Analysis
-
max time kernel
147s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
25-10-2021 11:02
Static task
static1
Behavioral task
behavioral1
Sample
triage_dropped_file.exe
Resource
win7-en-20210920
General
-
Target
triage_dropped_file.exe
-
Size
941KB
-
MD5
538af9b3eb449aaf53eeaf6ecf3c4037
-
SHA1
edc27955b5d2388c7a2b792721941d2c270eac5a
-
SHA256
de43df6bd459b56aec0cd86e0873cc0c5b556e08547e2b9ea79082c44d9b7220
-
SHA512
a5eb2c410f8669bfb744158d459fe69221649d444394958774f2d91b7082c6537f798114ca51b395d7fe35db634cf41b86d6b7bb589ee17e0acd688bfea17ba3
Malware Config
Extracted
xloader
2.5
fpdi
http://www.walletwriter.space/fpdi/
jencio.com
b9jty7.com
banahinvestments.com
capitolfurniture.net
jlvip1086.com
pompeyocargo.com
designbyshubhi.info
elbauldepecas.com
bracelexx.online
advanceporbrx.xyz
ruihongco.com
wipemirecord.com
goodfoodsme.com
sommpick.com
rangilugujarat.com
realestate5g.com
spunkdlashes.com
palisadestahoehousing.com
brandingsocal.com
privatejetsboston.com
strataguide.com
pragmatismtoday.com
teslapro1.com
picturebookoriginals.com
nbrus.com
lafon-fr.com
studyallenergy.com
opensourcedao.com
cerulecode.com
c2spreader.info
hamiker.com
slimming-belt.store
myraandmarlow.com
sellanycar.online
mokkaoffice.com
strazde.com
haharate.quest
xgustify.xyz
sisoow.rest
awesomeclub98.club
ashleymariephotographyllc.com
mobilethaimassageatl.com
petswastepickup.com
eco1tnpasumo1.xyz
social-nudge.com
osmorobotics.com
99044222.com
xuebaousa.com
madisonbroadband.com
lisworldart.com
tzuzulcode.com
gonzagacargo.com
kanpekisien.com
currysrilanka.com
designedairservices.com
sato76.com
weinsteinanddouglas.com
gearella.com
tes5ci.com
obatkuatsemarang.xyz
tdaiarquitectura.com
reshawna.com
pfmtime.com
eastendfinancial.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/856-58-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/856-59-0x000000000041D460-mapping.dmp xloader behavioral1/memory/460-66-0x0000000000070000-0x0000000000099000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 792 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
triage_dropped_file.exetriage_dropped_file.execscript.exedescription pid process target process PID 1540 set thread context of 856 1540 triage_dropped_file.exe triage_dropped_file.exe PID 856 set thread context of 1212 856 triage_dropped_file.exe Explorer.EXE PID 460 set thread context of 1212 460 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
triage_dropped_file.execscript.exepid process 856 triage_dropped_file.exe 856 triage_dropped_file.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe 460 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
triage_dropped_file.execscript.exepid process 856 triage_dropped_file.exe 856 triage_dropped_file.exe 856 triage_dropped_file.exe 460 cscript.exe 460 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
triage_dropped_file.execscript.exedescription pid process Token: SeDebugPrivilege 856 triage_dropped_file.exe Token: SeDebugPrivilege 460 cscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
triage_dropped_file.exepid process 1540 triage_dropped_file.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
triage_dropped_file.exeExplorer.EXEcscript.exedescription pid process target process PID 1540 wrote to memory of 856 1540 triage_dropped_file.exe triage_dropped_file.exe PID 1540 wrote to memory of 856 1540 triage_dropped_file.exe triage_dropped_file.exe PID 1540 wrote to memory of 856 1540 triage_dropped_file.exe triage_dropped_file.exe PID 1540 wrote to memory of 856 1540 triage_dropped_file.exe triage_dropped_file.exe PID 1540 wrote to memory of 856 1540 triage_dropped_file.exe triage_dropped_file.exe PID 1540 wrote to memory of 856 1540 triage_dropped_file.exe triage_dropped_file.exe PID 1540 wrote to memory of 856 1540 triage_dropped_file.exe triage_dropped_file.exe PID 1212 wrote to memory of 460 1212 Explorer.EXE cscript.exe PID 1212 wrote to memory of 460 1212 Explorer.EXE cscript.exe PID 1212 wrote to memory of 460 1212 Explorer.EXE cscript.exe PID 1212 wrote to memory of 460 1212 Explorer.EXE cscript.exe PID 460 wrote to memory of 792 460 cscript.exe cmd.exe PID 460 wrote to memory of 792 460 cscript.exe cmd.exe PID 460 wrote to memory of 792 460 cscript.exe cmd.exe PID 460 wrote to memory of 792 460 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:856 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"3⤵
- Deletes itself
PID:792
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/460-64-0x0000000000000000-mapping.dmp
-
memory/460-69-0x0000000002010000-0x00000000020A0000-memory.dmpFilesize
576KB
-
memory/460-68-0x00000000020A0000-0x00000000023A3000-memory.dmpFilesize
3.0MB
-
memory/460-66-0x0000000000070000-0x0000000000099000-memory.dmpFilesize
164KB
-
memory/460-65-0x0000000000AE0000-0x0000000000B02000-memory.dmpFilesize
136KB
-
memory/792-67-0x0000000000000000-mapping.dmp
-
memory/856-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/856-62-0x00000000002C0000-0x00000000002D1000-memory.dmpFilesize
68KB
-
memory/856-60-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/856-59-0x000000000041D460-mapping.dmp
-
memory/856-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/856-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1212-63-0x0000000006DD0000-0x0000000006F08000-memory.dmpFilesize
1.2MB
-
memory/1212-70-0x0000000003F20000-0x0000000003FDE000-memory.dmpFilesize
760KB
-
memory/1540-54-0x0000000000220000-0x0000000000226000-memory.dmpFilesize
24KB
-
memory/1540-55-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB