Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 13:12
Static task
static1
Behavioral task
behavioral1
Sample
PO_098765.exe
Resource
win7v20210408
General
-
Target
PO_098765.exe
-
Size
626KB
-
MD5
564508cbfae2c08aec669e47219f9b00
-
SHA1
36f867db04e9f8a9c9b585df26ba1f4391a0ccbf
-
SHA256
f27c4430f40881602df511b48cd0704e0c4050a0ef1d8f0b920f8b7d0da77b96
-
SHA512
c35b9bc7a6662d52d570a9fcf6f825603d72471375f25598d1dd0112312c729cca0fb3089bedbb84678215e8f8a4c9770af3933aa40133edd90957e8ba36c7b4
Malware Config
Extracted
xloader
2.3
http://www.bodymoisturizer.online/q4kr/
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2644-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2644-125-0x000000000041D0D0-mapping.dmp xloader behavioral2/memory/1524-132-0x0000000000AD0000-0x0000000000AF9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO_098765.exeRegSvcs.exechkdsk.exedescription pid process target process PID 3984 set thread context of 2644 3984 PO_098765.exe RegSvcs.exe PID 2644 set thread context of 3008 2644 RegSvcs.exe Explorer.EXE PID 1524 set thread context of 3008 1524 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
PO_098765.exeRegSvcs.exechkdsk.exepid process 3984 PO_098765.exe 3984 PO_098765.exe 3984 PO_098765.exe 2644 RegSvcs.exe 2644 RegSvcs.exe 2644 RegSvcs.exe 2644 RegSvcs.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe 1524 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exechkdsk.exepid process 2644 RegSvcs.exe 2644 RegSvcs.exe 2644 RegSvcs.exe 1524 chkdsk.exe 1524 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO_098765.exeRegSvcs.exechkdsk.exedescription pid process Token: SeDebugPrivilege 3984 PO_098765.exe Token: SeDebugPrivilege 2644 RegSvcs.exe Token: SeDebugPrivilege 1524 chkdsk.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PO_098765.exeExplorer.EXEchkdsk.exedescription pid process target process PID 3984 wrote to memory of 3992 3984 PO_098765.exe RegSvcs.exe PID 3984 wrote to memory of 3992 3984 PO_098765.exe RegSvcs.exe PID 3984 wrote to memory of 3992 3984 PO_098765.exe RegSvcs.exe PID 3984 wrote to memory of 2644 3984 PO_098765.exe RegSvcs.exe PID 3984 wrote to memory of 2644 3984 PO_098765.exe RegSvcs.exe PID 3984 wrote to memory of 2644 3984 PO_098765.exe RegSvcs.exe PID 3984 wrote to memory of 2644 3984 PO_098765.exe RegSvcs.exe PID 3984 wrote to memory of 2644 3984 PO_098765.exe RegSvcs.exe PID 3984 wrote to memory of 2644 3984 PO_098765.exe RegSvcs.exe PID 3008 wrote to memory of 1524 3008 Explorer.EXE chkdsk.exe PID 3008 wrote to memory of 1524 3008 Explorer.EXE chkdsk.exe PID 3008 wrote to memory of 1524 3008 Explorer.EXE chkdsk.exe PID 1524 wrote to memory of 2072 1524 chkdsk.exe cmd.exe PID 1524 wrote to memory of 2072 1524 chkdsk.exe cmd.exe PID 1524 wrote to memory of 2072 1524 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_098765.exe"C:\Users\Admin\AppData\Local\Temp\PO_098765.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1524-129-0x0000000000000000-mapping.dmp
-
memory/1524-134-0x00000000050A0000-0x000000000512F000-memory.dmpFilesize
572KB
-
memory/1524-133-0x0000000004CB0000-0x0000000004DFA000-memory.dmpFilesize
1.3MB
-
memory/1524-132-0x0000000000AD0000-0x0000000000AF9000-memory.dmpFilesize
164KB
-
memory/1524-131-0x0000000000CA0000-0x0000000000CAA000-memory.dmpFilesize
40KB
-
memory/2072-130-0x0000000000000000-mapping.dmp
-
memory/2644-125-0x000000000041D0D0-mapping.dmp
-
memory/2644-126-0x00000000019F0000-0x0000000001D10000-memory.dmpFilesize
3.1MB
-
memory/2644-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2644-127-0x0000000001400000-0x0000000001410000-memory.dmpFilesize
64KB
-
memory/3008-135-0x0000000002CA0000-0x0000000002D64000-memory.dmpFilesize
784KB
-
memory/3008-128-0x00000000053A0000-0x000000000551B000-memory.dmpFilesize
1.5MB
-
memory/3984-114-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/3984-122-0x0000000006D10000-0x0000000006D8F000-memory.dmpFilesize
508KB
-
memory/3984-121-0x0000000008620000-0x0000000008621000-memory.dmpFilesize
4KB
-
memory/3984-120-0x0000000005620000-0x0000000005622000-memory.dmpFilesize
8KB
-
memory/3984-119-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/3984-118-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/3984-117-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/3984-116-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/3984-123-0x0000000006C40000-0x0000000006C70000-memory.dmpFilesize
192KB