Analysis
- max time kernel
153s - max time network
153s - platform
windows10_x64 - resource
win10v20210408 - submitted
07/10/2021, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
IMG100897 TWI-SHA 202102 BANK SHEETS.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target IMG100897 TWI-SHA 202102 BANK SHEETS.exe
- Size 774KB
- Sample211007-jq1a3scccp
- SHA256 700c8d2a1ebc0994ccd09f93acadb4806ed3554cdef24c8e9ef0b3801646bbde
- MD5 46bf448f0f13973dca9b0818f23fbdcb
- SHA1 83e78c785903a560b44bd419f5a2e74266a98eab
- SHA512 84570ab18ce5c42bfc3f266432043f64730b14611e5d5d2b246bbe4d528abedb704a173dcd3f69c50a3e7cd767eb5fdba8db5d289312b6e1da00b5b1ea60895a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
epns
C2
-
http://www.lnvietnam.online/epns/
Decoy
-
mmfaccao.com
-
blttsperma.quest
-
946abe.net
-
indispensablehands.com
-
jkformationfrance.com
-
phonerepaire.com
-
lienquan-trian.com
-
youkuti.com
-
empowermindbodystudios.com
-
seunicapf.com
-
fk-link.xyz
-
kunai.tech
-
difficultbutdoablebrand.com
-
ejworkspace.com
-
teracorp.biz
-
thekids.today
-
quintaalentejana.com
-
annaviruksham.com
-
jshengrong.com
-
nsmetalmakina.xyz
-
hentainftd.com
-
alphabet-chicken-farms.com
-
erotikchat.red
-
skintipsllc.com
-
expressofertachegou.com
-
ygraeriotexniki.com
-
thesidehustler.net
-
visionries.com
-
deployinghigh.com
-
havana-smile.com
-
exclusivegift7.com
-
ephraimhomedeals.com
-
westquartier.com
-
kiingear.com
-
officecom-myaccount.com
-
lemomentconcept.com
-
royalteacherclass.com
-
alltart.com
-
hustlershandbook.biz
-
mxpvlv.biz
-
canalcorporate.com
-
carcity.toys
-
k6tkuwrnjake.biz
-
acrobike69.com
-
4000518883.com
-
katia-magnetisme.com
-
shiningproent.com
-
ikmbc-b02.com
-
thoughtsbig.com
-
baba.clinic
-
blazestead.com
-
12monthmillionairetraining.com
-
goodtasteonline.com
-
nokushop.com
-
teneses.com
-
215oldtoby.com
-
pampelina.com
-
eimzaizmir.com
-
newnetteline.com
-
discovertexasbeaches.com
-
farrukhportfolio.website
-
bombers.xyz
-
melissacarbonell.group
-
5402506.win
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/1164-116-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1164-117-0x000000000041D410-mapping.dmp xloader behavioral2/memory/1200-123-0x0000000000700000-0x0000000000729000-memory.dmp xloader - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Blfiknt = "C:\\Users\\Public\\Libraries\\tnkiflB.url" IMG100897 TWI-SHA 202102 BANK SHEETS.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 664 set thread context of 1164 664 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 68 PID 1164 set thread context of 3024 1164 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 22 PID 1200 set thread context of 3024 1200 cmd.exe 22 - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1164 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 1164 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 1164 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 1164 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe 1200 cmd.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1164 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 1164 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 1164 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 1200 cmd.exe 1200 cmd.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1164 IMG100897 TWI-SHA 202102 BANK SHEETS.exe Token: SeDebugPrivilege 1200 cmd.exe Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 664 wrote to memory of 1164 664 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 68 PID 664 wrote to memory of 1164 664 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 68 PID 664 wrote to memory of 1164 664 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 68 PID 664 wrote to memory of 1164 664 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 68 PID 664 wrote to memory of 1164 664 IMG100897 TWI-SHA 202102 BANK SHEETS.exe 68 PID 3024 wrote to memory of 1200 3024 Explorer.EXE 69 PID 3024 wrote to memory of 1200 3024 Explorer.EXE 69 PID 3024 wrote to memory of 1200 3024 Explorer.EXE 69
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\IMG100897 TWI-SHA 202102 BANK SHEETS.exe"C:\Users\Admin\AppData\Local\Temp\IMG100897 TWI-SHA 202102 BANK SHEETS.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Users\Admin\AppData\Local\Temp\IMG100897 TWI-SHA 202102 BANK SHEETS.exe"C:\Users\Admin\AppData\Local\Temp\IMG100897 TWI-SHA 202102 BANK SHEETS.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1200
-