Analysis
-
max time kernel
301s -
max time network
299s -
platform
windows7_x64 -
resource
win7-en -
submitted
03-09-2021 04:50
Static task
static1
Behavioral task
behavioral1
Sample
grace $.exe
Resource
win7-en
General
-
Target
grace $.exe
-
Size
482KB
-
MD5
beee308b51db0c02f8eeebf7d2773a6d
-
SHA1
4df5d609ea5b05dfcba4b9e51120a10374f7d450
-
SHA256
7af335cb2a2646ddadf12f730585a217523da868aaeb12ba621b367c1b942693
-
SHA512
d0665aa70d1c1116a36c296bc49ec4b474a086d9741d3439f8b0fe4c8f054ae8ab1d5610b4e4e74758c25947054a569e5b897822e2859c8595b00dc69015a63b
Malware Config
Extracted
xloader
2.3
t75f
http://www.vertexnailsblaine.com/t75f/
onegolfsydney.com
kaizensportscoaching.com
mliacbjv.icu
rinstech.net
midas-parts.com
istmenian.com
ibrahimpike.com
herbspaces.com
gentleman4higher.com
workabusiness.com
isabusive.website
222555dy.com
lwhyzhzb.xyz
gabrielabravoillanes.com
hearthomelife.com
buildswealth.com
printitaz.com
l-mventures.com
baincot3.com
nstaq-labs.com
wikendi.com
newyears21.com
citestaccnt1597730671.com
thecuriousincidentwes.com
alchembiopro.com
stardustanimations.com
ssgasiaw.com
sarajanesstudio.com
whitepointfineart.com
dlglawtx.com
doudiangroup.com
jackpod.team
abvoltprunus.bid
miimamablog.com
selfbuildwithmannok.com
thanhxuan99.online
germantos.com
waterdoor.net
wmscloud.net
services-24hras.com
maneadvisors.com
mosineetowing.com
blockdelightsmart.com
booyaka.design
brewery-run.com
dexteroushandmade.com
minhamochila.com
drawingwoo.com
thesalcombefurniturecompany.net
nashautoglass.com
beenationgear.com
cleanseforlifewellness.com
corecounselingcenter.info
naturalcreativesociety.com
sarcontraders.com
lickitbuddyrehab.com
theweekendrecap.com
cetiya-veluvana.com
w7asd.net
nyctophilia.net
asialion.net
goldentreegrp.com
jacobuspark.com
punchingforce.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/568-58-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/568-59-0x000000000041D110-mapping.dmp xloader behavioral1/memory/1040-66-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 13 1040 rundll32.exe 43 1040 rundll32.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
grace $.exeRegSvcs.exerundll32.exedescription pid process target process PID 1632 set thread context of 568 1632 grace $.exe RegSvcs.exe PID 568 set thread context of 1376 568 RegSvcs.exe Explorer.EXE PID 1040 set thread context of 1376 1040 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 53 IoCs
Processes:
grace $.exeRegSvcs.exerundll32.exepid process 1632 grace $.exe 1632 grace $.exe 568 RegSvcs.exe 568 RegSvcs.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe 1040 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exerundll32.exepid process 568 RegSvcs.exe 568 RegSvcs.exe 568 RegSvcs.exe 1040 rundll32.exe 1040 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
grace $.exeRegSvcs.exerundll32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1632 grace $.exe Token: SeDebugPrivilege 568 RegSvcs.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeShutdownPrivilege 1376 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
grace $.exeExplorer.EXErundll32.exedescription pid process target process PID 1632 wrote to memory of 568 1632 grace $.exe RegSvcs.exe PID 1632 wrote to memory of 568 1632 grace $.exe RegSvcs.exe PID 1632 wrote to memory of 568 1632 grace $.exe RegSvcs.exe PID 1632 wrote to memory of 568 1632 grace $.exe RegSvcs.exe PID 1632 wrote to memory of 568 1632 grace $.exe RegSvcs.exe PID 1632 wrote to memory of 568 1632 grace $.exe RegSvcs.exe PID 1632 wrote to memory of 568 1632 grace $.exe RegSvcs.exe PID 1632 wrote to memory of 568 1632 grace $.exe RegSvcs.exe PID 1632 wrote to memory of 568 1632 grace $.exe RegSvcs.exe PID 1632 wrote to memory of 568 1632 grace $.exe RegSvcs.exe PID 1376 wrote to memory of 1040 1376 Explorer.EXE rundll32.exe PID 1376 wrote to memory of 1040 1376 Explorer.EXE rundll32.exe PID 1376 wrote to memory of 1040 1376 Explorer.EXE rundll32.exe PID 1376 wrote to memory of 1040 1376 Explorer.EXE rundll32.exe PID 1376 wrote to memory of 1040 1376 Explorer.EXE rundll32.exe PID 1376 wrote to memory of 1040 1376 Explorer.EXE rundll32.exe PID 1376 wrote to memory of 1040 1376 Explorer.EXE rundll32.exe PID 1040 wrote to memory of 320 1040 rundll32.exe cmd.exe PID 1040 wrote to memory of 320 1040 rundll32.exe cmd.exe PID 1040 wrote to memory of 320 1040 rundll32.exe cmd.exe PID 1040 wrote to memory of 320 1040 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\grace $.exe"C:\Users\Admin\AppData\Local\Temp\grace $.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-68-0x0000000000000000-mapping.dmp
-
memory/568-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/568-60-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/568-61-0x00000000000C0000-0x00000000000D0000-memory.dmpFilesize
64KB
-
memory/568-59-0x000000000041D110-mapping.dmp
-
memory/1040-65-0x00000000005B0000-0x00000000005BE000-memory.dmpFilesize
56KB
-
memory/1040-63-0x0000000000000000-mapping.dmp
-
memory/1040-64-0x0000000075AD1000-0x0000000075AD3000-memory.dmpFilesize
8KB
-
memory/1040-67-0x00000000020F0000-0x00000000023F3000-memory.dmpFilesize
3.0MB
-
memory/1040-66-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1040-69-0x00000000009E0000-0x0000000000A6F000-memory.dmpFilesize
572KB
-
memory/1376-62-0x0000000004B90000-0x0000000004C5A000-memory.dmpFilesize
808KB
-
memory/1376-70-0x0000000006520000-0x0000000006697000-memory.dmpFilesize
1.5MB
-
memory/1632-57-0x0000000001F60000-0x0000000001F8A000-memory.dmpFilesize
168KB
-
memory/1632-56-0x0000000005070000-0x00000000050CF000-memory.dmpFilesize
380KB
-
memory/1632-55-0x0000000000520000-0x0000000000536000-memory.dmpFilesize
88KB
-
memory/1632-52-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/1632-54-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB