Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-09-2021 17:06
Static task
static1
Behavioral task
behavioral1
Sample
1ZA109T4043832978.exe
Resource
win7-en-20210920
General
-
Target
1ZA109T4043832978.exe
-
Size
870KB
-
MD5
b9c97800cf3e146a5ab333672363db14
-
SHA1
545da9f150fcdf0994b87d09b26963c3a2788665
-
SHA256
5f849b2eff2280adf1041388bbad6fc2e4f047c36b6d942ecd4e07946352049c
-
SHA512
65f5ed4a6ebfb6125faa6f347070d391c5ec883f84603777605da2790cb8bf90c372e8d1bb86447479e2ddb3d63ea6b4fb089667a0fdb7ed6587b2416c7a7fb5
Malware Config
Extracted
xloader
2.5
tr7h
http://www.globalinterchangellc.com/tr7h/
hnhstudios.com
du-lang.com
lonestartradeoilllc.com
criptool.online
rebus-automotive.com
boxedwallconsepts.net
helixarray.com
jinqiaodianfen.com
goldenwaxi.com
comprarloterianacional.com
digebitdigital.com
cryptoupp.com
332151.com
bousui.club
redakassoumeh.com
giantinosglobalreachstore.com
resultsnft.com
papicolar.com
juvesti.com
tax-kaikei.com
fondosanimados.com
iamdrina.com
thenerdversity.com
dbdembroidery.com
credreality.com
brandinghollywood.com
texasshydraulics.com
empresafabago.com
oscyrk.com
greenworlder-game.com
smarti.space
cablerailingdesign.com
miura-conseil.biz
investoroffence.com
economicfreedomtools.com
xn--espaol101-o6a.online
tamoca.com
vezmnmnr.xyz
muniaduttafoundation.com
penshowmaps.com
thelettingagent.online
nfractal.digital
5151vip36.com
artelaser.net
001yu.xyz
xn--grlitzerseebhne-8sb7i.com
starlamovement.com
minacezsa.xyz
dizajnbalkona.store
edenhomeinspections.com
knx-concept.info
mccorveywedding.com
efterpisart.com
superbitems.com
beandhira.com
dawang999.com
kentvebaskanodulleri.com
range4tis.com
clark-painting.com
associatedmove.com
whwzhsw.com
yiganyimiao.com
pingwangjinrong.com
drivingflex.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/976-60-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/976-61-0x000000000041D4C0-mapping.dmp xloader behavioral1/memory/1852-70-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 584 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
1ZA109T4043832978.exe1ZA109T4043832978.exeraserver.exedescription pid process target process PID 1756 set thread context of 976 1756 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 976 set thread context of 1364 976 1ZA109T4043832978.exe Explorer.EXE PID 976 set thread context of 1364 976 1ZA109T4043832978.exe Explorer.EXE PID 1852 set thread context of 1364 1852 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
1ZA109T4043832978.exeraserver.exepid process 976 1ZA109T4043832978.exe 976 1ZA109T4043832978.exe 976 1ZA109T4043832978.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe 1852 raserver.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
1ZA109T4043832978.exeraserver.exepid process 976 1ZA109T4043832978.exe 976 1ZA109T4043832978.exe 976 1ZA109T4043832978.exe 976 1ZA109T4043832978.exe 1852 raserver.exe 1852 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1ZA109T4043832978.exeraserver.exedescription pid process Token: SeDebugPrivilege 976 1ZA109T4043832978.exe Token: SeDebugPrivilege 1852 raserver.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE 1364 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE 1364 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
1ZA109T4043832978.exe1ZA109T4043832978.exeraserver.exedescription pid process target process PID 1756 wrote to memory of 976 1756 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1756 wrote to memory of 976 1756 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1756 wrote to memory of 976 1756 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1756 wrote to memory of 976 1756 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1756 wrote to memory of 976 1756 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1756 wrote to memory of 976 1756 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 1756 wrote to memory of 976 1756 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 976 wrote to memory of 1852 976 1ZA109T4043832978.exe raserver.exe PID 976 wrote to memory of 1852 976 1ZA109T4043832978.exe raserver.exe PID 976 wrote to memory of 1852 976 1ZA109T4043832978.exe raserver.exe PID 976 wrote to memory of 1852 976 1ZA109T4043832978.exe raserver.exe PID 1852 wrote to memory of 584 1852 raserver.exe cmd.exe PID 1852 wrote to memory of 584 1852 raserver.exe cmd.exe PID 1852 wrote to memory of 584 1852 raserver.exe cmd.exe PID 1852 wrote to memory of 584 1852 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\1ZA109T4043832978.exe"C:\Users\Admin\AppData\Local\Temp\1ZA109T4043832978.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1ZA109T4043832978.exe"C:\Users\Admin\AppData\Local\Temp\1ZA109T4043832978.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\1ZA109T4043832978.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/584-71-0x0000000000000000-mapping.dmp
-
memory/976-62-0x0000000000C90000-0x0000000000F93000-memory.dmpFilesize
3.0MB
-
memory/976-65-0x00000000001D0000-0x00000000001E1000-memory.dmpFilesize
68KB
-
memory/976-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/976-61-0x000000000041D4C0-mapping.dmp
-
memory/976-63-0x0000000000190000-0x00000000001A1000-memory.dmpFilesize
68KB
-
memory/1364-74-0x0000000003FB0000-0x000000000404D000-memory.dmpFilesize
628KB
-
memory/1364-66-0x0000000006FE0000-0x000000000710D000-memory.dmpFilesize
1.2MB
-
memory/1364-64-0x0000000006440000-0x0000000006582000-memory.dmpFilesize
1.3MB
-
memory/1756-59-0x00000000045E0000-0x0000000004618000-memory.dmpFilesize
224KB
-
memory/1756-53-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/1756-58-0x00000000009C0000-0x00000000009C2000-memory.dmpFilesize
8KB
-
memory/1756-57-0x0000000007DD0000-0x0000000007E38000-memory.dmpFilesize
416KB
-
memory/1756-56-0x00000000009A0000-0x00000000009B3000-memory.dmpFilesize
76KB
-
memory/1756-55-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/1852-67-0x0000000000000000-mapping.dmp
-
memory/1852-68-0x0000000076B61000-0x0000000076B63000-memory.dmpFilesize
8KB
-
memory/1852-69-0x00000000001E0000-0x00000000001FC000-memory.dmpFilesize
112KB
-
memory/1852-70-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1852-72-0x0000000001F90000-0x0000000002293000-memory.dmpFilesize
3.0MB
-
memory/1852-73-0x0000000001E00000-0x0000000001E90000-memory.dmpFilesize
576KB