Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
28-07-2021 04:00
Static task
static1
Behavioral task
behavioral1
Sample
D3ccF8FfwAXrqsU.exe
Resource
win7v20210408
General
-
Target
D3ccF8FfwAXrqsU.exe
-
Size
1.3MB
-
MD5
e1c803b57cb1c949b037251a3dbf7d7d
-
SHA1
efeaac6997f56acb90ed2d28bbcb66929b2002a8
-
SHA256
5accccfe8695d78110cc9c27d79d56ac280879a0d874bb46c42c2a8baf7fe972
-
SHA512
fa6a275fc96ff89570b0186a43a3ffddb4a8af49fe50a8cd8698088713fb66764721f7e2cd5d2fce7345fb07b9a68c6a5df89980228ce20a3056b74ec52b909e
Malware Config
Extracted
xloader
2.3
http://www.designsbynandini.com/fznn/
petmarketsolutions.com
themummymarketplace.com
themidnightcollectivepdx.com
detoxshake.site
ross76.com
tom-tours2020.com
domoservis.com
allcombuildingsvc.com
padelshop.online
wosaying.com
heafg.com
inglesbrasileiro.com
santaclausonline.net
voiceofmagic.com
lafayettelc.com
communal-sleeve.net
extremecouponing.online
mypomate.com
rtdrillbit.com
therealtortaylor.com
yiyft.com
step-shoes.xyz
500brickellcondos.com
sserignou.com
rosiesmixologybartendingllc.com
savealotswfl.com
magetu.info
airboatcolombia.com
geezop.com
dadaoliangpi.com
jane-woolrich.net
detroit3dp.com
masonandmadyn.com
tformit.com
reyting-foreks.com
faszination-wetter.com
haneul.life
sweetiefilms.com
sellmyhomequicktampa.com
jvxez.com
laurawiercinska.com
demoattorney.com
clc-24.com
corruptoefrenmartinez.com
cosmicgeneralstore.com
nobel.ink
officeactivate.xyz
beevenomoil.com
1ow.life
kamilahtomlinson.com
xnr-market.com
interactivecommons.com
tonyjmarketinghelp.com
creativinet.com
aiministor.com
lavishladys.com
kingzrus.com
9066985.com
milayapi.net
haoshuo88.com
629310.com
activasigurari.xyz
pornera.xyz
wallawander.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral2/memory/2208-122-0x0000000001AD0000-0x0000000001ADB000-memory.dmp CustAttr -
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3536-125-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3536-126-0x000000000041D040-mapping.dmp xloader behavioral2/memory/3408-133-0x00000000045A0000-0x00000000045C8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
D3ccF8FfwAXrqsU.exeD3ccF8FfwAXrqsU.exechkdsk.exedescription pid process target process PID 2208 set thread context of 3536 2208 D3ccF8FfwAXrqsU.exe D3ccF8FfwAXrqsU.exe PID 3536 set thread context of 3048 3536 D3ccF8FfwAXrqsU.exe Explorer.EXE PID 3408 set thread context of 3048 3408 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
D3ccF8FfwAXrqsU.exeD3ccF8FfwAXrqsU.exechkdsk.exepid process 2208 D3ccF8FfwAXrqsU.exe 3536 D3ccF8FfwAXrqsU.exe 3536 D3ccF8FfwAXrqsU.exe 3536 D3ccF8FfwAXrqsU.exe 3536 D3ccF8FfwAXrqsU.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe 3408 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
D3ccF8FfwAXrqsU.exechkdsk.exepid process 3536 D3ccF8FfwAXrqsU.exe 3536 D3ccF8FfwAXrqsU.exe 3536 D3ccF8FfwAXrqsU.exe 3408 chkdsk.exe 3408 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
