Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
27-09-2021 10:12
Static task
static1
Behavioral task
behavioral1
Sample
$$$.exe
Resource
win7-en-20210920
General
-
Target
$$$.exe
-
Size
761KB
-
MD5
2d4991b52cb7c3f5e3cb8ed4d22c069a
-
SHA1
5f16af33b1cc461e4c6b4f5d1848547040fa1772
-
SHA256
984dec79b881adf59d5308f52fddeda0fbccbd917b750f6ec9a5be1a1a4dc0fa
-
SHA512
ee17ff87e053092385d90337cbab6719822f137dbf33408f10dc52f4c0db2579f54d56d54be7e55439945705de9005c27e361c29909d05704339c5333a8b14a2
Malware Config
Extracted
xloader
2.5
jdt0
http://www.jen4x.com/jdt0/
william188.com
kmknim.com
freedomnofear.com
industrialohare.com
devopswave.com
g1fz.com
aliceguidi.info
linkared.com
crossboda.com
lpddr3.com
ktnword.xyz
productsdesign.top
dulichnhatviet.com
piazzaassociates.com
inpude.com
kmi.contractors
getkyrobak.com
sportinggoodssuperstore.com
trifoly.info
aspectjudge.com
yangmoo.com
shiftmedicalstaffing.agency
umofan.com
investmentqualityjewels.com
hoteldelpaseocampeche.com
ezhandianfu888.com
liveincare-online.com
riverflowmassage.com
heldyn.com
escueladecampo.com
telecombazaar.com
oshitoishi.net
microexpertise.com
successportal.net
nepll.com
jdqmg.com
aedificeproperty.com
element-light.com
karenellissolutions.com
embutidosdigitales.com
goddistorted.com
wanimi.online
online-ec.biz
staysg.club
roytoys.xyz
loadcenter-dropbox.biz
appcast-70.com
espraycash.com
busizy.com
intellibotz.com
gg-loader.com
rocketdealfinder.com
hosting-premium-online.com
lookyanychev-gallery.store
norllix.com
itooze.com
cbuqn.com
life-lover.com
kelloscosplay.com
memory-information.club
grand-polyana.com
sanieart.com
pavlonmedia.net
edgar-regale.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2768-126-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2768-127-0x000000000041D390-mapping.dmp xloader behavioral2/memory/3696-134-0x0000000000C00000-0x0000000000C29000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
$$$.exeRegSvcs.exechkdsk.exedescription pid process target process PID 2064 set thread context of 2768 2064 $$$.exe RegSvcs.exe PID 2768 set thread context of 3068 2768 RegSvcs.exe Explorer.EXE PID 3696 set thread context of 3068 3696 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
$$$.exeRegSvcs.exechkdsk.exepid process 2064 $$$.exe 2064 $$$.exe 2768 RegSvcs.exe 2768 RegSvcs.exe 2768 RegSvcs.exe 2768 RegSvcs.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe 3696 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3068 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exechkdsk.exepid process 2768 RegSvcs.exe 2768 RegSvcs.exe 2768 RegSvcs.exe 3696 chkdsk.exe 3696 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
$$$.exeRegSvcs.exechkdsk.exedescription pid process Token: SeDebugPrivilege 2064 $$$.exe Token: SeDebugPrivilege 2768 RegSvcs.exe Token: SeDebugPrivilege 3696 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
$$$.exeExplorer.EXEchkdsk.exedescription pid process target process PID 2064 wrote to memory of 2768 2064 $$$.exe RegSvcs.exe PID 2064 wrote to memory of 2768 2064 $$$.exe RegSvcs.exe PID 2064 wrote to memory of 2768 2064 $$$.exe RegSvcs.exe PID 2064 wrote to memory of 2768 2064 $$$.exe RegSvcs.exe PID 2064 wrote to memory of 2768 2064 $$$.exe RegSvcs.exe PID 2064 wrote to memory of 2768 2064 $$$.exe RegSvcs.exe PID 3068 wrote to memory of 3696 3068 Explorer.EXE chkdsk.exe PID 3068 wrote to memory of 3696 3068 Explorer.EXE chkdsk.exe PID 3068 wrote to memory of 3696 3068 Explorer.EXE chkdsk.exe PID 3696 wrote to memory of 3052 3696 chkdsk.exe cmd.exe PID 3696 wrote to memory of 3052 3696 chkdsk.exe cmd.exe PID 3696 wrote to memory of 3052 3696 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\$$$.exe"C:\Users\Admin\AppData\Local\Temp\$$$.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2064-115-0x0000000000750000-0x0000000000751000-memory.dmpFilesize
4KB
-
memory/2064-117-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/2064-118-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/2064-119-0x0000000005040000-0x000000000553E000-memory.dmpFilesize
5.0MB
-
memory/2064-120-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/2064-121-0x0000000008580000-0x0000000008581000-memory.dmpFilesize
4KB
-
memory/2064-122-0x0000000005500000-0x0000000005507000-memory.dmpFilesize
28KB
-
memory/2064-123-0x0000000008C00000-0x0000000008C01000-memory.dmpFilesize
4KB
-
memory/2064-124-0x0000000008AA0000-0x0000000008AFF000-memory.dmpFilesize
380KB
-
memory/2064-125-0x0000000008B10000-0x0000000008B3F000-memory.dmpFilesize
188KB
-
memory/2768-126-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2768-127-0x000000000041D390-mapping.dmp
-
memory/2768-128-0x0000000001A90000-0x0000000001DB0000-memory.dmpFilesize
3.1MB
-
memory/2768-130-0x0000000001620000-0x0000000001631000-memory.dmpFilesize
68KB
-
memory/3052-132-0x0000000000000000-mapping.dmp
-
memory/3068-129-0x0000000000CC0000-0x0000000000DF1000-memory.dmpFilesize
1.2MB
-
memory/3068-137-0x00000000052A0000-0x00000000053F4000-memory.dmpFilesize
1.3MB
-
memory/3696-131-0x0000000000000000-mapping.dmp
-
memory/3696-133-0x0000000000FC0000-0x0000000000FCA000-memory.dmpFilesize
40KB
-
memory/3696-134-0x0000000000C00000-0x0000000000C29000-memory.dmpFilesize
164KB
-
memory/3696-135-0x0000000005520000-0x0000000005840000-memory.dmpFilesize
3.1MB
-
memory/3696-136-0x00000000051E0000-0x0000000005270000-memory.dmpFilesize
576KB