Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-09-2021 08:47
Static task
static1
Behavioral task
behavioral1
Sample
Statement of Acct..exe
Resource
win7-en
General
-
Target
Statement of Acct..exe
-
Size
521KB
-
MD5
850ef5cb4d3e3023ab26072a4cc6a25f
-
SHA1
0947a5b62ad244324971c7863977befaae3d71fd
-
SHA256
bb7d986712c63235f866f11ebc85ac60c360676e0576a075f16c16f679c31c7b
-
SHA512
58e8d6ecc2fbae3d85ff390c30bb5e7cff7f392ea2eae7bec8844e25b14b310e6af1a40da3e1d85516b881d1dcad2081a4d65e4da07ac6bbe45fa6a6d4e804a7
Malware Config
Extracted
xloader
2.4
tgnd
http://www.fhuosa.com/tgnd/
forever1887.com
zkz889.icu
futuresmanagers.com
salondebelle.biz
ziwomou.site
mobilestoreok.com
codexiveserver.xyz
cloudrail.net
pancakeandwaffle.net
ckbtmg.com
ralphboyer.net
carpenterglobal.solutions
mercoso.com
restoreyourpavers.com
tianyunpd.com
lan-sinoh.xyz
networlink.com
kazisworkshop.com
hempandcan.com
wd255.com
spectedsinues.com
winbigcompetitions.com
careconnectorsfl.com
customia.xyz
aestheticsbychill.com
sydneymortgagebroker.sydney
legallawgroup.com
posafrica.biz
rrstables.net
opexma.com
xxertyg.xyz
centermen.com
2272772.com
badplants.com
scrappyjonez.com
habesha-dream.com
doradoeventos.com
truegifty.website
markoonline.com
rockpresident.com
datasydney2022.com
tubbsbaitco.com
shopavix.com
ol9qz8i2sj3ic2f8.cfd
67161.xyz
tallulah.top
24-7homebiz.info
thesugarbuddy.com
instantcancelorder.xyz
bpost-international.com
infracreation.com
otomakyaj35.xyz
aboutforeverness.com
racheleaton.info
16ty6.com
davideli.com
financertr.xyz
matteogonfiantini.com
loudandclearcaraudio.com
spalp.xyz
apkversion.site
littlehappy.world
georgecuthbert.com
au-easyprofit-way.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2012-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2012-125-0x000000000041D410-mapping.dmp xloader behavioral2/memory/3040-132-0x0000000000CF0000-0x0000000000D19000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Statement of Acct..exeRegSvcs.exerundll32.exedescription pid process target process PID 664 set thread context of 2012 664 Statement of Acct..exe RegSvcs.exe PID 2012 set thread context of 3024 2012 RegSvcs.exe Explorer.EXE PID 3040 set thread context of 3024 3040 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
RegSvcs.exerundll32.exepid process 2012 RegSvcs.exe 2012 RegSvcs.exe 2012 RegSvcs.exe 2012 RegSvcs.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe 3040 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exerundll32.exepid process 2012 RegSvcs.exe 2012 RegSvcs.exe 2012 RegSvcs.exe 3040 rundll32.exe 3040 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RegSvcs.exerundll32.exedescription pid process Token: SeDebugPrivilege 2012 RegSvcs.exe Token: SeDebugPrivilege 3040 rundll32.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Statement of Acct..exeExplorer.EXErundll32.exedescription pid process target process PID 664 wrote to memory of 2012 664 Statement of Acct..exe RegSvcs.exe PID 664 wrote to memory of 2012 664 Statement of Acct..exe RegSvcs.exe PID 664 wrote to memory of 2012 664 Statement of Acct..exe RegSvcs.exe PID 664 wrote to memory of 2012 664 Statement of Acct..exe RegSvcs.exe PID 664 wrote to memory of 2012 664 Statement of Acct..exe RegSvcs.exe PID 664 wrote to memory of 2012 664 Statement of Acct..exe RegSvcs.exe PID 3024 wrote to memory of 3040 3024 Explorer.EXE rundll32.exe PID 3024 wrote to memory of 3040 3024 Explorer.EXE rundll32.exe PID 3024 wrote to memory of 3040 3024 Explorer.EXE rundll32.exe PID 3040 wrote to memory of 2860 3040 rundll32.exe cmd.exe PID 3040 wrote to memory of 2860 3040 rundll32.exe cmd.exe PID 3040 wrote to memory of 2860 3040 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Statement of Acct..exe"C:\Users\Admin\AppData\Local\Temp\Statement of Acct..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/664-114-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/664-116-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/664-117-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/664-118-0x0000000005060000-0x00000000050F2000-memory.dmpFilesize
584KB
-
memory/664-119-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/664-120-0x0000000005360000-0x0000000005367000-memory.dmpFilesize
28KB
-
memory/664-121-0x0000000008680000-0x0000000008681000-memory.dmpFilesize
4KB
-
memory/664-122-0x0000000008820000-0x0000000008896000-memory.dmpFilesize
472KB
-
memory/664-123-0x000000000AF70000-0x000000000AFB6000-memory.dmpFilesize
280KB
-
memory/2012-125-0x000000000041D410-mapping.dmp
-
memory/2012-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2012-127-0x00000000019A0000-0x00000000019B1000-memory.dmpFilesize
68KB
-
memory/2012-126-0x0000000001580000-0x00000000018A0000-memory.dmpFilesize
3.1MB
-
memory/2860-130-0x0000000000000000-mapping.dmp
-
memory/3024-128-0x0000000004EA0000-0x0000000004F9F000-memory.dmpFilesize
1020KB
-
memory/3024-135-0x0000000004760000-0x00000000047FB000-memory.dmpFilesize
620KB
-
memory/3040-129-0x0000000000000000-mapping.dmp
-
memory/3040-132-0x0000000000CF0000-0x0000000000D19000-memory.dmpFilesize
164KB
-
memory/3040-131-0x0000000000D40000-0x0000000000D53000-memory.dmpFilesize
76KB
-
memory/3040-133-0x0000000004440000-0x0000000004760000-memory.dmpFilesize
3.1MB
-
memory/3040-134-0x00000000047F0000-0x0000000004880000-memory.dmpFilesize
576KB