Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
25-10-2021 11:06
Static task
static1
Behavioral task
behavioral1
Sample
triage_dropped_file.exe
Resource
win7-en-20210920
General
-
Target
triage_dropped_file.exe
-
Size
941KB
-
MD5
538af9b3eb449aaf53eeaf6ecf3c4037
-
SHA1
edc27955b5d2388c7a2b792721941d2c270eac5a
-
SHA256
de43df6bd459b56aec0cd86e0873cc0c5b556e08547e2b9ea79082c44d9b7220
-
SHA512
a5eb2c410f8669bfb744158d459fe69221649d444394958774f2d91b7082c6537f798114ca51b395d7fe35db634cf41b86d6b7bb589ee17e0acd688bfea17ba3
Malware Config
Extracted
xloader
2.5
fpdi
http://www.walletwriter.space/fpdi/
jencio.com
b9jty7.com
banahinvestments.com
capitolfurniture.net
jlvip1086.com
pompeyocargo.com
designbyshubhi.info
elbauldepecas.com
bracelexx.online
advanceporbrx.xyz
ruihongco.com
wipemirecord.com
goodfoodsme.com
sommpick.com
rangilugujarat.com
realestate5g.com
spunkdlashes.com
palisadestahoehousing.com
brandingsocal.com
privatejetsboston.com
strataguide.com
pragmatismtoday.com
teslapro1.com
picturebookoriginals.com
nbrus.com
lafon-fr.com
studyallenergy.com
opensourcedao.com
cerulecode.com
c2spreader.info
hamiker.com
slimming-belt.store
myraandmarlow.com
sellanycar.online
mokkaoffice.com
strazde.com
haharate.quest
xgustify.xyz
sisoow.rest
awesomeclub98.club
ashleymariephotographyllc.com
mobilethaimassageatl.com
petswastepickup.com
eco1tnpasumo1.xyz
social-nudge.com
osmorobotics.com
99044222.com
xuebaousa.com
madisonbroadband.com
lisworldart.com
tzuzulcode.com
gonzagacargo.com
kanpekisien.com
currysrilanka.com
designedairservices.com
sato76.com
weinsteinanddouglas.com
gearella.com
tes5ci.com
obatkuatsemarang.xyz
tdaiarquitectura.com
reshawna.com
pfmtime.com
eastendfinancial.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/720-58-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/720-59-0x000000000041D460-mapping.dmp xloader behavioral1/memory/1120-67-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader behavioral1/memory/784-80-0x000000000041D460-mapping.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
systray1b0dit2.exesystray1b0dit2.exepid process 1672 systray1b0dit2.exe 784 systray1b0dit2.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1812 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mstsc.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MBDX6TP8OX = "C:\\Program Files (x86)\\U-z4\\systray1b0dit2.exe" mstsc.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
triage_dropped_file.exetriage_dropped_file.exemstsc.exesystray1b0dit2.exedescription pid process target process PID 820 set thread context of 720 820 triage_dropped_file.exe triage_dropped_file.exe PID 720 set thread context of 1264 720 triage_dropped_file.exe Explorer.EXE PID 1120 set thread context of 1264 1120 mstsc.exe Explorer.EXE PID 1672 set thread context of 784 1672 systray1b0dit2.exe systray1b0dit2.exe -
Drops file in Program Files directory 3 IoCs
Processes:
mstsc.exeExplorer.EXEsystray1b0dit2.exedescription ioc process File opened for modification C:\Program Files (x86)\U-z4\systray1b0dit2.exe mstsc.exe File created C:\Program Files (x86)\U-z4\systray1b0dit2.exe Explorer.EXE File opened for modification C:\Program Files (x86)\U-z4\systray1b0dit2.exe systray1b0dit2.exe -
Processes:
mstsc.exedescription ioc process Key created \Registry\User\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
triage_dropped_file.exemstsc.exesystray1b0dit2.exepid process 720 triage_dropped_file.exe 720 triage_dropped_file.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 784 systray1b0dit2.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
triage_dropped_file.exemstsc.exepid process 720 triage_dropped_file.exe 720 triage_dropped_file.exe 720 triage_dropped_file.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe 1120 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
triage_dropped_file.exemstsc.exesystray1b0dit2.exedescription pid process Token: SeDebugPrivilege 720 triage_dropped_file.exe Token: SeDebugPrivilege 1120 mstsc.exe Token: SeDebugPrivilege 784 systray1b0dit2.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
triage_dropped_file.exesystray1b0dit2.exepid process 820 triage_dropped_file.exe 1672 systray1b0dit2.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
triage_dropped_file.exeExplorer.EXEmstsc.exesystray1b0dit2.exedescription pid process target process PID 820 wrote to memory of 720 820 triage_dropped_file.exe triage_dropped_file.exe PID 820 wrote to memory of 720 820 triage_dropped_file.exe triage_dropped_file.exe PID 820 wrote to memory of 720 820 triage_dropped_file.exe triage_dropped_file.exe PID 820 wrote to memory of 720 820 triage_dropped_file.exe triage_dropped_file.exe PID 820 wrote to memory of 720 820 triage_dropped_file.exe triage_dropped_file.exe PID 820 wrote to memory of 720 820 triage_dropped_file.exe triage_dropped_file.exe PID 820 wrote to memory of 720 820 triage_dropped_file.exe triage_dropped_file.exe PID 1264 wrote to memory of 1120 1264 Explorer.EXE mstsc.exe PID 1264 wrote to memory of 1120 1264 Explorer.EXE mstsc.exe PID 1264 wrote to memory of 1120 1264 Explorer.EXE mstsc.exe PID 1264 wrote to memory of 1120 1264 Explorer.EXE mstsc.exe PID 1120 wrote to memory of 1812 1120 mstsc.exe cmd.exe PID 1120 wrote to memory of 1812 1120 mstsc.exe cmd.exe PID 1120 wrote to memory of 1812 1120 mstsc.exe cmd.exe PID 1120 wrote to memory of 1812 1120 mstsc.exe cmd.exe PID 1120 wrote to memory of 824 1120 mstsc.exe Firefox.exe PID 1120 wrote to memory of 824 1120 mstsc.exe Firefox.exe PID 1120 wrote to memory of 824 1120 mstsc.exe Firefox.exe PID 1120 wrote to memory of 824 1120 mstsc.exe Firefox.exe PID 1264 wrote to memory of 1672 1264 Explorer.EXE systray1b0dit2.exe PID 1264 wrote to memory of 1672 1264 Explorer.EXE systray1b0dit2.exe PID 1264 wrote to memory of 1672 1264 Explorer.EXE systray1b0dit2.exe PID 1264 wrote to memory of 1672 1264 Explorer.EXE systray1b0dit2.exe PID 1672 wrote to memory of 784 1672 systray1b0dit2.exe systray1b0dit2.exe PID 1672 wrote to memory of 784 1672 systray1b0dit2.exe systray1b0dit2.exe PID 1672 wrote to memory of 784 1672 systray1b0dit2.exe systray1b0dit2.exe PID 1672 wrote to memory of 784 1672 systray1b0dit2.exe systray1b0dit2.exe PID 1672 wrote to memory of 784 1672 systray1b0dit2.exe systray1b0dit2.exe PID 1672 wrote to memory of 784 1672 systray1b0dit2.exe systray1b0dit2.exe PID 1672 wrote to memory of 784 1672 systray1b0dit2.exe systray1b0dit2.exe PID 1120 wrote to memory of 824 1120 mstsc.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:720 -
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"3⤵
- Deletes itself
PID:1812 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:824
-
C:\Program Files (x86)\U-z4\systray1b0dit2.exe"C:\Program Files (x86)\U-z4\systray1b0dit2.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Program Files (x86)\U-z4\systray1b0dit2.exe"C:\Program Files (x86)\U-z4\systray1b0dit2.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\U-z4\systray1b0dit2.exeMD5
538af9b3eb449aaf53eeaf6ecf3c4037
SHA1edc27955b5d2388c7a2b792721941d2c270eac5a
SHA256de43df6bd459b56aec0cd86e0873cc0c5b556e08547e2b9ea79082c44d9b7220
SHA512a5eb2c410f8669bfb744158d459fe69221649d444394958774f2d91b7082c6537f798114ca51b395d7fe35db634cf41b86d6b7bb589ee17e0acd688bfea17ba3
-
C:\Program Files (x86)\U-z4\systray1b0dit2.exeMD5
538af9b3eb449aaf53eeaf6ecf3c4037
SHA1edc27955b5d2388c7a2b792721941d2c270eac5a
SHA256de43df6bd459b56aec0cd86e0873cc0c5b556e08547e2b9ea79082c44d9b7220
SHA512a5eb2c410f8669bfb744158d459fe69221649d444394958774f2d91b7082c6537f798114ca51b395d7fe35db634cf41b86d6b7bb589ee17e0acd688bfea17ba3
-
C:\Program Files (x86)\U-z4\systray1b0dit2.exeMD5
538af9b3eb449aaf53eeaf6ecf3c4037
SHA1edc27955b5d2388c7a2b792721941d2c270eac5a
SHA256de43df6bd459b56aec0cd86e0873cc0c5b556e08547e2b9ea79082c44d9b7220
SHA512a5eb2c410f8669bfb744158d459fe69221649d444394958774f2d91b7082c6537f798114ca51b395d7fe35db634cf41b86d6b7bb589ee17e0acd688bfea17ba3
-
memory/720-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/720-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/720-59-0x000000000041D460-mapping.dmp
-
memory/720-61-0x0000000000740000-0x0000000000A43000-memory.dmpFilesize
3.0MB
-
memory/720-62-0x0000000000360000-0x0000000000371000-memory.dmpFilesize
68KB
-
memory/720-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/784-82-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/784-80-0x000000000041D460-mapping.dmp
-
memory/820-55-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/820-54-0x0000000000220000-0x0000000000226000-memory.dmpFilesize
24KB
-
memory/1120-68-0x0000000002190000-0x0000000002493000-memory.dmpFilesize
3.0MB
-
memory/1120-70-0x0000000000AC0000-0x0000000000B50000-memory.dmpFilesize
576KB
-
memory/1120-66-0x0000000000C80000-0x0000000000D84000-memory.dmpFilesize
1.0MB
-
memory/1120-67-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1120-65-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/1120-64-0x0000000000000000-mapping.dmp
-
memory/1264-71-0x0000000006E20000-0x0000000006F84000-memory.dmpFilesize
1.4MB
-
memory/1264-63-0x0000000006CE0000-0x0000000006E13000-memory.dmpFilesize
1.2MB
-
memory/1672-72-0x0000000000000000-mapping.dmp
-
memory/1672-74-0x0000000000270000-0x0000000000276000-memory.dmpFilesize
24KB
-
memory/1672-75-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB
-
memory/1812-69-0x0000000000000000-mapping.dmp