Analysis
-
max time kernel
158s -
max time network
162s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-09-2021 10:05
Static task
static1
Behavioral task
behavioral1
Sample
Original Scan_Doc Ref 28538013241899233.exe
Resource
win7-en-20210920
General
-
Target
Original Scan_Doc Ref 28538013241899233.exe
-
Size
912KB
-
MD5
6fb08a5130cdfc1ba7da0133a916733c
-
SHA1
4c781c859da4a76de1e8c942b4d712c37fb8ca72
-
SHA256
18421819d1c37b2be9b6ce90781a538e28f1238486a2f3d60ef682e0fb80f529
-
SHA512
5572042fab4d2d8d88bb42745ffc33da8af5c9b763cbd8a8a2d50442b46db6b120a79f2cc7c47bbabf10aaff4a7de97251ea3f7148e2d8c1bf0ad90917cbf4fc
Malware Config
Extracted
xloader
2.5
epns
http://www.lnvietnam.online/epns/
mmfaccao.com
blttsperma.quest
946abe.net
indispensablehands.com
jkformationfrance.com
phonerepaire.com
lienquan-trian.com
youkuti.com
empowermindbodystudios.com
seunicapf.com
fk-link.xyz
kunai.tech
difficultbutdoablebrand.com
ejworkspace.com
teracorp.biz
thekids.today
quintaalentejana.com
annaviruksham.com
jshengrong.com
nsmetalmakina.xyz
hentainftd.com
alphabet-chicken-farms.com
erotikchat.red
skintipsllc.com
expressofertachegou.com
ygraeriotexniki.com
thesidehustler.net
visionries.com
deployinghigh.com
havana-smile.com
exclusivegift7.com
ephraimhomedeals.com
westquartier.com
kiingear.com
officecom-myaccount.com
lemomentconcept.com
royalteacherclass.com
alltart.com
hustlershandbook.biz
mxpvlv.biz
canalcorporate.com
carcity.toys
k6tkuwrnjake.biz
acrobike69.com
4000518883.com
katia-magnetisme.com
shiningproent.com
ikmbc-b02.com
thoughtsbig.com
baba.clinic
blazestead.com
12monthmillionairetraining.com
goodtasteonline.com
nokushop.com
teneses.com
215oldtoby.com
pampelina.com
eimzaizmir.com
newnetteline.com
discovertexasbeaches.com
farrukhportfolio.website
bombers.xyz
melissacarbonell.group
5402506.win
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1272-115-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1272-116-0x000000000041D410-mapping.dmp xloader behavioral2/memory/1416-122-0x0000000000FE0000-0x0000000001009000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Original Scan_Doc Ref 28538013241899233.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Whwpmnj = "C:\\Users\\Public\\Libraries\\jnmpwhW.url" Original Scan_Doc Ref 28538013241899233.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Original Scan_Doc Ref 28538013241899233.exeOriginal Scan_Doc Ref 28538013241899233.exewlanext.exedescription pid process target process PID 996 set thread context of 1272 996 Original Scan_Doc Ref 28538013241899233.exe Original Scan_Doc Ref 28538013241899233.exe PID 1272 set thread context of 2180 1272 Original Scan_Doc Ref 28538013241899233.exe Explorer.EXE PID 1416 set thread context of 2180 1416 wlanext.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
Original Scan_Doc Ref 28538013241899233.exewlanext.exepid process 1272 Original Scan_Doc Ref 28538013241899233.exe 1272 Original Scan_Doc Ref 28538013241899233.exe 1272 Original Scan_Doc Ref 28538013241899233.exe 1272 Original Scan_Doc Ref 28538013241899233.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe 1416 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2180 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Original Scan_Doc Ref 28538013241899233.exewlanext.exepid process 1272 Original Scan_Doc Ref 28538013241899233.exe 1272 Original Scan_Doc Ref 28538013241899233.exe 1272 Original Scan_Doc Ref 28538013241899233.exe 1416 wlanext.exe 1416 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
Original Scan_Doc Ref 28538013241899233.exewlanext.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1272 Original Scan_Doc Ref 28538013241899233.exe Token: SeDebugPrivilege 1416 wlanext.exe Token: SeShutdownPrivilege 2180 Explorer.EXE Token: SeCreatePagefilePrivilege 2180 Explorer.EXE Token: SeShutdownPrivilege 2180 Explorer.EXE Token: SeCreatePagefilePrivilege 2180 Explorer.EXE Token: SeShutdownPrivilege 2180 Explorer.EXE Token: SeCreatePagefilePrivilege 2180 Explorer.EXE Token: SeShutdownPrivilege 2180 Explorer.EXE Token: SeCreatePagefilePrivilege 2180 Explorer.EXE -
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
Explorer.EXEpid process 2180 Explorer.EXE 2180 Explorer.EXE 2180 Explorer.EXE 2180 Explorer.EXE 2180 Explorer.EXE 2180 Explorer.EXE 2180 Explorer.EXE 2180 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Original Scan_Doc Ref 28538013241899233.exeExplorer.EXEdescription pid process target process PID 996 wrote to memory of 1272 996 Original Scan_Doc Ref 28538013241899233.exe Original Scan_Doc Ref 28538013241899233.exe PID 996 wrote to memory of 1272 996 Original Scan_Doc Ref 28538013241899233.exe Original Scan_Doc Ref 28538013241899233.exe PID 996 wrote to memory of 1272 996 Original Scan_Doc Ref 28538013241899233.exe Original Scan_Doc Ref 28538013241899233.exe PID 996 wrote to memory of 1272 996 Original Scan_Doc Ref 28538013241899233.exe Original Scan_Doc Ref 28538013241899233.exe PID 996 wrote to memory of 1272 996 Original Scan_Doc Ref 28538013241899233.exe Original Scan_Doc Ref 28538013241899233.exe PID 2180 wrote to memory of 1416 2180 Explorer.EXE wlanext.exe PID 2180 wrote to memory of 1416 2180 Explorer.EXE wlanext.exe PID 2180 wrote to memory of 1416 2180 Explorer.EXE wlanext.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Original Scan_Doc Ref 28538013241899233.exe"C:\Users\Admin\AppData\Local\Temp\Original Scan_Doc Ref 28538013241899233.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Original Scan_Doc Ref 28538013241899233.exe"C:\Users\Admin\AppData\Local\Temp\Original Scan_Doc Ref 28538013241899233.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/996-114-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/1272-115-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1272-116-0x000000000041D410-mapping.dmp
-
memory/1272-118-0x00000000009E0000-0x00000000009F1000-memory.dmpFilesize
68KB
-
memory/1272-117-0x0000000000A20000-0x0000000000D40000-memory.dmpFilesize
3.1MB
-
memory/1416-120-0x0000000000000000-mapping.dmp
-
memory/1416-121-0x0000000001130000-0x0000000001147000-memory.dmpFilesize
92KB
-
memory/1416-122-0x0000000000FE0000-0x0000000001009000-memory.dmpFilesize
164KB
-
memory/1416-123-0x00000000039B0000-0x0000000003CD0000-memory.dmpFilesize
3.1MB
-
memory/1416-124-0x0000000003860000-0x00000000038F0000-memory.dmpFilesize
576KB
-
memory/2180-119-0x00000000064B0000-0x00000000065FD000-memory.dmpFilesize
1.3MB
-
memory/2180-125-0x0000000005660000-0x0000000005773000-memory.dmpFilesize
1.1MB