D3ccF8FfwAXrqsU.exeD3ccF8FfwAXrqsU.exechkdsk.exedescription pid process Token: SeDebugPrivilege 2208 D3ccF8FfwAXrqsU.exe Token: SeDebugPrivilege 3536 D3ccF8FfwAXrqsU.exe Token: SeDebugPrivilege 3408 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
D3ccF8FfwAXrqsU.exeExplorer.EXEchkdsk.exedescription pid process target process PID 2208 wrote to memory of 3536 2208 D3ccF8FfwAXrqsU.exe D3ccF8FfwAXrqsU.exe PID 2208 wrote to memory of 3536 2208 D3ccF8FfwAXrqsU.exe D3ccF8FfwAXrqsU.exe PID 2208 wrote to memory of 3536 2208 D3ccF8FfwAXrqsU.exe D3ccF8FfwAXrqsU.exe PID 2208 wrote to memory of 3536 2208 D3ccF8FfwAXrqsU.exe D3ccF8FfwAXrqsU.exe PID 2208 wrote to memory of 3536 2208 D3ccF8FfwAXrqsU.exe D3ccF8FfwAXrqsU.exe PID 2208 wrote to memory of 3536 2208 D3ccF8FfwAXrqsU.exe D3ccF8FfwAXrqsU.exe PID 3048 wrote to memory of 3408 3048 Explorer.EXE chkdsk.exe PID 3048 wrote to memory of 3408 3048 Explorer.EXE chkdsk.exe PID 3048 wrote to memory of 3408 3048 Explorer.EXE chkdsk.exe PID 3408 wrote to memory of 2140 3408 chkdsk.exe cmd.exe PID 3408 wrote to memory of 2140 3408 chkdsk.exe cmd.exe PID 3408 wrote to memory of 2140 3408 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\D3ccF8FfwAXrqsU.exe"C:\Users\Admin\AppData\Local\Temp\D3ccF8FfwAXrqsU.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\D3ccF8FfwAXrqsU.exe"C:\Users\Admin\AppData\Local\Temp\D3ccF8FfwAXrqsU.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\D3ccF8FfwAXrqsU.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2140-131-0x0000000000000000-mapping.dmp
-
memory/2208-121-0x0000000005A80000-0x0000000005F7E000-memory.dmpFilesize
5.0MB
-
memory/2208-117-0x0000000005F80000-0x0000000005F81000-memory.dmpFilesize
4KB
-
memory/2208-118-0x0000000005A80000-0x0000000005A81000-memory.dmpFilesize
4KB
-
memory/2208-119-0x00000000033B0000-0x00000000033B1000-memory.dmpFilesize
4KB
-
memory/2208-120-0x0000000005BB0000-0x0000000005BB1000-memory.dmpFilesize
4KB
-
memory/2208-122-0x0000000001AD0000-0x0000000001ADB000-memory.dmpFilesize
44KB
-
memory/2208-123-0x0000000006780000-0x00000000067F3000-memory.dmpFilesize
460KB
-
memory/2208-124-0x0000000006500000-0x000000000652E000-memory.dmpFilesize
184KB
-
memory/2208-116-0x0000000005910000-0x0000000005911000-memory.dmpFilesize
4KB
-
memory/2208-114-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/3048-129-0x0000000003090000-0x0000000003168000-memory.dmpFilesize
864KB
-
memory/3048-136-0x0000000006860000-0x00000000069C5000-memory.dmpFilesize
1.4MB
-
memory/3408-130-0x0000000000000000-mapping.dmp
-
memory/3408-133-0x00000000045A0000-0x00000000045C8000-memory.dmpFilesize
160KB
-
memory/3408-132-0x00000000003C0000-0x00000000003CA000-memory.dmpFilesize
40KB
-
memory/3408-134-0x0000000004EE0000-0x0000000005200000-memory.dmpFilesize
3.1MB
-
memory/3408-135-0x0000000005200000-0x000000000528F000-memory.dmpFilesize
572KB
-
memory/3536-127-0x0000000001640000-0x0000000001960000-memory.dmpFilesize
3.1MB
-
memory/3536-128-0x00000000015A0000-0x00000000015B0000-memory.dmpFilesize
64KB
-
memory/3536-126-0x000000000041D040-mapping.dmp
-
memory/3536-125-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB