Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
28-07-2021 00:02
Static task
static1
Behavioral task
behavioral1
Sample
PO_9756-NMNBVC.exe
Resource
win7v20210410
General
-
Target
PO_9756-NMNBVC.exe
-
Size
871KB
-
MD5
9a649c1d193d55ef7f66e59b8294f24d
-
SHA1
e4c00ec807de5111c061ebc5d8421fe0d0114fc8
-
SHA256
04657288f9e931379d2c526330b23310c8bb26d65a209a2ebca5fb089b91efe3
-
SHA512
37fec35bf1cdae3560dc6e1503320f628d70f7a701135253412340afb84101f4ed444cb243143febbae6983969c1fe0e7e7a528fcd1aadcb7a8f08150130d4b5
Malware Config
Extracted
xloader
2.3
http://www.bodymoisturizer.online/q4kr/
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4040-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4040-125-0x000000000041D0D0-mapping.dmp xloader behavioral2/memory/1484-131-0x00000000031B0000-0x00000000031D9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO_9756-NMNBVC.exeRegSvcs.exenetsh.exedescription pid process target process PID 2988 set thread context of 4040 2988 PO_9756-NMNBVC.exe RegSvcs.exe PID 4040 set thread context of 3020 4040 RegSvcs.exe Explorer.EXE PID 1484 set thread context of 3020 1484 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
PO_9756-NMNBVC.exeRegSvcs.exenetsh.exepid process 2988 PO_9756-NMNBVC.exe 4040 RegSvcs.exe 4040 RegSvcs.exe 4040 RegSvcs.exe 4040 RegSvcs.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe 1484 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exenetsh.exepid process 4040 RegSvcs.exe 4040 RegSvcs.exe 4040 RegSvcs.exe 1484 netsh.exe 1484 netsh.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PO_9756-NMNBVC.exeRegSvcs.exenetsh.exedescription pid process Token: SeDebugPrivilege 2988 PO_9756-NMNBVC.exe Token: SeDebugPrivilege 4040 RegSvcs.exe Token: SeDebugPrivilege 1484 netsh.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO_9756-NMNBVC.exeExplorer.EXEnetsh.exedescription pid process target process PID 2988 wrote to memory of 4040 2988 PO_9756-NMNBVC.exe RegSvcs.exe PID 2988 wrote to memory of 4040 2988 PO_9756-NMNBVC.exe RegSvcs.exe PID 2988 wrote to memory of 4040 2988 PO_9756-NMNBVC.exe RegSvcs.exe PID 2988 wrote to memory of 4040 2988 PO_9756-NMNBVC.exe RegSvcs.exe PID 2988 wrote to memory of 4040 2988 PO_9756-NMNBVC.exe RegSvcs.exe PID 2988 wrote to memory of 4040 2988 PO_9756-NMNBVC.exe RegSvcs.exe PID 3020 wrote to memory of 1484 3020 Explorer.EXE netsh.exe PID 3020 wrote to memory of 1484 3020 Explorer.EXE netsh.exe PID 3020 wrote to memory of 1484 3020 Explorer.EXE netsh.exe PID 1484 wrote to memory of 3044 1484 netsh.exe cmd.exe PID 1484 wrote to memory of 3044 1484 netsh.exe cmd.exe PID 1484 wrote to memory of 3044 1484 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_9756-NMNBVC.exe"C:\Users\Admin\AppData\Local\Temp\PO_9756-NMNBVC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1484-129-0x0000000000000000-mapping.dmp
-
memory/1484-134-0x0000000003A30000-0x0000000003ABF000-memory.dmpFilesize
572KB
-
memory/1484-130-0x0000000001050000-0x000000000106E000-memory.dmpFilesize
120KB
-
memory/1484-132-0x0000000003680000-0x00000000039A0000-memory.dmpFilesize
3.1MB
-
memory/1484-131-0x00000000031B0000-0x00000000031D9000-memory.dmpFilesize
164KB
-
memory/2988-120-0x0000000005B80000-0x0000000005B82000-memory.dmpFilesize
8KB
-
memory/2988-117-0x0000000005860000-0x0000000005861000-memory.dmpFilesize
4KB
-
memory/2988-122-0x00000000073A0000-0x000000000745B000-memory.dmpFilesize
748KB
-
memory/2988-123-0x0000000007460000-0x00000000074CD000-memory.dmpFilesize
436KB
-
memory/2988-121-0x0000000008DC0000-0x0000000008DC1000-memory.dmpFilesize
4KB
-
memory/2988-116-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB
-
memory/2988-114-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/2988-119-0x0000000005780000-0x0000000005C7E000-memory.dmpFilesize
5.0MB
-
memory/2988-118-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/3020-135-0x0000000005D10000-0x0000000005E68000-memory.dmpFilesize
1.3MB
-
memory/3020-128-0x0000000002420000-0x000000000250D000-memory.dmpFilesize
948KB
-
memory/3044-133-0x0000000000000000-mapping.dmp
-
memory/4040-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4040-126-0x00000000016F0000-0x0000000001A10000-memory.dmpFilesize
3.1MB
-
memory/4040-127-0x0000000001170000-0x0000000001180000-memory.dmpFilesize
64KB
-
memory/4040-125-0x000000000041D0D0-mapping.dmp