Analysis
-
max time kernel
149s -
max time network
173s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
28-07-2021 00:02
Static task
static1
Behavioral task
behavioral1
Sample
PO_9756-NMNBVC.exe
Resource
win7v20210410
General
-
Target
PO_9756-NMNBVC.exe
-
Size
871KB
-
MD5
9a649c1d193d55ef7f66e59b8294f24d
-
SHA1
e4c00ec807de5111c061ebc5d8421fe0d0114fc8
-
SHA256
04657288f9e931379d2c526330b23310c8bb26d65a209a2ebca5fb089b91efe3
-
SHA512
37fec35bf1cdae3560dc6e1503320f628d70f7a701135253412340afb84101f4ed444cb243143febbae6983969c1fe0e7e7a528fcd1aadcb7a8f08150130d4b5
Malware Config
Extracted
xloader
2.3
http://www.bodymoisturizer.online/q4kr/
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1356-65-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1356-66-0x000000000041D0D0-mapping.dmp xloader behavioral1/memory/472-74-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO_9756-NMNBVC.exeRegSvcs.exeraserver.exedescription pid process target process PID 916 set thread context of 1356 916 PO_9756-NMNBVC.exe RegSvcs.exe PID 1356 set thread context of 1208 1356 RegSvcs.exe Explorer.EXE PID 472 set thread context of 1208 472 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
PO_9756-NMNBVC.exeRegSvcs.exeraserver.exepid process 916 PO_9756-NMNBVC.exe 1356 RegSvcs.exe 1356 RegSvcs.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe 472 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeraserver.exepid process 1356 RegSvcs.exe 1356 RegSvcs.exe 1356 RegSvcs.exe 472 raserver.exe 472 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO_9756-NMNBVC.exeRegSvcs.exeraserver.exedescription pid process Token: SeDebugPrivilege 916 PO_9756-NMNBVC.exe Token: SeDebugPrivilege 1356 RegSvcs.exe Token: SeDebugPrivilege 472 raserver.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
PO_9756-NMNBVC.exeExplorer.EXEraserver.exedescription pid process target process PID 916 wrote to memory of 1356 916 PO_9756-NMNBVC.exe RegSvcs.exe PID 916 wrote to memory of 1356 916 PO_9756-NMNBVC.exe RegSvcs.exe PID 916 wrote to memory of 1356 916 PO_9756-NMNBVC.exe RegSvcs.exe PID 916 wrote to memory of 1356 916 PO_9756-NMNBVC.exe RegSvcs.exe PID 916 wrote to memory of 1356 916 PO_9756-NMNBVC.exe RegSvcs.exe PID 916 wrote to memory of 1356 916 PO_9756-NMNBVC.exe RegSvcs.exe PID 916 wrote to memory of 1356 916 PO_9756-NMNBVC.exe RegSvcs.exe PID 916 wrote to memory of 1356 916 PO_9756-NMNBVC.exe RegSvcs.exe PID 916 wrote to memory of 1356 916 PO_9756-NMNBVC.exe RegSvcs.exe PID 916 wrote to memory of 1356 916 PO_9756-NMNBVC.exe RegSvcs.exe PID 1208 wrote to memory of 472 1208 Explorer.EXE raserver.exe PID 1208 wrote to memory of 472 1208 Explorer.EXE raserver.exe PID 1208 wrote to memory of 472 1208 Explorer.EXE raserver.exe PID 1208 wrote to memory of 472 1208 Explorer.EXE raserver.exe PID 472 wrote to memory of 572 472 raserver.exe cmd.exe PID 472 wrote to memory of 572 472 raserver.exe cmd.exe PID 472 wrote to memory of 572 472 raserver.exe cmd.exe PID 472 wrote to memory of 572 472 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_9756-NMNBVC.exe"C:\Users\Admin\AppData\Local\Temp\PO_9756-NMNBVC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/472-70-0x0000000000000000-mapping.dmp
-
memory/472-76-0x00000000008A0000-0x000000000092F000-memory.dmpFilesize
572KB
-
memory/472-75-0x0000000001F40000-0x0000000002243000-memory.dmpFilesize
3.0MB
-
memory/472-74-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/472-73-0x0000000000990000-0x00000000009AC000-memory.dmpFilesize
112KB
-
memory/472-71-0x0000000075011000-0x0000000075013000-memory.dmpFilesize
8KB
-
memory/572-72-0x0000000000000000-mapping.dmp
-
memory/916-64-0x0000000004F00000-0x0000000004F6D000-memory.dmpFilesize
436KB
-
memory/916-59-0x00000000011A0000-0x00000000011A1000-memory.dmpFilesize
4KB
-
memory/916-63-0x0000000005C40000-0x0000000005CFB000-memory.dmpFilesize
748KB
-
memory/916-62-0x0000000000320000-0x0000000000322000-memory.dmpFilesize
8KB
-
memory/916-61-0x0000000000450000-0x0000000000451000-memory.dmpFilesize
4KB
-
memory/1208-69-0x0000000004B00000-0x0000000004C01000-memory.dmpFilesize
1.0MB
-
memory/1208-77-0x0000000006C10000-0x0000000006D2C000-memory.dmpFilesize
1.1MB
-
memory/1356-68-0x0000000000090000-0x00000000000A0000-memory.dmpFilesize
64KB
-
memory/1356-67-0x0000000000AC0000-0x0000000000DC3000-memory.dmpFilesize
3.0MB
-
memory/1356-66-0x000000000041D0D0-mapping.dmp
-
memory/1356-65-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB