Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 19:59
Static task
static1
Behavioral task
behavioral1
Sample
367006.exe
Resource
win7v20210410
General
-
Target
367006.exe
-
Size
1.0MB
-
MD5
54cd3832c1ab9889d0b3741292a0263b
-
SHA1
c855ad13ab4cd135d1e04c10524a4f06a2007654
-
SHA256
e3a371bfc3dd3560f5bd27f023c137e5b2c7bdba80c5b7f14a69f393cbce047e
-
SHA512
85223e48449c77d8a36a820bb9df9c546ad0c13f9b35c8c542104dd62de557f611bf23e187245b50995481a7e175a96978dea4c0c6fc3b8461f1f07c4111c9a8
Malware Config
Extracted
xloader
2.3
http://www.ameri.loans/dt9v/
scandinavianview.com
120x600businessskyscraper.fail
livebigrace.com
fussygang.net
afiyetmarket.com
shopcerygensan.com
iregentos.info
anidonia.com
vtnywvebm.club
envcons.com
blackpharaohbeards.com
shortsnsuits.com
digitalvv.com
czechagents.com
texasadvancedsurgery.com
erhob.com
fastypro.com
singlemomsurvival.com
mohitiitr.com
airsoftoutlet.store
respondnetwork.com
gaessl.com
karyigit.com
nyprfirm.com
skinpubgmsx.com
transworld-pictures.uk
affiiliate.com
iamidealbeauty.com
appcps.com
raadiance-films.com
wineclubwebinar.com
cashcampfire.com
nkw.cool
cheapasdutch.com
dlsscd.com
a1classicfordparts.com
tellesfreitaspartners.com
active-measurement-tool.com
pasarmurah.net
wild0utkingz.com
breathepilatesyoga.kiwi
authenticmediaholdings.com
webforall.net
christaswart.com
no-reply-icloud.com
jogocertoptjc.com
amsterdamtownstoronto.com
kiralikmanliftkocaeli.com
vybrantjewels.com
zvgty-kgbh.xyz
christakimlickojones.com
machida-fuuzoku.info
betbasketballrich.com
creativeinkpress.com
ecoleibtissama.com
turvaisi.com
cho-ass.net
bellatalksmedia.com
on-your-left.com
ssgasi.com
funif.icu
thanksgivingalkathon2020.com
thehiltz.team
casinovulkan.bid
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1512-125-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/1512-126-0x000000000041D020-mapping.dmp xloader behavioral2/memory/2068-133-0x0000000002FA0000-0x0000000002FC8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
367006.exe367006.execolorcpl.exedescription pid process target process PID 644 set thread context of 1512 644 367006.exe 367006.exe PID 1512 set thread context of 3092 1512 367006.exe Explorer.EXE PID 2068 set thread context of 3092 2068 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
367006.execolorcpl.exepid process 1512 367006.exe 1512 367006.exe 1512 367006.exe 1512 367006.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe 2068 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3092 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
367006.execolorcpl.exepid process 1512 367006.exe 1512 367006.exe 1512 367006.exe 2068 colorcpl.exe 2068 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
367006.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1512 367006.exe Token: SeDebugPrivilege 2068 colorcpl.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
367006.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 644 wrote to memory of 1512 644 367006.exe 367006.exe PID 644 wrote to memory of 1512 644 367006.exe 367006.exe PID 644 wrote to memory of 1512 644 367006.exe 367006.exe PID 644 wrote to memory of 1512 644 367006.exe 367006.exe PID 644 wrote to memory of 1512 644 367006.exe 367006.exe PID 644 wrote to memory of 1512 644 367006.exe 367006.exe PID 3092 wrote to memory of 2068 3092 Explorer.EXE colorcpl.exe PID 3092 wrote to memory of 2068 3092 Explorer.EXE colorcpl.exe PID 3092 wrote to memory of 2068 3092 Explorer.EXE colorcpl.exe PID 2068 wrote to memory of 1312 2068 colorcpl.exe cmd.exe PID 2068 wrote to memory of 1312 2068 colorcpl.exe cmd.exe PID 2068 wrote to memory of 1312 2068 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\367006.exe"C:\Users\Admin\AppData\Local\Temp\367006.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\367006.exe"C:\Users\Admin\AppData\Local\Temp\367006.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\367006.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/644-116-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/644-117-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/644-118-0x00000000051C0000-0x00000000051C1000-memory.dmpFilesize
4KB
-
memory/644-119-0x00000000051C0000-0x00000000056BE000-memory.dmpFilesize
5.0MB
-
memory/644-120-0x0000000002B10000-0x0000000002B11000-memory.dmpFilesize
4KB
-
memory/644-121-0x0000000005330000-0x0000000005331000-memory.dmpFilesize
4KB
-
memory/644-122-0x0000000006BD0000-0x0000000006BEB000-memory.dmpFilesize
108KB
-
memory/644-123-0x0000000006E90000-0x0000000006F02000-memory.dmpFilesize
456KB
-
memory/644-124-0x0000000006F10000-0x0000000006F3E000-memory.dmpFilesize
184KB
-
memory/644-114-0x0000000000740000-0x0000000000741000-memory.dmpFilesize
4KB
-
memory/1312-131-0x0000000000000000-mapping.dmp
-
memory/1512-125-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1512-127-0x0000000001A70000-0x0000000001D90000-memory.dmpFilesize
3.1MB
-
memory/1512-128-0x00000000019D0000-0x00000000019E0000-memory.dmpFilesize
64KB
-
memory/1512-126-0x000000000041D020-mapping.dmp
-
memory/2068-130-0x0000000000000000-mapping.dmp
-
memory/2068-132-0x0000000000100000-0x0000000000119000-memory.dmpFilesize
100KB
-
memory/2068-133-0x0000000002FA0000-0x0000000002FC8000-memory.dmpFilesize
160KB
-
memory/2068-134-0x0000000004780000-0x0000000004AA0000-memory.dmpFilesize
3.1MB
-
memory/2068-135-0x0000000004B30000-0x0000000004BBF000-memory.dmpFilesize
572KB
-
memory/3092-129-0x0000000005E40000-0x0000000005F1C000-memory.dmpFilesize
880KB
-
memory/3092-136-0x0000000006230000-0x00000000063A4000-memory.dmpFilesize
1.5MB