Analysis
-
max time kernel
148s -
max time network
196s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-09-2021 12:45
Static task
static1
Behavioral task
behavioral1
Sample
BL.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
BL.exe
Resource
win10-en-20210920
General
-
Target
BL.exe
-
Size
807KB
-
MD5
655d846a65b27c02ed505b03a4c3bb5c
-
SHA1
9b0861b0e816878ba0293cbe7c2838ed6f1ab98b
-
SHA256
c6abf1c546a9bd38b2e156da3b3d13388a3f81cf1955f85f76792c6193e144a6
-
SHA512
0ce9e954e41771c8ee9d982798d659ac73e9880aa887541348e70ae9a4a880163145b1c3e1650f99a8e1ebb8b0177cb7ffab0daa41027a4dffeca5e0a4534bda
Malware Config
Extracted
xloader
2.3
angp
http://www.cartoonuniversetr.com/angp/
up24az.com
zeroveom.com
1digitalventures.com
forddongsaigon.com
ryota-mizusawa.com
quick-1k.com
startprofitsonline.com
thumbaycomforts.com
wigholes.website
makhariskloset.com
laranabcn.com
unseen.observer
multipliii.com
smartpod.tech
lightparis.com
reddetenis.com
forprosperliving.group
growingequityfund.com
youbuzc.com
kompromat.global
tvanchieta.com
zusbre.com
beijingban2.icu
beautybrowpen.com
broadwayvapeshops.com
securaproperty.com
398-genda.icu
karate-club-arbent.com
walkietalkiesforkids.com
watsonplumbingheating.com
automationagility.com
agaverealestateteam.com
thereprezentant.com
shrivastavwebsolutions.com
hydets.xyz
little-monsters.info
amorabeautygh.com
kuberabettingtip.com
cervezamaracaibo.com
diyblogphotos.com
upscalejob.com
osti-slim-001.host
tmcb2b.com
stuartdio.com
redemptionstorychurch.com
okinfocenter.com
activatemymind.com
dnadropnutrition.com
pietermaritzburgpower.com
fjxwddz.com
youngindwon.com
neworleanshemorrhoidcenter.com
blunss.info
thereglo.com
greeenshootsproductions.com
missasiasanfrancisco.com
oparinia.com
metroimportadores.com
thepremiumfreight.com
themodernthali.com
compallowshop.com
korsandroid.com
saqtrading.com
zhuanzhuana.club
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1416-64-0x0000000000000000-mapping.dmp xloader behavioral1/memory/1416-66-0x0000000010410000-0x0000000010439000-memory.dmp xloader behavioral1/memory/1648-75-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
secinit.execmmon32.exedescription pid process target process PID 1416 set thread context of 1200 1416 secinit.exe Explorer.EXE PID 1416 set thread context of 1200 1416 secinit.exe Explorer.EXE PID 1648 set thread context of 1200 1648 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
secinit.execmmon32.exepid process 1416 secinit.exe 1416 secinit.exe 1416 secinit.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe 1648 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
secinit.execmmon32.exepid process 1416 secinit.exe 1416 secinit.exe 1416 secinit.exe 1416 secinit.exe 1648 cmmon32.exe 1648 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
secinit.execmmon32.exedescription pid process Token: SeDebugPrivilege 1416 secinit.exe Token: SeDebugPrivilege 1648 cmmon32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
BL.exeExplorer.EXEcmmon32.exedescription pid process target process PID 564 wrote to memory of 1416 564 BL.exe secinit.exe PID 564 wrote to memory of 1416 564 BL.exe secinit.exe PID 564 wrote to memory of 1416 564 BL.exe secinit.exe PID 564 wrote to memory of 1416 564 BL.exe secinit.exe PID 564 wrote to memory of 1416 564 BL.exe secinit.exe PID 564 wrote to memory of 1416 564 BL.exe secinit.exe PID 564 wrote to memory of 1416 564 BL.exe secinit.exe PID 1200 wrote to memory of 1648 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 1648 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 1648 1200 Explorer.EXE cmmon32.exe PID 1200 wrote to memory of 1648 1200 Explorer.EXE cmmon32.exe PID 1648 wrote to memory of 1800 1648 cmmon32.exe cmd.exe PID 1648 wrote to memory of 1800 1648 cmmon32.exe cmd.exe PID 1648 wrote to memory of 1800 1648 cmmon32.exe cmd.exe PID 1648 wrote to memory of 1800 1648 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BL.exe"C:\Users\Admin\AppData\Local\Temp\BL.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\secinit.exeC:\Windows\System32\secinit.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\secinit.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-63-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/564-59-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1200-69-0x0000000006130000-0x0000000006237000-memory.dmpFilesize
1.0MB
-
memory/1200-78-0x0000000006980000-0x0000000006ACA000-memory.dmpFilesize
1.3MB
-
memory/1200-71-0x0000000006530000-0x0000000006621000-memory.dmpFilesize
964KB
-
memory/1416-65-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/1416-68-0x0000000000180000-0x0000000000190000-memory.dmpFilesize
64KB
-
memory/1416-67-0x0000000001FB0000-0x00000000022B3000-memory.dmpFilesize
3.0MB
-
memory/1416-66-0x0000000010410000-0x0000000010439000-memory.dmpFilesize
164KB
-
memory/1416-70-0x0000000000290000-0x00000000002A0000-memory.dmpFilesize
64KB
-
memory/1416-64-0x0000000000000000-mapping.dmp
-
memory/1648-72-0x0000000000000000-mapping.dmp
-
memory/1648-74-0x0000000000980000-0x000000000098D000-memory.dmpFilesize
52KB
-
memory/1648-75-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1648-76-0x00000000021F0000-0x00000000024F3000-memory.dmpFilesize
3.0MB
-
memory/1648-77-0x0000000000410000-0x000000000049F000-memory.dmpFilesize
572KB
-
memory/1800-73-0x0000000000000000-mapping.dmp