Analysis
-
max time kernel
149s -
max time network
189s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-07-2021 16:22
Static task
static1
Behavioral task
behavioral1
Sample
SOA.exe
Resource
win7v20210410
General
-
Target
SOA.exe
-
Size
896KB
-
MD5
23d890e7a25c8a51bfcec1939a20a7e9
-
SHA1
0193e5561521c2beac81ef0e3141fe0f93f7e9b7
-
SHA256
ddc1d5dd3d2d2a64d1d3e7586023715a1da59c30af9682843d326e0f16f12632
-
SHA512
fcb819f6537a4829b2a5d3e605370c6991bfbd189abcc8cc786ef446060e5ced93da6f38a2b4dd6477ac6ad5712ece89bae495bbfc52debb1889f0f4a69c6c8e
Malware Config
Extracted
xloader
2.3
http://www.cannabisoutletonline.com/n86i/
purpose-guide.com
averyshairco.com
blockchain-365.com
jismlmuu.icu
famosobambino.com
firstclasstruckingny.com
oracleoftheinternet.com
alliesdispatchlogistics.com
salten2.com
bfactivator.com
jgc40.com
nanninghao.com
eigorilla.info
predies.com
dmzg-cn.net
registratetexas.com
maxifina-aprovado.com
mdqqy-dliv.xyz
annurenterprise.com
dongtrunghathaovanphuc.com
fdshomes.com
tringband.com
thesawfam.com
medsbest.rest
aingus.com
carlfbrothersauthor.com
behind7.com
karigeddes.com
gteana.com
afepcfmcb.icu
bluebuilddesign.com
soliyamalimited.com
peterchengrealty.com
dearth22717.info
a-v-r.com
moybaun.com
dhaliatus.online
luxtoyou.com
dallasresidentialpainters.com
bajakubajaringan.com
writinginstructionforkids.com
cocorelaxmassage.com
evvivastocazzo.com
airpound.com
legacyazschoolagy.com
nlsapparel.com
rafsdoorservice.com
babelbuilders.com
2006almadenrd.com
emergelifelegacy.com
hanafelixart.com
magistrydev.com
grupomediaye.com
severfounsvisn.com
yhdz188.com
lisn.club
friendsofericorts.com
amoelectric1997.com
lifecover.club
blaxies3.com
kfcpx.com
vpvelguem.com
johnmabry.com
kortescab.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/468-67-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/468-68-0x000000000041D060-mapping.dmp xloader behavioral1/memory/568-77-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 616 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SOA.exeSOA.exerundll32.exedescription pid process target process PID 1304 set thread context of 468 1304 SOA.exe SOA.exe PID 468 set thread context of 1204 468 SOA.exe Explorer.EXE PID 468 set thread context of 1204 468 SOA.exe Explorer.EXE PID 568 set thread context of 1204 568 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
SOA.exerundll32.exepid process 468 SOA.exe 468 SOA.exe 468 SOA.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe 568 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
SOA.exerundll32.exepid process 468 SOA.exe 468 SOA.exe 468 SOA.exe 468 SOA.exe 568 rundll32.exe 568 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SOA.exerundll32.exedescription pid process Token: SeDebugPrivilege 468 SOA.exe Token: SeDebugPrivilege 568 rundll32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
SOA.exeExplorer.EXErundll32.exedescription pid process target process PID 1304 wrote to memory of 468 1304 SOA.exe SOA.exe PID 1304 wrote to memory of 468 1304 SOA.exe SOA.exe PID 1304 wrote to memory of 468 1304 SOA.exe SOA.exe PID 1304 wrote to memory of 468 1304 SOA.exe SOA.exe PID 1304 wrote to memory of 468 1304 SOA.exe SOA.exe PID 1304 wrote to memory of 468 1304 SOA.exe SOA.exe PID 1304 wrote to memory of 468 1304 SOA.exe SOA.exe PID 1204 wrote to memory of 568 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 568 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 568 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 568 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 568 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 568 1204 Explorer.EXE rundll32.exe PID 1204 wrote to memory of 568 1204 Explorer.EXE rundll32.exe PID 568 wrote to memory of 616 568 rundll32.exe cmd.exe PID 568 wrote to memory of 616 568 rundll32.exe cmd.exe PID 568 wrote to memory of 616 568 rundll32.exe cmd.exe PID 568 wrote to memory of 616 568 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SOA.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/468-67-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/468-68-0x000000000041D060-mapping.dmp
-
memory/468-70-0x0000000000210000-0x0000000000221000-memory.dmpFilesize
68KB
-
memory/468-69-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/468-72-0x0000000000260000-0x0000000000271000-memory.dmpFilesize
68KB
-
memory/568-74-0x0000000000000000-mapping.dmp
-
memory/568-80-0x0000000001FB0000-0x0000000002040000-memory.dmpFilesize
576KB
-
memory/568-78-0x0000000002050000-0x0000000002353000-memory.dmpFilesize
3.0MB
-
memory/568-77-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/568-76-0x0000000000AB0000-0x0000000000ABE000-memory.dmpFilesize
56KB
-
memory/568-75-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/616-79-0x0000000000000000-mapping.dmp
-
memory/1204-71-0x00000000064B0000-0x0000000006655000-memory.dmpFilesize
1.6MB
-
memory/1204-73-0x0000000004350000-0x000000000441A000-memory.dmpFilesize
808KB
-
memory/1204-81-0x0000000006ED0000-0x0000000006FC2000-memory.dmpFilesize
968KB
-
memory/1304-60-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/1304-66-0x0000000001FE0000-0x000000000200A000-memory.dmpFilesize
168KB
-
memory/1304-65-0x0000000004C60000-0x0000000004CDA000-memory.dmpFilesize
488KB
-
memory/1304-64-0x0000000000620000-0x0000000000622000-memory.dmpFilesize
8KB
-
memory/1304-63-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/1304-62-0x00000000006D0000-0x0000000000729000-memory.dmpFilesize
356KB