Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 12:41
Static task
static1
General
-
Target
PO_S32G01521.exe
-
Size
450KB
-
MD5
7c67d687aa9d574fcea531bda2eda1da
-
SHA1
9ca303e862a7d00d2768abcf83211fceb72e836c
-
SHA256
44810a90a17a6d1286bdd1862a82c7062371ccece40cbd8e22dce7028e011825
-
SHA512
55ad7074da83ff222622fad62e2f657d7c888d7ed2398346c9e897ac77d8f5f275513eeb11e82081242fb3c17d7f1eb739e024ff617dd1d0f4ed4d78d8859b6a
Malware Config
Extracted
xloader
2.3
http://www.bodymoisturizer.online/q4kr/
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1960-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1960-67-0x000000000041D0D0-mapping.dmp xloader behavioral1/memory/1516-75-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO_S32G01521.exeRegSvcs.execmmon32.exedescription pid process target process PID 2004 set thread context of 1960 2004 PO_S32G01521.exe RegSvcs.exe PID 1960 set thread context of 1256 1960 RegSvcs.exe Explorer.EXE PID 1960 set thread context of 1256 1960 RegSvcs.exe Explorer.EXE PID 1516 set thread context of 1256 1516 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
PO_S32G01521.exeRegSvcs.execmmon32.exepid process 2004 PO_S32G01521.exe 1960 RegSvcs.exe 1960 RegSvcs.exe 1960 RegSvcs.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe 1516 cmmon32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.execmmon32.exepid process 1960 RegSvcs.exe 1960 RegSvcs.exe 1960 RegSvcs.exe 1960 RegSvcs.exe 1516 cmmon32.exe 1516 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO_S32G01521.exeRegSvcs.execmmon32.exedescription pid process Token: SeDebugPrivilege 2004 PO_S32G01521.exe Token: SeDebugPrivilege 1960 RegSvcs.exe Token: SeDebugPrivilege 1516 cmmon32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
PO_S32G01521.exeRegSvcs.execmmon32.exedescription pid process target process PID 2004 wrote to memory of 1960 2004 PO_S32G01521.exe RegSvcs.exe PID 2004 wrote to memory of 1960 2004 PO_S32G01521.exe RegSvcs.exe PID 2004 wrote to memory of 1960 2004 PO_S32G01521.exe RegSvcs.exe PID 2004 wrote to memory of 1960 2004 PO_S32G01521.exe RegSvcs.exe PID 2004 wrote to memory of 1960 2004 PO_S32G01521.exe RegSvcs.exe PID 2004 wrote to memory of 1960 2004 PO_S32G01521.exe RegSvcs.exe PID 2004 wrote to memory of 1960 2004 PO_S32G01521.exe RegSvcs.exe PID 2004 wrote to memory of 1960 2004 PO_S32G01521.exe RegSvcs.exe PID 2004 wrote to memory of 1960 2004 PO_S32G01521.exe RegSvcs.exe PID 2004 wrote to memory of 1960 2004 PO_S32G01521.exe RegSvcs.exe PID 1960 wrote to memory of 1516 1960 RegSvcs.exe cmmon32.exe PID 1960 wrote to memory of 1516 1960 RegSvcs.exe cmmon32.exe PID 1960 wrote to memory of 1516 1960 RegSvcs.exe cmmon32.exe PID 1960 wrote to memory of 1516 1960 RegSvcs.exe cmmon32.exe PID 1516 wrote to memory of 284 1516 cmmon32.exe cmd.exe PID 1516 wrote to memory of 284 1516 cmmon32.exe cmd.exe PID 1516 wrote to memory of 284 1516 cmmon32.exe cmd.exe PID 1516 wrote to memory of 284 1516 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\PO_S32G01521.exe"C:\Users\Admin\AppData\Local\Temp\PO_S32G01521.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/284-76-0x0000000000000000-mapping.dmp
-
memory/1256-70-0x0000000005080000-0x00000000051B8000-memory.dmpFilesize
1.2MB
-
memory/1256-79-0x0000000007180000-0x00000000072D9000-memory.dmpFilesize
1.3MB
-
memory/1256-72-0x0000000007030000-0x000000000717D000-memory.dmpFilesize
1.3MB
-
memory/1516-78-0x00000000008D0000-0x000000000095F000-memory.dmpFilesize
572KB
-
memory/1516-77-0x0000000001E70000-0x0000000002173000-memory.dmpFilesize
3.0MB
-
memory/1516-74-0x0000000000A60000-0x0000000000A6D000-memory.dmpFilesize
52KB
-
memory/1516-75-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1516-73-0x0000000000000000-mapping.dmp
-
memory/1960-68-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/1960-71-0x00000000001B0000-0x00000000001C0000-memory.dmpFilesize
64KB
-
memory/1960-69-0x0000000000100000-0x0000000000110000-memory.dmpFilesize
64KB
-
memory/1960-67-0x000000000041D0D0-mapping.dmp
-
memory/1960-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2004-60-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/2004-65-0x00000000007D0000-0x00000000007FE000-memory.dmpFilesize
184KB
-
memory/2004-64-0x0000000005380000-0x00000000053F9000-memory.dmpFilesize
484KB
-
memory/2004-63-0x0000000000710000-0x0000000000712000-memory.dmpFilesize
8KB
-
memory/2004-62-0x00000000047C0000-0x00000000047C1000-memory.dmpFilesize
4KB