover.club
blaxies3.com
kfcpx.com
vpvelguem.com
johnmabry.com
kortescab.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/968-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/968-67-0x000000000041D060-mapping.dmp xloader behavioral1/memory/1864-76-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1068 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SOA.exeSOA.exerundll32.exedescription pid process target process PID 1944 set thread context of 968 1944 SOA.exe SOA.exe PID 968 set thread context of 1276 968 SOA.exe Explorer.EXE PID 968 set thread context of 1276 968 SOA.exe Explorer.EXE PID 1864 set thread context of 1276 1864 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
SOA.exerundll32.exepid process 968 SOA.exe 968 SOA.exe 968 SOA.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe 1864 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
SOA.exerundll32.exepid process 968 SOA.exe 968 SOA.exe 968 SOA.exe 968 SOA.exe 1864 rundll32.exe 1864 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SOA.exerundll32.exedescription pid process Token: SeDebugPrivilege 968 SOA.exe Token: SeDebugPrivilege 1864 rundll32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SOA.exeExplorer.EXErundll32.exedescription pid process target process PID 1944 wrote to memory of 968 1944 SOA.exe SOA.exe PID 1944 wrote to memory of 968 1944 SOA.exe SOA.exe PID 1944 wrote to memory of 968 1944 SOA.exe SOA.exe PID 1944 wrote to memory of 968 1944 SOA.exe SOA.exe PID 1944 wrote to memory of 968 1944 SOA.exe SOA.exe PID 1944 wrote to memory of 968 1944 SOA.exe SOA.exe PID 1944 wrote to memory of 968 1944 SOA.exe SOA.exe PID 1276 wrote to memory of 1864 1276 Explorer.EXE rundll32.exe PID 1276 wrote to memory of 1864 1276 Explorer.EXE rundll32.exe PID 1276 wrote to memory of 1864 1276 Explorer.EXE rundll32.exe PID 1276 wrote to memory of 1864 1276 Explorer.EXE rundll32.exe PID 1276 wrote to memory of 1864 1276 Explorer.EXE rundll32.exe PID 1276 wrote to memory of 1864 1276 Explorer.EXE rundll32.exe PID 1276 wrote to memory of 1864 1276 Explorer.EXE rundll32.exe PID 1864 wrote to memory of 1068 1864 rundll32.exe cmd.exe PID 1864 wrote to memory of 1068 1864 rundll32.exe cmd.exe PID 1864 wrote to memory of 1068 1864 rundll32.exe cmd.exe PID 1864 wrote to memory of 1068 1864 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SOA.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/968-71-0x00000000001D0000-0x00000000001E1000-memory.dmpFilesize
68KB
-
memory/968-69-0x0000000000180000-0x0000000000191000-memory.dmpFilesize
68KB
-
memory/968-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/968-67-0x000000000041D060-mapping.dmp
-
memory/968-68-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/1068-77-0x0000000000000000-mapping.dmp
-
memory/1276-70-0x0000000004B10000-0x0000000004C7A000-memory.dmpFilesize
1.4MB
-
memory/1276-80-0x0000000004050000-0x000000000413B000-memory.dmpFilesize
940KB
-
memory/1276-72-0x0000000006F60000-0x0000000007106000-memory.dmpFilesize
1.6MB
-
memory/1864-75-0x0000000000720000-0x000000000072E000-memory.dmpFilesize
56KB
-
memory/1864-73-0x0000000000000000-mapping.dmp
-
memory/1864-74-0x00000000760B1000-0x00000000760B3000-memory.dmpFilesize
8KB
-
memory/1864-76-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1864-78-0x0000000002090000-0x0000000002393000-memory.dmpFilesize
3.0MB
-
memory/1864-79-0x0000000000460000-0x00000000004F0000-memory.dmpFilesize
576KB
-
memory/1944-65-0x0000000000680000-0x00000000006AA000-memory.dmpFilesize
168KB
-
memory/1944-64-0x00000000058F0000-0x000000000596A000-memory.dmpFilesize
488KB
-
memory/1944-63-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/1944-59-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/1944-62-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/1944-61-0x0000000004210000-0x0000000004269000-memory.dmpFilesize
356KB