Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
20-10-2021 05:37
Static task
static1
Behavioral task
behavioral1
Sample
Drawing.exe
Resource
win7-en-20211014
General
-
Target
Drawing.exe
-
Size
572KB
-
MD5
da60dccf62e5dd00e76531b6e0e74794
-
SHA1
a9bb11bbb6bcc1cb69b302bcec25ec29d770e6d4
-
SHA256
88f9f44e6cb13da79a3967ffa56a9d8c46d8d49623518df5e90c3d4cf72b3b79
-
SHA512
e6e25dbcc0b8669f781da4533783f5cf9abb568762837c03768369b4b9d99e4b637ff1a06f1829d53b683e2dc2ade14831bc5df804e42d2516f9ed96e6f6a74f
Malware Config
Extracted
xloader
2.5
dq6e
http://www.nihiufypsz.quest/dq6e/
one80.center
buymorefun.store
wiew-bkjm.com
elvalordesertu.com
tallyeyeglassery.net
nuhive.net
supportsmercari.com
h5625.com
dfgroup.website
personlig-almanacka.com
gunpow3r.com
xn--tiergesttzt-0hb.com
mpochip.com
accreditslots.com
gameplancyber.com
clickonline.website
bhagyashreerestaurant.com
lunaenglish.online
kidsorange.com
reshapers.art
19hawthornedrive166.com
allisonholaday.com
tuner-buy.com
lehyeh.com
salonspasuitesmanamgement.com
gordianits.com
zhuoyu168.com
jokeaou.com
tous-des-cons.club
ilmn8.com
geetamalhotra.com
crescentiron.com
therecipe.store
teneses.com
liberbankrtes.com
lifechangingcarehouston.com
balanz.express
poizboutique.com
anblogsite.com
chicherone.com
rotibagelen.com
trendystoreonline2021.com
boudoirluxe.com
grandhoums.com
oneloyalty.online
ospreyoutlet.store
xn--hc0bm0v0zb40ifs0a.com
localizandolab.com
mmorpgheroes.net
bodies-gym.xyz
thenorthdale.com
lasikeyesurgerysclinicus.com
pwntheusa.com
eaiworwek.xyz
almatnstore.com
savandehop.com
primetire.net
d-destiny.com
delmarexclusive.com
magentasrc.com
3danimation.xyz
getjano.com
cakeriver.com
wazis.store
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1456-63-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 544 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Drawing.exeDrawing.exeNETSTAT.EXEdescription pid process target process PID 1604 set thread context of 1660 1604 Drawing.exe Drawing.exe PID 1660 set thread context of 1360 1660 Drawing.exe Explorer.EXE PID 1456 set thread context of 1360 1456 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1456 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
Drawing.exeNETSTAT.EXEpid process 1660 Drawing.exe 1660 Drawing.exe 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE 1456 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Drawing.exeNETSTAT.EXEpid process 1660 Drawing.exe 1660 Drawing.exe 1660 Drawing.exe 1456 NETSTAT.EXE 1456 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Drawing.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1660 Drawing.exe Token: SeDebugPrivilege 1456 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Drawing.exepid process 1604 Drawing.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Drawing.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1604 wrote to memory of 1660 1604 Drawing.exe Drawing.exe PID 1604 wrote to memory of 1660 1604 Drawing.exe Drawing.exe PID 1604 wrote to memory of 1660 1604 Drawing.exe Drawing.exe PID 1604 wrote to memory of 1660 1604 Drawing.exe Drawing.exe PID 1604 wrote to memory of 1660 1604 Drawing.exe Drawing.exe PID 1360 wrote to memory of 1456 1360 Explorer.EXE NETSTAT.EXE PID 1360 wrote to memory of 1456 1360 Explorer.EXE NETSTAT.EXE PID 1360 wrote to memory of 1456 1360 Explorer.EXE NETSTAT.EXE PID 1360 wrote to memory of 1456 1360 Explorer.EXE NETSTAT.EXE PID 1456 wrote to memory of 544 1456 NETSTAT.EXE cmd.exe PID 1456 wrote to memory of 544 1456 NETSTAT.EXE cmd.exe PID 1456 wrote to memory of 544 1456 NETSTAT.EXE cmd.exe PID 1456 wrote to memory of 544 1456 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Drawing.exe"C:\Users\Admin\AppData\Local\Temp\Drawing.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Drawing.exe"C:\Users\Admin\AppData\Local\Temp\Drawing.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Drawing.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/544-61-0x0000000000000000-mapping.dmp
-
memory/1360-59-0x0000000007000000-0x0000000007168000-memory.dmpFilesize
1.4MB
-
memory/1360-66-0x0000000005F90000-0x000000000602B000-memory.dmpFilesize
620KB
-
memory/1456-60-0x0000000000000000-mapping.dmp
-
memory/1456-62-0x0000000000C70000-0x0000000000C79000-memory.dmpFilesize
36KB
-
memory/1456-63-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1456-64-0x0000000002210000-0x0000000002513000-memory.dmpFilesize
3.0MB
-
memory/1456-65-0x0000000000AF0000-0x0000000000B80000-memory.dmpFilesize
576KB
-
memory/1604-55-0x0000000075F41000-0x0000000075F43000-memory.dmpFilesize
8KB
-
memory/1660-56-0x000000000041D430-mapping.dmp
-
memory/1660-58-0x0000000000330000-0x0000000000341000-memory.dmpFilesize
68KB
-
memory/1660-57-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB