Analysis
-
max time kernel
147s -
max time network
197s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-07-2021 13:05
Static task
static1
Behavioral task
behavioral1
Sample
Instruction copy.exe
Resource
win7v20210408
General
-
Target
Instruction copy.exe
-
Size
960KB
-
MD5
f91a66d080744b9e8b946984d6d747c4
-
SHA1
886580b7e7d7f27135d2c9981770a2a59332e680
-
SHA256
c6a1a1a68b5faac43930deeab9cd6745bde62869786e21e0681b3dc0973afa80
-
SHA512
b559c9048de556c45f77e26d4c2f1c7785348b76ae4d5f9957e202a5c9d01e7c68a1a3958aeede45ff427ad741b01fcd15497e67898acfc5176f9ac9aa1e2238
Malware Config
Extracted
xloader
2.3
http://www.inverservi.com/m6b5/
ixtarbelize.com
pheamal.com
daiyncc.com
staydoubted.com
laagerlitigation.club
sukrantastansakarya.com
esupport.ltd
vetscontracting.net
themuslimlife.coach
salmanairs.com
somatictherapyservices.com
lastminuteminister.com
comunicarbuenosaires.com
kazuya.tech
insightlyservicedev.com
redevelopment38subhashnagar.com
thefutureinvestor.com
simplysu.com
lagu45.com
livingstonpistolpermit.com
youngedbg.club
askmeboost.com
hizmetbasvuru-girisi.com
fourteenfoodsdq.net
discoglosse.com
shareusall.com
armseducationassociates.com
twilio123.com
hofmann.red
autoanyway.com
duckvlog.com
raceleagues.com
foleyautomotivehydraulics.com
foreverbefaithfultoyou.com
junrui-tech.com
angelinateofilovic.com
justinandsarahgetmarried.com
carlsmithcarlsmith.com
novopeugeot208.com
citestftcwaut17.com
theproductivitygroup.com
cohen-asset.com
trumpismysugardaddy.com
wishcida.com
buncheese.com
dietrichcompanies.com
zafav.xyz
commodore-gravel.com
juport.men
hyanggips.com
aliyunwangpan.com
nuturessoap.com
networksloss.club
blackcouplesofhtown.com
saadiawhite.net
girasmboize.com
melissabelmontefotografias.com
landprorentals.com
bonacrypto.com
meeuba.com
lknstump.com
iregentos.info
linguisticpartner.com
mpsaklera.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/468-64-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/468-65-0x000000000041D0F0-mapping.dmp xloader behavioral1/memory/1712-71-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 516 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Instruction copy.exeInstruction copy.exesystray.exedescription pid process target process PID 1188 set thread context of 468 1188 Instruction copy.exe Instruction copy.exe PID 468 set thread context of 1196 468 Instruction copy.exe Explorer.EXE PID 1712 set thread context of 1196 1712 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
Instruction copy.exeInstruction copy.exesystray.exepid process 1188 Instruction copy.exe 1188 Instruction copy.exe 1188 Instruction copy.exe 1188 Instruction copy.exe 468 Instruction copy.exe 468 Instruction copy.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe 1712 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Instruction copy.exesystray.exepid process 468 Instruction copy.exe 468 Instruction copy.exe 468 Instruction copy.exe 1712 systray.exe 1712 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Instruction copy.exeInstruction copy.exesystray.exedescription pid process Token: SeDebugPrivilege 1188 Instruction copy.exe Token: SeDebugPrivilege 468 Instruction copy.exe Token: SeDebugPrivilege 1712 systray.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Instruction copy.exeExplorer.EXEsystray.exedescription pid process target process PID 1188 wrote to memory of 336 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 336 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 336 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 336 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 656 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 656 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 656 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 656 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 468 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 468 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 468 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 468 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 468 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 468 1188 Instruction copy.exe Instruction copy.exe PID 1188 wrote to memory of 468 1188 Instruction copy.exe Instruction copy.exe PID 1196 wrote to memory of 1712 1196 Explorer.EXE systray.exe PID 1196 wrote to memory of 1712 1196 Explorer.EXE systray.exe PID 1196 wrote to memory of 1712 1196 Explorer.EXE systray.exe PID 1196 wrote to memory of 1712 1196 Explorer.EXE systray.exe PID 1712 wrote to memory of 516 1712 systray.exe cmd.exe PID 1712 wrote to memory of 516 1712 systray.exe cmd.exe PID 1712 wrote to memory of 516 1712 systray.exe cmd.exe PID 1712 wrote to memory of 516 1712 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Instruction copy.exe"C:\Users\Admin\AppData\Local\Temp\Instruction copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Instruction copy.exe"C:\Users\Admin\AppData\Local\Temp\Instruction copy.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Instruction copy.exe"C:\Users\Admin\AppData\Local\Temp\Instruction copy.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Instruction copy.exe"C:\Users\Admin\AppData\Local\Temp\Instruction copy.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Instruction copy.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/468-64-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/468-65-0x000000000041D0F0-mapping.dmp
-
memory/468-67-0x00000000000B0000-0x00000000000C0000-memory.dmpFilesize
64KB
-
memory/468-66-0x00000000009F0000-0x0000000000CF3000-memory.dmpFilesize
3.0MB
-
memory/516-73-0x0000000000000000-mapping.dmp
-
memory/1188-61-0x0000000000560000-0x00000000005DB000-memory.dmpFilesize
492KB
-
memory/1188-62-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/1188-63-0x0000000000540000-0x000000000054F000-memory.dmpFilesize
60KB
-
memory/1188-59-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/1196-68-0x0000000003D00000-0x0000000003DC8000-memory.dmpFilesize
800KB
-
memory/1196-75-0x0000000004A30000-0x0000000004B2B000-memory.dmpFilesize
1004KB
-
memory/1712-71-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/1712-72-0x0000000001F30000-0x0000000002233000-memory.dmpFilesize
3.0MB
-
memory/1712-70-0x0000000000990000-0x0000000000995000-memory.dmpFilesize
20KB
-
memory/1712-69-0x0000000000000000-mapping.dmp
-
memory/1712-74-0x0000000001DA0000-0x0000000001E2F000-memory.dmpFilesize
572KB
-
memory/1712-76-0x0000000075AD1000-0x0000000075AD3000-memory.dmpFilesize
8KB