Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 17:03
Static task
static1
Behavioral task
behavioral1
Sample
SOA.exe
Resource
win7v20210408
General
-
Target
SOA.exe
-
Size
896KB
-
MD5
23d890e7a25c8a51bfcec1939a20a7e9
-
SHA1
0193e5561521c2beac81ef0e3141fe0f93f7e9b7
-
SHA256
ddc1d5dd3d2d2a64d1d3e7586023715a1da59c30af9682843d326e0f16f12632
-
SHA512
fcb819f6537a4829b2a5d3e605370c6991bfbd189abcc8cc786ef446060e5ced93da6f38a2b4dd6477ac6ad5712ece89bae495bbfc52debb1889f0f4a69c6c8e
Malware Config
Extracted
xloader
2.3
http://www.cannabisoutletonline.com/n86i/
purpose-guide.com
averyshairco.com
blockchain-365.com
jismlmuu.icu
famosobambino.com
firstclasstruckingny.com
oracleoftheinternet.com
alliesdispatchlogistics.com
salten2.com
bfactivator.com
jgc40.com
nanninghao.com
eigorilla.info
predies.com
dmzg-cn.net
registratetexas.com
maxifina-aprovado.com
mdqqy-dliv.xyz
annurenterprise.com
dongtrunghathaovanphuc.com
fdshomes.com
tringband.com
thesawfam.com
medsbest.rest
aingus.com
carlfbrothersauthor.com
behind7.com
karigeddes.com
gteana.com
afepcfmcb.icu
bluebuilddesign.com
soliyamalimited.com
peterchengrealty.com
dearth22717.info
a-v-r.com
moybaun.com
dhaliatus.online
luxtoyou.com
dallasresidentialpainters.com
bajakubajaringan.com
writinginstructionforkids.com
cocorelaxmassage.com
evvivastocazzo.com
airpound.com
legacyazschoolagy.com
nlsapparel.com
rafsdoorservice.com
babelbuilders.com
2006almadenrd.com
emergelifelegacy.com
hanafelixart.com
magistrydev.com
grupomediaye.com
severfounsvisn.com
yhdz188.com
lisn.club
friendsofericorts.com
amoelectric1997.com
lifecover.club
blaxies3.com
kfcpx.com
vpvelguem.com
johnmabry.com
kortescab.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1016-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1016-126-0x000000000041D060-mapping.dmp xloader behavioral2/memory/4124-132-0x0000000000AE0000-0x0000000000B09000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
SOA.exeSOA.exeraserver.exedescription pid process target process PID 4440 set thread context of 1016 4440 SOA.exe SOA.exe PID 1016 set thread context of 2416 1016 SOA.exe Explorer.EXE PID 4124 set thread context of 2416 4124 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
SOA.exeSOA.exeraserver.exepid process 4440 SOA.exe 4440 SOA.exe 1016 SOA.exe 1016 SOA.exe 1016 SOA.exe 1016 SOA.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe 4124 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2416 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
SOA.exeraserver.exepid process 1016 SOA.exe 1016 SOA.exe 1016 SOA.exe 4124 raserver.exe 4124 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SOA.exeSOA.exeraserver.exedescription pid process Token: SeDebugPrivilege 4440 SOA.exe Token: SeDebugPrivilege 1016 SOA.exe Token: SeDebugPrivilege 4124 raserver.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
SOA.exeExplorer.EXEraserver.exedescription pid process target process PID 4440 wrote to memory of 3336 4440 SOA.exe SOA.exe PID 4440 wrote to memory of 3336 4440 SOA.exe SOA.exe PID 4440 wrote to memory of 3336 4440 SOA.exe SOA.exe PID 4440 wrote to memory of 1016 4440 SOA.exe SOA.exe PID 4440 wrote to memory of 1016 4440 SOA.exe SOA.exe PID 4440 wrote to memory of 1016 4440 SOA.exe SOA.exe PID 4440 wrote to memory of 1016 4440 SOA.exe SOA.exe PID 4440 wrote to memory of 1016 4440 SOA.exe SOA.exe PID 4440 wrote to memory of 1016 4440 SOA.exe SOA.exe PID 2416 wrote to memory of 4124 2416 Explorer.EXE raserver.exe PID 2416 wrote to memory of 4124 2416 Explorer.EXE raserver.exe PID 2416 wrote to memory of 4124 2416 Explorer.EXE raserver.exe PID 4124 wrote to memory of 4108 4124 raserver.exe cmd.exe PID 4124 wrote to memory of 4108 4124 raserver.exe cmd.exe PID 4124 wrote to memory of 4108 4124 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SOA.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1016-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1016-127-0x0000000000EC0000-0x00000000011E0000-memory.dmpFilesize
3.1MB
-
memory/1016-128-0x0000000001200000-0x0000000001211000-memory.dmpFilesize
68KB
-
memory/1016-126-0x000000000041D060-mapping.dmp
-
memory/2416-136-0x0000000006D30000-0x0000000006E73000-memory.dmpFilesize
1.3MB
-
memory/2416-129-0x00000000069B0000-0x0000000006B45000-memory.dmpFilesize
1.6MB
-
memory/4108-133-0x0000000000000000-mapping.dmp
-
memory/4124-130-0x0000000000000000-mapping.dmp
-
memory/4124-131-0x0000000000DD0000-0x0000000000DEF000-memory.dmpFilesize
124KB
-
memory/4124-135-0x0000000004960000-0x00000000049F0000-memory.dmpFilesize
576KB
-
memory/4124-134-0x0000000004AB0000-0x0000000004DD0000-memory.dmpFilesize
3.1MB
-
memory/4124-132-0x0000000000AE0000-0x0000000000B09000-memory.dmpFilesize
164KB
-
memory/4440-121-0x0000000006D90000-0x0000000006D92000-memory.dmpFilesize
8KB
-
memory/4440-119-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/4440-118-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/4440-114-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/4440-120-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/4440-123-0x00000000064A0000-0x000000000651A000-memory.dmpFilesize
488KB
-
memory/4440-117-0x00000000095E0000-0x00000000095E1000-memory.dmpFilesize
4KB
-
memory/4440-122-0x0000000007180000-0x0000000007181000-memory.dmpFilesize
4KB
-
memory/4440-124-0x0000000004D10000-0x0000000004D3A000-memory.dmpFilesize
168KB
-
memory/4440-116-0x0000000007080000-0x00000000070D9000-memory.dmpFilesize
356KB