Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22-10-2021 08:05
Static task
static1
Behavioral task
behavioral1
Sample
Scan_10384648.exe
Resource
win7-en-20211014
General
-
Target
Scan_10384648.exe
-
Size
493KB
-
MD5
74e58b71d9d25130e6b47e1adccd1cf8
-
SHA1
92fb13e26c1c0ed3698cece64aabe0834b74e798
-
SHA256
4645255a1302be5b36e6814261279dc48d24f03c3a170b0b2efca04adacd2718
-
SHA512
991695fd0ea85daf11e7d6da0a9f2079b9da9c46b217ccdccaba6cfdf83ed501188e1efedadab077c5d4bd33bfa430d9456d80ba1b3f92565ab7db5fa0021321
Malware Config
Extracted
xloader
2.5
yjqn
http://www.wavekiss.com/yjqn/
ittybittybunnies.com
flordedesierto.com
cum.care
petshomespace.com
verputzarbeit.com
yuvajanmat.com
getlie.com
finanes.xyz
thelazyrando.com
domelite.design
yukinko-takasu.com
pontosmensal.com
maurlinoconstruction.com
getelectronow.com
newmexicocarwrecklawfirm.com
gunnbucks.com
ncsy30.xyz
opsem.info
authorisewallet.com
scchanghe.com
dpisa.info
z5r9t.online
paisleiskreations.com
arabatalmustahlik.com
summahred.com
moodplans.com
theglobalonlineacademy.com
dutchdollhouse.com
strolleyluggage.online
qimai51.com
2day-sweeps.info
skyguardens.com
lilijewls.com
if.services
teneses.com
bwteeco.com
walletsupportsnow.com
mk696.com
suddennnnnnnnnnnn48.xyz
alphadogsocial.com
michitorres.com
trybestchoice.com
axelar.academy
mountlaketerraceapartment.com
webmakers.xyz
domaineregnard.com
snail-sky.com
jengibre.xyz
sichuanyitai.com
otqrfw.com
rcdating.com
youyushops.com
fltraffic.net
68065123.com
standingoncommonground.net
eqzaec.com
yujieqin.com
aquitemtijolo.com
worldhealthplanet.com
galmbacher-legal.com
acumen-international.com
predictablecomfort365.com
atesex.com
roboruben.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1196-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1196-125-0x000000000041D3B0-mapping.dmp xloader behavioral2/memory/2476-132-0x0000000002F90000-0x0000000002FB9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Scan_10384648.exeScan_10384648.execmmon32.exedescription pid process target process PID 1976 set thread context of 1196 1976 Scan_10384648.exe Scan_10384648.exe PID 1196 set thread context of 3068 1196 Scan_10384648.exe Explorer.EXE PID 2476 set thread context of 3068 2476 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
Scan_10384648.execmmon32.exepid process 1196 Scan_10384648.exe 1196 Scan_10384648.exe 1196 Scan_10384648.exe 1196 Scan_10384648.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe 2476 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3068 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Scan_10384648.execmmon32.exepid process 1196 Scan_10384648.exe 1196 Scan_10384648.exe 1196 Scan_10384648.exe 2476 cmmon32.exe 2476 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Scan_10384648.execmmon32.exedescription pid process Token: SeDebugPrivilege 1196 Scan_10384648.exe Token: SeDebugPrivilege 2476 cmmon32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Scan_10384648.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1976 wrote to memory of 1196 1976 Scan_10384648.exe Scan_10384648.exe PID 1976 wrote to memory of 1196 1976 Scan_10384648.exe Scan_10384648.exe PID 1976 wrote to memory of 1196 1976 Scan_10384648.exe Scan_10384648.exe PID 1976 wrote to memory of 1196 1976 Scan_10384648.exe Scan_10384648.exe PID 1976 wrote to memory of 1196 1976 Scan_10384648.exe Scan_10384648.exe PID 1976 wrote to memory of 1196 1976 Scan_10384648.exe Scan_10384648.exe PID 3068 wrote to memory of 2476 3068 Explorer.EXE cmmon32.exe PID 3068 wrote to memory of 2476 3068 Explorer.EXE cmmon32.exe PID 3068 wrote to memory of 2476 3068 Explorer.EXE cmmon32.exe PID 2476 wrote to memory of 3404 2476 cmmon32.exe cmd.exe PID 2476 wrote to memory of 3404 2476 cmmon32.exe cmd.exe PID 2476 wrote to memory of 3404 2476 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan_10384648.exe"C:\Users\Admin\AppData\Local\Temp\Scan_10384648.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan_10384648.exe"C:\Users\Admin\AppData\Local\Temp\Scan_10384648.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Scan_10384648.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1196-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1196-127-0x0000000000F10000-0x0000000001230000-memory.dmpFilesize
3.1MB
-
memory/1196-128-0x0000000001270000-0x0000000001281000-memory.dmpFilesize
68KB
-
memory/1196-125-0x000000000041D3B0-mapping.dmp
-
memory/1976-121-0x0000000005E30000-0x0000000005E37000-memory.dmpFilesize
28KB
-
memory/1976-117-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/1976-122-0x0000000008D60000-0x0000000008D61000-memory.dmpFilesize
4KB
-
memory/1976-123-0x0000000008D10000-0x0000000008D5B000-memory.dmpFilesize
300KB
-
memory/1976-120-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/1976-119-0x00000000051A0000-0x000000000569E000-memory.dmpFilesize
5.0MB
-
memory/1976-118-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/1976-115-0x0000000000780000-0x0000000000781000-memory.dmpFilesize
4KB
-
memory/2476-130-0x0000000000000000-mapping.dmp
-
memory/2476-132-0x0000000002F90000-0x0000000002FB9000-memory.dmpFilesize
164KB
-
memory/2476-131-0x00000000002F0000-0x00000000002FC000-memory.dmpFilesize
48KB
-
memory/2476-134-0x00000000046C0000-0x00000000049E0000-memory.dmpFilesize
3.1MB
-
memory/2476-135-0x0000000004A70000-0x0000000004B00000-memory.dmpFilesize
576KB
-
memory/3068-129-0x0000000006400000-0x0000000006535000-memory.dmpFilesize
1.2MB
-
memory/3068-136-0x0000000006540000-0x0000000006677000-memory.dmpFilesize
1.2MB
-
memory/3404-133-0x0000000000000000-mapping.dmp