Analysis
-
max time kernel
1200s -
max time network
1196s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
27-09-2021 07:53
Static task
static1
Behavioral task
behavioral1
Sample
t0ID2yWRERNRIz4.exe
Resource
win7-en-20210920
General
-
Target
t0ID2yWRERNRIz4.exe
-
Size
818KB
-
MD5
2fa809111f6953a10bcae39ef3f57aa7
-
SHA1
9415a9c252e39776162749c9131d96274cd6cac9
-
SHA256
7b4c1bf9a15a419080fe02866aa26f162f79d5e01763c6af5915b07988556223
-
SHA512
adb6b340237a62af5fced4c819bfa92317e15a4062dab379d97a1b2ecd9e5ace9fca9330872f7d4f01c2a0b96035d9a69a376d7f7c812fece8584326447933b9
Malware Config
Extracted
xloader
2.5
gjeh
http://www.getaudionow.com/gjeh/
carmator.com
bsbqrp.com
siemens-mp.com
dunnfloorcoverings.com
cpassminimedicalschools.info
howtodesignyourhomeoffice.com
famliytaste.com
freesocialmarketing.com
jejuhaenyeo.net
tradebot.icu
arzug.com
carrefour-solucoes.online
ladyom.com
aoironote.com
newmexicocarwreckattorney.com
wealthpatternsllc.net
thinkpinkalicous.com
prajapati.company
bjhwky.com
jsdigitalekuns.com
hada-kirara.xyz
cryptochatr.com
ehao5ahhl6.com
i8news-sv.website
12sky2limitless.online
royalknightent.store
dualvisionproductions.com
nextgenerationracingleague.com
1dy17.xyz
vineethnekuri.com
offlces.com
mmpluk.com
4kwallpapers.online
yakyu-eiga.com
advertisingresult.com
ktshandymanservices.com
reyizz.com
ethics.tools
cyberbesttechnology.com
glopik.com
claybycollins.com
buythedamnbike.com
7q3qq3.com
normanwagers.com
editoramandacaia.com
fscmyc.com
contactosasi.com
brightpretty.com
glavins.net
demoxyz.online
apnagas.com
drdavesea.com
wholeheartedfounder.com
gunpowderz.com
thegliderguy.com
drawcen.com
7777wns.com
tecmovco.com
a3chic.com
alattarherbs.com
tracks-clicks.com
appioservice.com
matthewwesco.club
lampshadefish.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1812-59-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1812-60-0x000000000041D460-mapping.dmp xloader behavioral1/memory/1072-69-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Blocklisted process makes network request 12 IoCs
Processes:
msiexec.exeflow pid process 28 1072 msiexec.exe 47 1072 msiexec.exe 64 1072 msiexec.exe 88 1072 msiexec.exe 116 1072 msiexec.exe 126 1072 msiexec.exe 135 1072 msiexec.exe 146 1072 msiexec.exe 158 1072 msiexec.exe 175 1072 msiexec.exe 182 1072 msiexec.exe 201 1072 msiexec.exe -
Executes dropped EXE 1 IoCs
Processes:
gdisfv.exepid process 1064 gdisfv.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\H4L0CZLPKBU = "C:\\Program Files (x86)\\V2d3\\gdisfv.exe" msiexec.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
t0ID2yWRERNRIz4.exeMSBuild.exemsiexec.exedescription pid process target process PID 1144 set thread context of 1812 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1812 set thread context of 1392 1812 MSBuild.exe Explorer.EXE PID 1812 set thread context of 1392 1812 MSBuild.exe Explorer.EXE PID 1072 set thread context of 1392 1072 msiexec.exe Explorer.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
msiexec.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\V2d3\gdisfv.exe msiexec.exe File created C:\Program Files (x86)\V2d3\gdisfv.exe Explorer.EXE -
Processes:
msiexec.exedescription ioc process Key created \Registry\User\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Modifies registry class 9 IoCs
Processes:
t0ID2yWRERNRIz4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\GMKAssembler.Project\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\t0ID2yWRERNRIz4.exe\" \"%1\"" t0ID2yWRERNRIz4.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\GMKAssembler.Project\DefaultIcon t0ID2yWRERNRIz4.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\GMKAssembler.Project t0ID2yWRERNRIz4.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\GMKAssembler.Project\Shell t0ID2yWRERNRIz4.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\GMKAssembler.Project\Shell\open\command t0ID2yWRERNRIz4.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\GMKAssembler.Project\Shell\open t0ID2yWRERNRIz4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\GMKAssembler.Project\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\t0ID2yWRERNRIz4.exe" t0ID2yWRERNRIz4.exe Key created \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\.gmkasm t0ID2yWRERNRIz4.exe Set value (str) \REGISTRY\USER\S-1-5-21-3456797065-1076791440-4146276586-1000_CLASSES\.gmkasm\ = "GMKAssembler.Project" t0ID2yWRERNRIz4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
t0ID2yWRERNRIz4.exeMSBuild.exemsiexec.exepid process 1144 t0ID2yWRERNRIz4.exe 1144 t0ID2yWRERNRIz4.exe 1144 t0ID2yWRERNRIz4.exe 1144 t0ID2yWRERNRIz4.exe 1812 MSBuild.exe 1812 MSBuild.exe 1812 MSBuild.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
MSBuild.exemsiexec.exepid process 1812 MSBuild.exe 1812 MSBuild.exe 1812 MSBuild.exe 1812 MSBuild.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe 1072 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
t0ID2yWRERNRIz4.exeMSBuild.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1144 t0ID2yWRERNRIz4.exe Token: SeDebugPrivilege 1812 MSBuild.exe Token: SeDebugPrivilege 1072 msiexec.exe Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE Token: SeShutdownPrivilege 1392 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE 1392 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE 1392 Explorer.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
t0ID2yWRERNRIz4.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1144 wrote to memory of 1360 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1144 wrote to memory of 1360 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1144 wrote to memory of 1360 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1144 wrote to memory of 1360 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1144 wrote to memory of 1812 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1144 wrote to memory of 1812 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1144 wrote to memory of 1812 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1144 wrote to memory of 1812 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1144 wrote to memory of 1812 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1144 wrote to memory of 1812 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1144 wrote to memory of 1812 1144 t0ID2yWRERNRIz4.exe MSBuild.exe PID 1392 wrote to memory of 1072 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 1072 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 1072 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 1072 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 1072 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 1072 1392 Explorer.EXE msiexec.exe PID 1392 wrote to memory of 1072 1392 Explorer.EXE msiexec.exe PID 1072 wrote to memory of 1752 1072 msiexec.exe cmd.exe PID 1072 wrote to memory of 1752 1072 msiexec.exe cmd.exe PID 1072 wrote to memory of 1752 1072 msiexec.exe cmd.exe PID 1072 wrote to memory of 1752 1072 msiexec.exe cmd.exe PID 1072 wrote to memory of 1488 1072 msiexec.exe Firefox.exe PID 1072 wrote to memory of 1488 1072 msiexec.exe Firefox.exe PID 1072 wrote to memory of 1488 1072 msiexec.exe Firefox.exe PID 1072 wrote to memory of 1488 1072 msiexec.exe Firefox.exe PID 1392 wrote to memory of 1064 1392 Explorer.EXE gdisfv.exe PID 1392 wrote to memory of 1064 1392 Explorer.EXE gdisfv.exe PID 1392 wrote to memory of 1064 1392 Explorer.EXE gdisfv.exe PID 1392 wrote to memory of 1064 1392 Explorer.EXE gdisfv.exe PID 1072 wrote to memory of 1488 1072 msiexec.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\t0ID2yWRERNRIz4.exe"C:\Users\Admin\AppData\Local\Temp\t0ID2yWRERNRIz4.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\V2d3\gdisfv.exe"C:\Program Files (x86)\V2d3\gdisfv.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\V2d3\gdisfv.exeMD5
9af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
C:\Program Files (x86)\V2d3\gdisfv.exeMD5
9af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
memory/1064-79-0x0000000000370000-0x0000000000371000-memory.dmpFilesize
4KB
-
memory/1064-77-0x0000000001140000-0x0000000001141000-memory.dmpFilesize
4KB
-
memory/1064-74-0x0000000000000000-mapping.dmp
-
memory/1072-68-0x0000000000E20000-0x0000000000E34000-memory.dmpFilesize
80KB
-
memory/1072-71-0x0000000002240000-0x0000000002543000-memory.dmpFilesize
3.0MB
-
memory/1072-72-0x0000000000A00000-0x0000000000A90000-memory.dmpFilesize
576KB
-
memory/1072-66-0x0000000000000000-mapping.dmp
-
memory/1072-67-0x0000000076581000-0x0000000076583000-memory.dmpFilesize
8KB
-
memory/1072-69-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1144-55-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/1144-56-0x0000000000A20000-0x0000000000A3D000-memory.dmpFilesize
116KB
-
memory/1144-57-0x0000000005690000-0x00000000056F6000-memory.dmpFilesize
408KB
-
memory/1144-58-0x0000000000C60000-0x0000000000C96000-memory.dmpFilesize
216KB
-
memory/1144-53-0x0000000001000000-0x0000000001001000-memory.dmpFilesize
4KB
-
memory/1392-65-0x0000000007410000-0x0000000008766000-memory.dmpFilesize
19.3MB
-
memory/1392-73-0x00000000094A0000-0x00000000095B8000-memory.dmpFilesize
1.1MB
-
memory/1392-62-0x0000000007410000-0x0000000008766000-memory.dmpFilesize
19.3MB
-
memory/1488-80-0x0000000000000000-mapping.dmp
-
memory/1488-82-0x0000000000060000-0x0000000000175000-memory.dmpFilesize
1.1MB
-
memory/1488-81-0x000000013F280000-0x000000013F313000-memory.dmpFilesize
588KB
-
memory/1752-70-0x0000000000000000-mapping.dmp
-
memory/1812-60-0x000000000041D460-mapping.dmp
-
memory/1812-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1812-64-0x0000000000320000-0x0000000000331000-memory.dmpFilesize
68KB
-
memory/1812-63-0x0000000000180000-0x0000000000191000-memory.dmpFilesize
68KB
-
memory/1812-61-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB