Analysis
-
max time kernel
157s -
max time network
161s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-09-2021 07:03
Static task
static1
Behavioral task
behavioral1
Sample
onxyPs4yG1MUPbN.exe
Resource
win7v20210408
General
-
Target
onxyPs4yG1MUPbN.exe
-
Size
751KB
-
MD5
dcf0af8133ef8884811ad04f6c4274e8
-
SHA1
65c24521f2670260e9abe932c639f51b0847971b
-
SHA256
115716164b2092df207c750d11a2b4ce05bee204b7f21f1f62d93a5b7d78afa1
-
SHA512
1ff607115b6a831783f6273a7ab84bd6d9899d2ef6fcea96e1449a9ee692b74e0405a9a17349275ef6ae588fd9aaf4aa7fd29c767619502ba73ea31b24c61514
Malware Config
Extracted
xloader
2.5
gjeh
http://www.getaudionow.com/gjeh/
carmator.com
bsbqrp.com
siemens-mp.com
dunnfloorcoverings.com
cpassminimedicalschools.info
howtodesignyourhomeoffice.com
famliytaste.com
freesocialmarketing.com
jejuhaenyeo.net
tradebot.icu
arzug.com
carrefour-solucoes.online
ladyom.com
aoironote.com
newmexicocarwreckattorney.com
wealthpatternsllc.net
thinkpinkalicous.com
prajapati.company
bjhwky.com
jsdigitalekuns.com
hada-kirara.xyz
cryptochatr.com
ehao5ahhl6.com
i8news-sv.website
12sky2limitless.online
royalknightent.store
dualvisionproductions.com
nextgenerationracingleague.com
1dy17.xyz
vineethnekuri.com
offlces.com
mmpluk.com
4kwallpapers.online
yakyu-eiga.com
advertisingresult.com
ktshandymanservices.com
reyizz.com
ethics.tools
cyberbesttechnology.com
glopik.com
claybycollins.com
buythedamnbike.com
7q3qq3.com
normanwagers.com
editoramandacaia.com
fscmyc.com
contactosasi.com
brightpretty.com
glavins.net
demoxyz.online
apnagas.com
drdavesea.com
wholeheartedfounder.com
gunpowderz.com
thegliderguy.com
drawcen.com
7777wns.com
tecmovco.com
a3chic.com
alattarherbs.com
tracks-clicks.com
appioservice.com
matthewwesco.club
lampshadefish.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1692-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1692-67-0x000000000041D460-mapping.dmp xloader behavioral1/memory/1448-77-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
onxyPs4yG1MUPbN.exeRegSvcs.execolorcpl.exedescription pid process target process PID 880 set thread context of 1692 880 onxyPs4yG1MUPbN.exe RegSvcs.exe PID 1692 set thread context of 1204 1692 RegSvcs.exe Explorer.EXE PID 1692 set thread context of 1204 1692 RegSvcs.exe Explorer.EXE PID 1448 set thread context of 1204 1448 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
onxyPs4yG1MUPbN.exeRegSvcs.execolorcpl.exepid process 880 onxyPs4yG1MUPbN.exe 880 onxyPs4yG1MUPbN.exe 1692 RegSvcs.exe 1692 RegSvcs.exe 1692 RegSvcs.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe 1448 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.execolorcpl.exepid process 1692 RegSvcs.exe 1692 RegSvcs.exe 1692 RegSvcs.exe 1692 RegSvcs.exe 1448 colorcpl.exe 1448 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
onxyPs4yG1MUPbN.exeRegSvcs.execolorcpl.exedescription pid process Token: SeDebugPrivilege 880 onxyPs4yG1MUPbN.exe Token: SeDebugPrivilege 1692 RegSvcs.exe Token: SeDebugPrivilege 1448 colorcpl.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
onxyPs4yG1MUPbN.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 880 wrote to memory of 1692 880 onxyPs4yG1MUPbN.exe RegSvcs.exe PID 880 wrote to memory of 1692 880 onxyPs4yG1MUPbN.exe RegSvcs.exe PID 880 wrote to memory of 1692 880 onxyPs4yG1MUPbN.exe RegSvcs.exe PID 880 wrote to memory of 1692 880 onxyPs4yG1MUPbN.exe RegSvcs.exe PID 880 wrote to memory of 1692 880 onxyPs4yG1MUPbN.exe RegSvcs.exe PID 880 wrote to memory of 1692 880 onxyPs4yG1MUPbN.exe RegSvcs.exe PID 880 wrote to memory of 1692 880 onxyPs4yG1MUPbN.exe RegSvcs.exe PID 880 wrote to memory of 1692 880 onxyPs4yG1MUPbN.exe RegSvcs.exe PID 880 wrote to memory of 1692 880 onxyPs4yG1MUPbN.exe RegSvcs.exe PID 880 wrote to memory of 1692 880 onxyPs4yG1MUPbN.exe RegSvcs.exe PID 1204 wrote to memory of 1448 1204 Explorer.EXE colorcpl.exe PID 1204 wrote to memory of 1448 1204 Explorer.EXE colorcpl.exe PID 1204 wrote to memory of 1448 1204 Explorer.EXE colorcpl.exe PID 1204 wrote to memory of 1448 1204 Explorer.EXE colorcpl.exe PID 1448 wrote to memory of 1304 1448 colorcpl.exe cmd.exe PID 1448 wrote to memory of 1304 1448 colorcpl.exe cmd.exe PID 1448 wrote to memory of 1304 1448 colorcpl.exe cmd.exe PID 1448 wrote to memory of 1304 1448 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onxyPs4yG1MUPbN.exe"C:\Users\Admin\AppData\Local\Temp\onxyPs4yG1MUPbN.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/880-60-0x0000000000C40000-0x0000000000C41000-memory.dmpFilesize
4KB
-
memory/880-62-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/880-63-0x00000000006F0000-0x000000000070D000-memory.dmpFilesize
116KB
-
memory/880-64-0x0000000004F30000-0x0000000004F98000-memory.dmpFilesize
416KB
-
memory/880-65-0x0000000004DC0000-0x0000000004DF9000-memory.dmpFilesize
228KB
-
memory/1204-80-0x0000000006EA0000-0x000000000700A000-memory.dmpFilesize
1.4MB
-
memory/1204-70-0x0000000004A30000-0x0000000004B51000-memory.dmpFilesize
1.1MB
-
memory/1204-72-0x0000000007530000-0x00000000076AE000-memory.dmpFilesize
1.5MB
-
memory/1304-75-0x0000000000000000-mapping.dmp
-
memory/1448-76-0x0000000000540000-0x0000000000558000-memory.dmpFilesize
96KB
-
memory/1448-79-0x0000000001D10000-0x0000000001DA0000-memory.dmpFilesize
576KB
-
memory/1448-78-0x0000000001F50000-0x0000000002253000-memory.dmpFilesize
3.0MB
-
memory/1448-77-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/1448-73-0x0000000000000000-mapping.dmp
-
memory/1448-74-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1692-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1692-71-0x00000000001E0000-0x00000000001F1000-memory.dmpFilesize
68KB
-
memory/1692-69-0x0000000000190000-0x00000000001A1000-memory.dmpFilesize
68KB
-
memory/1692-68-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/1692-67-0x000000000041D460-mapping.dmp