Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 08:27
Static task
static1
Behavioral task
behavioral1
Sample
Inv_7623980.exe
Resource
win7v20210408
General
-
Target
Inv_7623980.exe
-
Size
1.1MB
-
MD5
24de383154bbdc31b305fd25a3ee95db
-
SHA1
7d3be8631affd24746beeec725b4ad0d518805b8
-
SHA256
790898f9518c146e7ffa430b975ee0f5bc162b6b5a5dba008e0572741312bc19
-
SHA512
7dee6bb2ca1996706c59cab95575200b3273bc2e110d9514527d8b5cda4d33bb65a9bf12a7c015568e16a8646cbd5e7df0f71321708ed60de884822cc4855090
Malware Config
Extracted
xloader
2.3
http://www.inverservi.com/m6b5/
ixtarbelize.com
pheamal.com
daiyncc.com
staydoubted.com
laagerlitigation.club
sukrantastansakarya.com
esupport.ltd
vetscontracting.net
themuslimlife.coach
salmanairs.com
somatictherapyservices.com
lastminuteminister.com
comunicarbuenosaires.com
kazuya.tech
insightlyservicedev.com
redevelopment38subhashnagar.com
thefutureinvestor.com
simplysu.com
lagu45.com
livingstonpistolpermit.com
youngedbg.club
askmeboost.com
hizmetbasvuru-girisi.com
fourteenfoodsdq.net
discoglosse.com
shareusall.com
armseducationassociates.com
twilio123.com
hofmann.red
autoanyway.com
duckvlog.com
raceleagues.com
foleyautomotivehydraulics.com
foreverbefaithfultoyou.com
junrui-tech.com
angelinateofilovic.com
justinandsarahgetmarried.com
carlsmithcarlsmith.com
novopeugeot208.com
citestftcwaut17.com
theproductivitygroup.com
cohen-asset.com
trumpismysugardaddy.com
wishcida.com
buncheese.com
dietrichcompanies.com
zafav.xyz
commodore-gravel.com
juport.men
hyanggips.com
aliyunwangpan.com
nuturessoap.com
networksloss.club
blackcouplesofhtown.com
saadiawhite.net
girasmboize.com
melissabelmontefotografias.com
landprorentals.com
bonacrypto.com
meeuba.com
lknstump.com
iregentos.info
linguisticpartner.com
mpsaklera.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/5108-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/5108-125-0x000000000041D0F0-mapping.dmp xloader behavioral2/memory/4028-131-0x0000000003000000-0x0000000003029000-memory.dmp xloader behavioral2/memory/4028-133-0x0000000003030000-0x00000000030DE000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Inv_7623980.exeInv_7623980.exehelp.exedescription pid process target process PID 4444 set thread context of 5108 4444 Inv_7623980.exe Inv_7623980.exe PID 5108 set thread context of 3008 5108 Inv_7623980.exe Explorer.EXE PID 4028 set thread context of 3008 4028 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Inv_7623980.exeInv_7623980.exehelp.exepid process 4444 Inv_7623980.exe 4444 Inv_7623980.exe 5108 Inv_7623980.exe 5108 Inv_7623980.exe 5108 Inv_7623980.exe 5108 Inv_7623980.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe 4028 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Inv_7623980.exehelp.exepid process 5108 Inv_7623980.exe 5108 Inv_7623980.exe 5108 Inv_7623980.exe 4028 help.exe 4028 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Inv_7623980.exeInv_7623980.exehelp.exedescription pid process Token: SeDebugPrivilege 4444 Inv_7623980.exe Token: SeDebugPrivilege 5108 Inv_7623980.exe Token: SeDebugPrivilege 4028 help.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Inv_7623980.exeExplorer.EXEhelp.exedescription pid process target process PID 4444 wrote to memory of 5096 4444 Inv_7623980.exe Inv_7623980.exe PID 4444 wrote to memory of 5096 4444 Inv_7623980.exe Inv_7623980.exe PID 4444 wrote to memory of 5096 4444 Inv_7623980.exe Inv_7623980.exe PID 4444 wrote to memory of 5108 4444 Inv_7623980.exe Inv_7623980.exe PID 4444 wrote to memory of 5108 4444 Inv_7623980.exe Inv_7623980.exe PID 4444 wrote to memory of 5108 4444 Inv_7623980.exe Inv_7623980.exe PID 4444 wrote to memory of 5108 4444 Inv_7623980.exe Inv_7623980.exe PID 4444 wrote to memory of 5108 4444 Inv_7623980.exe Inv_7623980.exe PID 4444 wrote to memory of 5108 4444 Inv_7623980.exe Inv_7623980.exe PID 3008 wrote to memory of 4028 3008 Explorer.EXE help.exe PID 3008 wrote to memory of 4028 3008 Explorer.EXE help.exe PID 3008 wrote to memory of 4028 3008 Explorer.EXE help.exe PID 4028 wrote to memory of 4044 4028 help.exe cmd.exe PID 4028 wrote to memory of 4044 4028 help.exe cmd.exe PID 4028 wrote to memory of 4044 4028 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inv_7623980.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3008-128-0x0000000004BB0000-0x0000000004CBC000-memory.dmpFilesize
1.0MB
-
memory/3008-135-0x0000000004CC0000-0x0000000004DFF000-memory.dmpFilesize
1.2MB
-
memory/4028-134-0x00000000034E0000-0x000000000356F000-memory.dmpFilesize
572KB
-
memory/4028-133-0x0000000003030000-0x00000000030DE000-memory.dmpFilesize
696KB
-
memory/4028-130-0x0000000000230000-0x0000000000237000-memory.dmpFilesize
28KB
-
memory/4028-131-0x0000000003000000-0x0000000003029000-memory.dmpFilesize
164KB
-
memory/4028-129-0x0000000000000000-mapping.dmp
-
memory/4044-132-0x0000000000000000-mapping.dmp
-
memory/4444-120-0x00000000057F0000-0x0000000005CEE000-memory.dmpFilesize
5.0MB
-
memory/4444-123-0x00000000056A0000-0x00000000056AF000-memory.dmpFilesize
60KB
-
memory/4444-122-0x0000000005930000-0x00000000059AB000-memory.dmpFilesize
492KB
-
memory/4444-121-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/4444-114-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/4444-119-0x0000000005870000-0x0000000005871000-memory.dmpFilesize
4KB
-
memory/4444-118-0x00000000057F0000-0x00000000057F1000-memory.dmpFilesize
4KB
-
memory/4444-117-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/4444-116-0x0000000005CF0000-0x0000000005CF1000-memory.dmpFilesize
4KB
-
memory/5108-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/5108-125-0x000000000041D0F0-mapping.dmp
-
memory/5108-126-0x0000000001580000-0x00000000018A0000-memory.dmpFilesize
3.1MB
-
memory/5108-127-0x0000000000FC0000-0x000000000106E000-memory.dmpFilesize
696KB