Analysis
- max time kernel
150s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
02/08/2021, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
SKGMC38758347_Aztrade azerbaycan urun teklifi.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target SKGMC38758347_Aztrade azerbaycan urun teklifi.exe
- Size 679KB
- Sample210802-24kxvb84t2
- SHA256 8dec5ed95d3ca077bb1c2695074877a7160f97960df22a119d9f2debfb18dc0b
- MD5 7b237f5378187373a67114d738cedc4c
- SHA1 56341c81d80a8cb85c7b8ad0fe65a64572860ffe
- SHA512 1065b5f7ccd2cff48cf80e62c7840cc81b3cd9f863cc3eabdc5ea47a6d1d69ce910273c589d5e355bb6519fb7a0c25ac15317a3f1053fe519ae1497c3b23db27
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.3
C2
-
http://www.mambomakaya.com/ftgq/
Decoy
-
naturalbeautyapparel.com
-
abtotalsolution.com
-
periclescapitalmanagement.com
-
pleasejustdont.com
-
ryanscode.com
-
carsandscooters.com
-
best-polarized-sunglasses.com
-
hoodshawaii.com
-
titaefred.com
-
tomrings.com
-
swededenoting.host
-
birthdaytease.com
-
xaydzn.com
-
scutganxun.com
-
gdzhongle.com
-
alossol.com
-
shivamshield.com
-
fashionnailsjohnston.com
-
jobuelas.com
-
arvopaert.com
-
leabsayang.com
-
lakeviewfashions.com
-
tekisltd.com
-
akeromeganutra.com
-
countdown-yourspecialday.info
-
altshiftdel.com
-
xn--80apahn7a.space
-
travisisyourrealtor.com
-
zerelle.com
-
mdmppropertydetroit.com
-
lilijwood.com
-
takansampai.com
-
caibiriji.com
-
theruthyfoundation.com
-
lacasitadeeithne.com
-
markashleycollins.com
-
illuvoice.com
-
227592.com
-
omehaspancakemix.com
-
darkmad.net
-
buttonsandchary.com
-
balkanesport.com
-
hapax23.com
-
enniscarter.com
-
churchdogma.com
-
katharinarabl.net
-
pcbboattours.com
-
gloriousbdreseller.com
-
dreambuildarchitect.com
-
4114global.com
-
probabilisticstatements.info
-
quliao999.com
-
ahmed-mohammed.online
-
caribbeannorthcoast.com
-
tequilamidnight.com
-
2-sny68-w2mz.net
-
teknokablo.com
-
ozarktek.com
-
youreternalseen.com
-
sarahdutra.com
-
streamcommunitty.com
-
tweepstats.com
-
paulautoservices.com
-
lahamburguesadetuvida.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/3972-116-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1888-122-0x0000000002FC0000-0x0000000002FE9000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1032 set thread context of 3972 1032 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 74 PID 3972 set thread context of 2740 3972 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 27 PID 1888 set thread context of 2740 1888 svchost.exe 27 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3972 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 3972 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 3972 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 3972 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe 1888 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2740 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1032 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 3972 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 3972 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 3972 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 1888 svchost.exe 1888 svchost.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3972 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE Token: SeDebugPrivilege 1888 svchost.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2740 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1032 wrote to memory of 3972 1032 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 74 PID 1032 wrote to memory of 3972 1032 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 74 PID 1032 wrote to memory of 3972 1032 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 74 PID 1032 wrote to memory of 3972 1032 SKGMC38758347_Aztrade azerbaycan urun teklifi.exe 74 PID 2740 wrote to memory of 1888 2740 Explorer.EXE 76 PID 2740 wrote to memory of 1888 2740 Explorer.EXE 76 PID 2740 wrote to memory of 1888 2740 Explorer.EXE 76 PID 1888 wrote to memory of 2232 1888 svchost.exe 79 PID 1888 wrote to memory of 2232 1888 svchost.exe 79 PID 1888 wrote to memory of 2232 1888 svchost.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\SKGMC38758347_Aztrade azerbaycan urun teklifi.exe"C:\Users\Admin\AppData\Local\Temp\SKGMC38758347_Aztrade azerbaycan urun teklifi.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\SKGMC38758347_Aztrade azerbaycan urun teklifi.exe"C:\Users\Admin\AppData\Local\Temp\SKGMC38758347_Aztrade azerbaycan urun teklifi.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3972
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SKGMC38758347_Aztrade azerbaycan urun teklifi.exe"3⤵PID:2232
-
-