Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20210410 - submitted
02/08/2021, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
SGKCM20217566748_Federighi Turkiye Oferta Termék .exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target SGKCM20217566748_Federighi Turkiye Oferta Termék .exe
- Size 921KB
- Sample210802-jtfa9sae6a
- SHA256 f515599d9ab7045656d0976c3aa5740feab68f862fa2e339379a1118f8ccba4a
- MD5 89988ac505f3a7eedd5a842d23683f10
- SHA1 087322adf2ee38e7b50bdc0b0a3c92d6657e5ab4
- SHA512 03f97c8fe7240f0b89013ed8fe77cefad7ac61d70f9e07981986d96663b4dc90530485c204fe5d9e0e481bb49f4b7301fb3874f57aec17f66afe011b9adea514
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.3
C2
-
http://www.mambomakaya.com/ftgq/
Decoy
-
naturalbeautyapparel.com
-
abtotalsolution.com
-
periclescapitalmanagement.com
-
pleasejustdont.com
-
ryanscode.com
-
carsandscooters.com
-
best-polarized-sunglasses.com
-
hoodshawaii.com
-
titaefred.com
-
tomrings.com
-
swededenoting.host
-
birthdaytease.com
-
xaydzn.com
-
scutganxun.com
-
gdzhongle.com
-
alossol.com
-
shivamshield.com
-
fashionnailsjohnston.com
-
jobuelas.com
-
arvopaert.com
-
leabsayang.com
-
lakeviewfashions.com
-
tekisltd.com
-
akeromeganutra.com
-
countdown-yourspecialday.info
-
altshiftdel.com
-
xn--80apahn7a.space
-
travisisyourrealtor.com
-
zerelle.com
-
mdmppropertydetroit.com
-
lilijwood.com
-
takansampai.com
-
caibiriji.com
-
theruthyfoundation.com
-
lacasitadeeithne.com
-
markashleycollins.com
-
illuvoice.com
-
227592.com
-
omehaspancakemix.com
-
darkmad.net
-
buttonsandchary.com
-
balkanesport.com
-
hapax23.com
-
enniscarter.com
-
churchdogma.com
-
katharinarabl.net
-
pcbboattours.com
-
gloriousbdreseller.com
-
dreambuildarchitect.com
-
4114global.com
-
probabilisticstatements.info
-
quliao999.com
-
ahmed-mohammed.online
-
caribbeannorthcoast.com
-
tequilamidnight.com
-
2-sny68-w2mz.net
-
teknokablo.com
-
ozarktek.com
-
youreternalseen.com
-
sarahdutra.com
-
streamcommunitty.com
-
tweepstats.com
-
paulautoservices.com
-
lahamburguesadetuvida.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/3728-116-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1932-122-0x00000000004D0000-0x00000000004F9000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3944 set thread context of 3728 3944 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 72 PID 3728 set thread context of 2492 3728 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 17 PID 1932 set thread context of 2492 1932 msdt.exe 17 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3728 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 3728 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 3728 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 3728 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe 1932 msdt.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2492 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3944 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 3728 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 3728 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 3728 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 1932 msdt.exe 1932 msdt.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeDebugPrivilege 3728 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe Token: SeShutdownPrivilege 2492 Explorer.EXE Token: SeCreatePagefilePrivilege 2492 Explorer.EXE Token: SeShutdownPrivilege 2492 Explorer.EXE Token: SeCreatePagefilePrivilege 2492 Explorer.EXE Token: SeShutdownPrivilege 2492 Explorer.EXE Token: SeCreatePagefilePrivilege 2492 Explorer.EXE Token: SeShutdownPrivilege 2492 Explorer.EXE Token: SeCreatePagefilePrivilege 2492 Explorer.EXE Token: SeShutdownPrivilege 2492 Explorer.EXE Token: SeCreatePagefilePrivilege 2492 Explorer.EXE Token: SeShutdownPrivilege 2492 Explorer.EXE Token: SeCreatePagefilePrivilege 2492 Explorer.EXE Token: SeDebugPrivilege 1932 msdt.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2492 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3944 wrote to memory of 3728 3944 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 72 PID 3944 wrote to memory of 3728 3944 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 72 PID 3944 wrote to memory of 3728 3944 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 72 PID 3944 wrote to memory of 3728 3944 SGKCM20217566748_Federighi Turkiye Oferta Termék .exe 72 PID 2492 wrote to memory of 1932 2492 Explorer.EXE 76 PID 2492 wrote to memory of 1932 2492 Explorer.EXE 76 PID 2492 wrote to memory of 1932 2492 Explorer.EXE 76 PID 1932 wrote to memory of 1096 1932 msdt.exe 79 PID 1932 wrote to memory of 1096 1932 msdt.exe 79 PID 1932 wrote to memory of 1096 1932 msdt.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\SGKCM20217566748_Federighi Turkiye Oferta Termék .exe"C:\Users\Admin\AppData\Local\Temp\SGKCM20217566748_Federighi Turkiye Oferta Termék .exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\SGKCM20217566748_Federighi Turkiye Oferta Termék .exe"C:\Users\Admin\AppData\Local\Temp\SGKCM20217566748_Federighi Turkiye Oferta Termék .exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SGKCM20217566748_Federighi Turkiye Oferta Termék .exe"3⤵PID:1096
-
-