Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
29-09-2021 17:06
Static task
static1
Behavioral task
behavioral1
Sample
1ZA109T4043832978.exe
Resource
win7-en-20210920
General
-
Target
1ZA109T4043832978.exe
-
Size
870KB
-
MD5
b9c97800cf3e146a5ab333672363db14
-
SHA1
545da9f150fcdf0994b87d09b26963c3a2788665
-
SHA256
5f849b2eff2280adf1041388bbad6fc2e4f047c36b6d942ecd4e07946352049c
-
SHA512
65f5ed4a6ebfb6125faa6f347070d391c5ec883f84603777605da2790cb8bf90c372e8d1bb86447479e2ddb3d63ea6b4fb089667a0fdb7ed6587b2416c7a7fb5
Malware Config
Extracted
xloader
2.5
tr7h
http://www.globalinterchangellc.com/tr7h/
hnhstudios.com
du-lang.com
lonestartradeoilllc.com
criptool.online
rebus-automotive.com
boxedwallconsepts.net
helixarray.com
jinqiaodianfen.com
goldenwaxi.com
comprarloterianacional.com
digebitdigital.com
cryptoupp.com
332151.com
bousui.club
redakassoumeh.com
giantinosglobalreachstore.com
resultsnft.com
papicolar.com
juvesti.com
tax-kaikei.com
fondosanimados.com
iamdrina.com
thenerdversity.com
dbdembroidery.com
credreality.com
brandinghollywood.com
texasshydraulics.com
empresafabago.com
oscyrk.com
greenworlder-game.com
smarti.space
cablerailingdesign.com
miura-conseil.biz
investoroffence.com
economicfreedomtools.com
xn--espaol101-o6a.online
tamoca.com
vezmnmnr.xyz
muniaduttafoundation.com
penshowmaps.com
thelettingagent.online
nfractal.digital
5151vip36.com
artelaser.net
001yu.xyz
xn--grlitzerseebhne-8sb7i.com
starlamovement.com
minacezsa.xyz
dizajnbalkona.store
edenhomeinspections.com
knx-concept.info
mccorveywedding.com
efterpisart.com
superbitems.com
beandhira.com
dawang999.com
kentvebaskanodulleri.com
range4tis.com
clark-painting.com
associatedmove.com
whwzhsw.com
yiganyimiao.com
pingwangjinrong.com
drivingflex.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3744-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3744-126-0x000000000041D4C0-mapping.dmp xloader behavioral2/memory/544-133-0x00000000008A0000-0x00000000008C9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
1ZA109T4043832978.exe1ZA109T4043832978.exesvchost.exedescription pid process target process PID 656 set thread context of 3744 656 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 3744 set thread context of 3060 3744 1ZA109T4043832978.exe Explorer.EXE PID 544 set thread context of 3060 544 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
1ZA109T4043832978.exesvchost.exepid process 3744 1ZA109T4043832978.exe 3744 1ZA109T4043832978.exe 3744 1ZA109T4043832978.exe 3744 1ZA109T4043832978.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe 544 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3060 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
1ZA109T4043832978.exesvchost.exepid process 3744 1ZA109T4043832978.exe 3744 1ZA109T4043832978.exe 3744 1ZA109T4043832978.exe 544 svchost.exe 544 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
1ZA109T4043832978.exesvchost.exedescription pid process Token: SeDebugPrivilege 3744 1ZA109T4043832978.exe Token: SeDebugPrivilege 544 svchost.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3060 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
1ZA109T4043832978.exeExplorer.EXEsvchost.exedescription pid process target process PID 656 wrote to memory of 3744 656 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 656 wrote to memory of 3744 656 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 656 wrote to memory of 3744 656 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 656 wrote to memory of 3744 656 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 656 wrote to memory of 3744 656 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 656 wrote to memory of 3744 656 1ZA109T4043832978.exe 1ZA109T4043832978.exe PID 3060 wrote to memory of 544 3060 Explorer.EXE svchost.exe PID 3060 wrote to memory of 544 3060 Explorer.EXE svchost.exe PID 3060 wrote to memory of 544 3060 Explorer.EXE svchost.exe PID 544 wrote to memory of 2556 544 svchost.exe cmd.exe PID 544 wrote to memory of 2556 544 svchost.exe cmd.exe PID 544 wrote to memory of 2556 544 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1ZA109T4043832978.exe"C:\Users\Admin\AppData\Local\Temp\1ZA109T4043832978.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1ZA109T4043832978.exe"C:\Users\Admin\AppData\Local\Temp\1ZA109T4043832978.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\1ZA109T4043832978.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/544-130-0x0000000000000000-mapping.dmp
-
memory/544-135-0x0000000003400000-0x0000000003490000-memory.dmpFilesize
576KB
-
memory/544-134-0x0000000003620000-0x0000000003940000-memory.dmpFilesize
3.1MB
-
memory/544-133-0x00000000008A0000-0x00000000008C9000-memory.dmpFilesize
164KB
-
memory/544-132-0x0000000000990000-0x000000000099C000-memory.dmpFilesize
48KB
-
memory/656-120-0x00000000087F0000-0x00000000087F1000-memory.dmpFilesize
4KB
-
memory/656-122-0x0000000008D20000-0x0000000008D88000-memory.dmpFilesize
416KB
-
memory/656-123-0x0000000008D90000-0x0000000008D92000-memory.dmpFilesize
8KB
-
memory/656-124-0x0000000008DB0000-0x0000000008DE8000-memory.dmpFilesize
224KB
-
memory/656-116-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/656-117-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/656-118-0x0000000005380000-0x000000000587E000-memory.dmpFilesize
5.0MB
-
memory/656-119-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/656-121-0x0000000005840000-0x0000000005853000-memory.dmpFilesize
76KB
-
memory/656-114-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/2556-131-0x0000000000000000-mapping.dmp
-
memory/3060-129-0x0000000006950000-0x0000000006A9F000-memory.dmpFilesize
1.3MB
-
memory/3060-136-0x0000000006CD0000-0x0000000006DEC000-memory.dmpFilesize
1.1MB
-
memory/3744-127-0x0000000001960000-0x0000000001C80000-memory.dmpFilesize
3.1MB
-
memory/3744-128-0x00000000018F0000-0x0000000001901000-memory.dmpFilesize
68KB
-
memory/3744-126-0x000000000041D4C0-mapping.dmp
-
memory/3744-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB