Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 12:37
Static task
static1
Behavioral task
behavioral1
Sample
XQFreZzaubEvXYg.exe
Resource
win7v20210408
General
-
Target
XQFreZzaubEvXYg.exe
-
Size
465KB
-
MD5
ddafa2b44ec908b114a4c33431e0952a
-
SHA1
e85c3f28cd859c6b5ab900c6a0c07a8fcfde8173
-
SHA256
4ca6a48021d7d442d9311b158691b1f219576d7d37a99f64741463659903ad4c
-
SHA512
4a3e227d44ad1cd9d6402e3bbde1ecc51196a7d8325f808bd6ba05059a6f596edf82f0ce2b359daa61267f6fcd08dc994549a6b06aec0cda1480ec14ab3efd87
Malware Config
Extracted
xloader
2.3
http://www.panyu-qqbaby.com/weni/
sdmdwang.com
konversationswithkoshie.net
carap.club
eagldeream.com
856380585.xyz
elgallocoffee.com
magetu.info
lovertons.com
theichallenge.com
advancedautorepairsonline.com
wingsstyling.info
tapdaugusta.com
wiloasbanhsgtarewdasc.solutions
donjrisdumb.com
experienceddoctor.com
cloverhillconsultants.com
underwear.show
karensgonewild2020.com
arodsr.com
thefucktardmanual.com
712kenwood.info
telecompink.com
ebizkendra.com
kitkatmp3.com
utformehagen.com
profitsnavigator.com
kathyharvey.com
tongaoffshore.com
vrpreservation.com
hy7128.com
nicolettejohnsonphotography.com
rating.travel
visualartcr.com
nationalbarista.com
lovecartoonforever.com
koimkt.com
directpractice.pro
blockchaincloud360.com
queverenbuenosaires.com
coachmyragolden.com
awree.com
facebookipl.com
rcheapwdbuy.com
trinspinsgreen.com
voxaide.com
ecorner.online
mattvickery.com
regarta.com
fknprfct.com
theessentialstore.net
sunilpsingh.com
ovtnywveba.club
optimalgafa.com
awdjob.info
humachem.com
southeasternsteakcompany.com
centerevents.net
warrenswindowcleans.co.uk
lebullterrier.com
thecxchecker.com
formerknown.com
pupbutler.com
tincanphones.com
tgeuuy.cool
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1108-124-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/1108-125-0x000000000041D000-mapping.dmp xloader behavioral2/memory/2752-131-0x0000000003370000-0x0000000003398000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
XQFreZzaubEvXYg.exeXQFreZzaubEvXYg.exewscript.exedescription pid process target process PID 3016 set thread context of 1108 3016 XQFreZzaubEvXYg.exe XQFreZzaubEvXYg.exe PID 1108 set thread context of 3036 1108 XQFreZzaubEvXYg.exe Explorer.EXE PID 2752 set thread context of 3036 2752 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
XQFreZzaubEvXYg.exeXQFreZzaubEvXYg.exewscript.exepid process 3016 XQFreZzaubEvXYg.exe 1108 XQFreZzaubEvXYg.exe 1108 XQFreZzaubEvXYg.exe 1108 XQFreZzaubEvXYg.exe 1108 XQFreZzaubEvXYg.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe 2752 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
XQFreZzaubEvXYg.exewscript.exepid process 1108 XQFreZzaubEvXYg.exe 1108 XQFreZzaubEvXYg.exe 1108 XQFreZzaubEvXYg.exe 2752 wscript.exe 2752 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
XQFreZzaubEvXYg.exeXQFreZzaubEvXYg.exewscript.exedescription pid process Token: SeDebugPrivilege 3016 XQFreZzaubEvXYg.exe Token: SeDebugPrivilege 1108 XQFreZzaubEvXYg.exe Token: SeDebugPrivilege 2752 wscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
XQFreZzaubEvXYg.exeExplorer.EXEwscript.exedescription pid process target process PID 3016 wrote to memory of 1108 3016 XQFreZzaubEvXYg.exe XQFreZzaubEvXYg.exe PID 3016 wrote to memory of 1108 3016 XQFreZzaubEvXYg.exe XQFreZzaubEvXYg.exe PID 3016 wrote to memory of 1108 3016 XQFreZzaubEvXYg.exe XQFreZzaubEvXYg.exe PID 3016 wrote to memory of 1108 3016 XQFreZzaubEvXYg.exe XQFreZzaubEvXYg.exe PID 3016 wrote to memory of 1108 3016 XQFreZzaubEvXYg.exe XQFreZzaubEvXYg.exe PID 3016 wrote to memory of 1108 3016 XQFreZzaubEvXYg.exe XQFreZzaubEvXYg.exe PID 3036 wrote to memory of 2752 3036 Explorer.EXE wscript.exe PID 3036 wrote to memory of 2752 3036 Explorer.EXE wscript.exe PID 3036 wrote to memory of 2752 3036 Explorer.EXE wscript.exe PID 2752 wrote to memory of 2208 2752 wscript.exe cmd.exe PID 2752 wrote to memory of 2208 2752 wscript.exe cmd.exe PID 2752 wrote to memory of 2208 2752 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XQFreZzaubEvXYg.exe"C:\Users\Admin\AppData\Local\Temp\XQFreZzaubEvXYg.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\XQFreZzaubEvXYg.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\XQFreZzaubEvXYg.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1108-124-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1108-126-0x0000000001000000-0x0000000001320000-memory.dmpFilesize
3.1MB
-
memory/1108-127-0x00000000007F0000-0x0000000000800000-memory.dmpFilesize
64KB
-
memory/1108-125-0x000000000041D000-mapping.dmp
-
memory/2208-132-0x0000000000000000-mapping.dmp
-
memory/2752-130-0x0000000000210000-0x0000000000237000-memory.dmpFilesize
156KB
-
memory/2752-129-0x0000000000000000-mapping.dmp
-
memory/2752-134-0x0000000004DD0000-0x0000000004E5F000-memory.dmpFilesize
572KB
-
memory/2752-133-0x0000000004A20000-0x0000000004D40000-memory.dmpFilesize
3.1MB
-
memory/2752-131-0x0000000003370000-0x0000000003398000-memory.dmpFilesize
160KB
-
memory/3016-117-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/3016-118-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/3016-121-0x00000000071B0000-0x00000000071B1000-memory.dmpFilesize
4KB
-
memory/3016-119-0x0000000004E50000-0x000000000534E000-memory.dmpFilesize
5.0MB
-
memory/3016-114-0x0000000000420000-0x0000000000421000-memory.dmpFilesize
4KB
-
memory/3016-120-0x0000000004E20000-0x0000000004E22000-memory.dmpFilesize
8KB
-
memory/3016-116-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/3016-123-0x00000000069D0000-0x00000000069FE000-memory.dmpFilesize
184KB
-
memory/3016-122-0x0000000006A50000-0x0000000006ACD000-memory.dmpFilesize
500KB
-
memory/3036-128-0x0000000005A30000-0x0000000005BD2000-memory.dmpFilesize
1.6MB
-
memory/3036-135-0x0000000005F20000-0x000000000607A000-memory.dmpFilesize
1.4MB