Analysis
-
max time kernel
151s -
max time network
173s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-07-2021 12:41
Static task
static1
General
-
Target
PO_S32G01521.exe
-
Size
450KB
-
MD5
7c67d687aa9d574fcea531bda2eda1da
-
SHA1
9ca303e862a7d00d2768abcf83211fceb72e836c
-
SHA256
44810a90a17a6d1286bdd1862a82c7062371ccece40cbd8e22dce7028e011825
-
SHA512
55ad7074da83ff222622fad62e2f657d7c888d7ed2398346c9e897ac77d8f5f275513eeb11e82081242fb3c17d7f1eb739e024ff617dd1d0f4ed4d78d8859b6a
Malware Config
Extracted
xloader
2.3
http://www.bodymoisturizer.online/q4kr/
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1324-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1324-67-0x000000000041D0D0-mapping.dmp xloader behavioral1/memory/1896-75-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PO_S32G01521.exeRegSvcs.exechkdsk.exedescription pid process target process PID 1036 set thread context of 1324 1036 PO_S32G01521.exe RegSvcs.exe PID 1324 set thread context of 1208 1324 RegSvcs.exe Explorer.EXE PID 1324 set thread context of 1208 1324 RegSvcs.exe Explorer.EXE PID 1896 set thread context of 1208 1896 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
PO_S32G01521.exeRegSvcs.exechkdsk.exepid process 1036 PO_S32G01521.exe 1036 PO_S32G01521.exe 1036 PO_S32G01521.exe 1036 PO_S32G01521.exe 1036 PO_S32G01521.exe 1324 RegSvcs.exe 1324 RegSvcs.exe 1324 RegSvcs.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exechkdsk.exepid process 1324 RegSvcs.exe 1324 RegSvcs.exe 1324 RegSvcs.exe 1324 RegSvcs.exe 1896 chkdsk.exe 1896 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO_S32G01521.exeRegSvcs.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1036 PO_S32G01521.exe Token: SeDebugPrivilege 1324 RegSvcs.exe Token: SeDebugPrivilege 1896 chkdsk.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
PO_S32G01521.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1036 wrote to memory of 1468 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1468 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1468 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1468 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1468 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1468 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1468 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1276 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1276 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1276 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1276 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1276 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1276 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1276 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1324 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1324 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1324 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1324 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1324 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1324 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1324 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1324 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1324 1036 PO_S32G01521.exe RegSvcs.exe PID 1036 wrote to memory of 1324 1036 PO_S32G01521.exe RegSvcs.exe PID 1208 wrote to memory of 1896 1208 Explorer.EXE chkdsk.exe PID 1208 wrote to memory of 1896 1208 Explorer.EXE chkdsk.exe PID 1208 wrote to memory of 1896 1208 Explorer.EXE chkdsk.exe PID 1208 wrote to memory of 1896 1208 Explorer.EXE chkdsk.exe PID 1896 wrote to memory of 1476 1896 chkdsk.exe cmd.exe PID 1896 wrote to memory of 1476 1896 chkdsk.exe cmd.exe PID 1896 wrote to memory of 1476 1896 chkdsk.exe cmd.exe PID 1896 wrote to memory of 1476 1896 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_S32G01521.exe"C:\Users\Admin\AppData\Local\Temp\PO_S32G01521.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1036-62-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/1036-63-0x0000000000490000-0x0000000000492000-memory.dmpFilesize
8KB
-
memory/1036-64-0x0000000004F10000-0x0000000004F89000-memory.dmpFilesize
484KB
-
memory/1036-65-0x00000000009C0000-0x00000000009EE000-memory.dmpFilesize
184KB
-
memory/1036-60-0x00000000011B0000-0x00000000011B1000-memory.dmpFilesize
4KB
-
memory/1208-70-0x0000000003F10000-0x000000000401A000-memory.dmpFilesize
1.0MB
-
memory/1208-79-0x0000000004B80000-0x0000000004C75000-memory.dmpFilesize
980KB
-
memory/1208-72-0x00000000075E0000-0x0000000007782000-memory.dmpFilesize
1.6MB
-
memory/1324-71-0x00000000002B0000-0x00000000002C0000-memory.dmpFilesize
64KB
-
memory/1324-68-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/1324-69-0x0000000000170000-0x0000000000180000-memory.dmpFilesize
64KB
-
memory/1324-67-0x000000000041D0D0-mapping.dmp
-
memory/1324-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1476-76-0x0000000000000000-mapping.dmp
-
memory/1896-73-0x0000000000000000-mapping.dmp
-
memory/1896-74-0x0000000000020000-0x0000000000027000-memory.dmpFilesize
28KB
-
memory/1896-75-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/1896-77-0x0000000001F00000-0x0000000002203000-memory.dmpFilesize
3.0MB
-
memory/1896-78-0x0000000001D30000-0x0000000001DBF000-memory.dmpFilesize
572KB
-
memory/1896-80-0x00000000750C1000-0x00000000750C3000-memory.dmpFilesize
8KB