Analysis
-
max time kernel
300s -
max time network
300s -
platform
windows10_x64 -
resource
win10-en -
submitted
07-09-2021 06:41
Static task
static1
Behavioral task
behavioral1
Sample
grace $$.exe
Resource
win7v20210408
General
-
Target
grace $$.exe
-
Size
489KB
-
MD5
ba3c72780f80542fe09aeed80a9a56c6
-
SHA1
22bc724884cf52efe4c596bcd8ffdd155c783238
-
SHA256
c840ee368fcab5974485c16fc456b1dc1923cc5e113ce6a96f6f314a7ec5ac94
-
SHA512
a66602343d24dff4330551b900644ece8fe62059a88327ddac99fb0bc625a7eb3cfa6f3697beed4a0ec9f2f1f227f42dd4e36c43470cf4c71d38b6ad07ee15fd
Malware Config
Extracted
xloader
2.3
t75f
http://www.vertexnailsblaine.com/t75f/
onegolfsydney.com
kaizensportscoaching.com
mliacbjv.icu
rinstech.net
midas-parts.com
istmenian.com
ibrahimpike.com
herbspaces.com
gentleman4higher.com
workabusiness.com
isabusive.website
222555dy.com
lwhyzhzb.xyz
gabrielabravoillanes.com
hearthomelife.com
buildswealth.com
printitaz.com
l-mventures.com
baincot3.com
nstaq-labs.com
wikendi.com
newyears21.com
citestaccnt1597730671.com
thecuriousincidentwes.com
alchembiopro.com
stardustanimations.com
ssgasiaw.com
sarajanesstudio.com
whitepointfineart.com
dlglawtx.com
doudiangroup.com
jackpod.team
abvoltprunus.bid
miimamablog.com
selfbuildwithmannok.com
thanhxuan99.online
germantos.com
waterdoor.net
wmscloud.net
services-24hras.com
maneadvisors.com
mosineetowing.com
blockdelightsmart.com
booyaka.design
brewery-run.com
dexteroushandmade.com
minhamochila.com
drawingwoo.com
thesalcombefurniturecompany.net
nashautoglass.com
beenationgear.com
cleanseforlifewellness.com
corecounselingcenter.info
naturalcreativesociety.com
sarcontraders.com
lickitbuddyrehab.com
theweekendrecap.com
cetiya-veluvana.com
w7asd.net
nyctophilia.net
asialion.net
goldentreegrp.com
jacobuspark.com
punchingforce.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3868-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3868-126-0x000000000041D110-mapping.dmp xloader behavioral2/memory/3644-133-0x0000000000490000-0x00000000004B9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
grace $$.exeRegSvcs.exeipconfig.exedescription pid process target process PID 3220 set thread context of 3868 3220 grace $$.exe RegSvcs.exe PID 3868 set thread context of 3052 3868 RegSvcs.exe Explorer.EXE PID 3644 set thread context of 3052 3644 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3644 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
grace $$.exeRegSvcs.exeipconfig.exepid process 3220 grace $$.exe 3220 grace $$.exe 3868 RegSvcs.exe 3868 RegSvcs.exe 3868 RegSvcs.exe 3868 RegSvcs.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe 3644 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeipconfig.exepid process 3868 RegSvcs.exe 3868 RegSvcs.exe 3868 RegSvcs.exe 3644 ipconfig.exe 3644 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
grace $$.exeRegSvcs.exeipconfig.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3220 grace $$.exe Token: SeDebugPrivilege 3868 RegSvcs.exe Token: SeDebugPrivilege 3644 ipconfig.exe Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3052 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
grace $$.exeExplorer.EXEipconfig.exedescription pid process target process PID 3220 wrote to memory of 3868 3220 grace $$.exe RegSvcs.exe PID 3220 wrote to memory of 3868 3220 grace $$.exe RegSvcs.exe PID 3220 wrote to memory of 3868 3220 grace $$.exe RegSvcs.exe PID 3220 wrote to memory of 3868 3220 grace $$.exe RegSvcs.exe PID 3220 wrote to memory of 3868 3220 grace $$.exe RegSvcs.exe PID 3220 wrote to memory of 3868 3220 grace $$.exe RegSvcs.exe PID 3052 wrote to memory of 3644 3052 Explorer.EXE ipconfig.exe PID 3052 wrote to memory of 3644 3052 Explorer.EXE ipconfig.exe PID 3052 wrote to memory of 3644 3052 Explorer.EXE ipconfig.exe PID 3644 wrote to memory of 2180 3644 ipconfig.exe cmd.exe PID 3644 wrote to memory of 2180 3644 ipconfig.exe cmd.exe PID 3644 wrote to memory of 2180 3644 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\grace $$.exe"C:\Users\Admin\AppData\Local\Temp\grace $$.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2180-131-0x0000000000000000-mapping.dmp
-
memory/3052-129-0x0000000003400000-0x00000000034D8000-memory.dmpFilesize
864KB
-
memory/3052-136-0x0000000006B10000-0x0000000006C3B000-memory.dmpFilesize
1.2MB
-
memory/3220-121-0x0000000005470000-0x0000000005486000-memory.dmpFilesize
88KB
-
memory/3220-119-0x0000000002DA0000-0x0000000002DA1000-memory.dmpFilesize
4KB
-
memory/3220-115-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/3220-122-0x000000000C850000-0x000000000C851000-memory.dmpFilesize
4KB
-
memory/3220-123-0x000000000C8F0000-0x000000000C94F000-memory.dmpFilesize
380KB
-
memory/3220-124-0x000000000F3C0000-0x000000000F3EA000-memory.dmpFilesize
168KB
-
memory/3220-117-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/3220-120-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/3220-118-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/3644-132-0x0000000000DB0000-0x0000000000DBB000-memory.dmpFilesize
44KB
-
memory/3644-130-0x0000000000000000-mapping.dmp
-
memory/3644-133-0x0000000000490000-0x00000000004B9000-memory.dmpFilesize
164KB
-
memory/3644-134-0x0000000002DC0000-0x00000000030E0000-memory.dmpFilesize
3.1MB
-
memory/3644-135-0x0000000000A50000-0x0000000000ADF000-memory.dmpFilesize
572KB
-
memory/3868-127-0x0000000001650000-0x0000000001970000-memory.dmpFilesize
3.1MB
-
memory/3868-128-0x0000000001640000-0x0000000001650000-memory.dmpFilesize
64KB
-
memory/3868-126-0x000000000041D110-mapping.dmp
-
memory/3868-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB