Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-10-2021 07:35
Static task
static1
Behavioral task
behavioral1
Sample
PO_#10292132.exe
Resource
win7-en-20210920
General
-
Target
PO_#10292132.exe
-
Size
377KB
-
MD5
026df37a937471af093a3e8bc8636b7b
-
SHA1
57d0b25b3dd1d648c710c3ff5e44041d39d0cafc
-
SHA256
28b77890ae9535db2da6bf03e7c41471d173b86fa67b907dafa38aede34fc148
-
SHA512
6efdd2b07055c93e9b18d169ed5f5a9d9aca550b76874ff36c1d6dc8687942bb401916463b85e410def704cdacb8e58d4311336605976bb3426439d557c698c0
Malware Config
Extracted
xloader
2.5
op08
http://www.jjmpestman.com/op08/
youva.online
bbyyn1.xyz
cuttizy.com
octoorder.com
empiredigitaldating.com
giuseppedelcampo.com
kingstons.info
kwanta.info
soulworkerrush.com
sookrit.com
flambeauxartpottery.com
360metaverse.online
adnilm.com
interiordesignhampshire.com
bitpaynumber.support
aliancafm.com
tivohub.xyz
xn--ucy193f.com
smartmapom.com
thelifeofrileyelizabeth.com
marlissfilms.com
radio-fm63-riom.com
termlifeinsurancerates.website
eldoradocash.com
industrialrocketlamp.com
fritzsisland.com
xchange.direct
gesunde-felle.com
cannabis-entreprise.com
imagineyouarehome.com
minxsystem.com
buddeltown.store
themagentospecialist.com
clusterpushchile.com
iniciar-es.cloud
lexhire.com
halston4corners.com
seikotrader.com
picsedits.net
credit-suisse-csx.com
sensinfo.art
uncoverthesecrets.com
kidfromtherock.club
eyeque.center
jobportalsg.com
wxhhdc.com
9146dx.com
ces341.com
madgeniustalk.com
oilelm.com
icd10withai.com
aranzaval.com
byglz.com
jl129.com
comettelectric.com
high-clicks3.com
davidfettermd.com
yashjo.com
663198.com
xn--2z1b43tzub2whod1gw2m.com
ryanhelm.com
emkabodrum.com
erickdechavez.com
atlantamodernhomes.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1308-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1308-62-0x000000000041D420-mapping.dmp xloader behavioral1/memory/960-71-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 748 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO_#10292132.exePO_#10292132.execmstp.exedescription pid process target process PID 1564 set thread context of 1308 1564 PO_#10292132.exe PO_#10292132.exe PID 1308 set thread context of 1264 1308 PO_#10292132.exe Explorer.EXE PID 960 set thread context of 1264 960 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
PO_#10292132.execmstp.exepid process 1308 PO_#10292132.exe 1308 PO_#10292132.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe 960 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO_#10292132.execmstp.exepid process 1308 PO_#10292132.exe 1308 PO_#10292132.exe 1308 PO_#10292132.exe 960 cmstp.exe 960 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO_#10292132.execmstp.exedescription pid process Token: SeDebugPrivilege 1308 PO_#10292132.exe Token: SeDebugPrivilege 960 cmstp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
PO_#10292132.exeExplorer.EXEcmstp.exedescription pid process target process PID 1564 wrote to memory of 1308 1564 PO_#10292132.exe PO_#10292132.exe PID 1564 wrote to memory of 1308 1564 PO_#10292132.exe PO_#10292132.exe PID 1564 wrote to memory of 1308 1564 PO_#10292132.exe PO_#10292132.exe PID 1564 wrote to memory of 1308 1564 PO_#10292132.exe PO_#10292132.exe PID 1564 wrote to memory of 1308 1564 PO_#10292132.exe PO_#10292132.exe PID 1564 wrote to memory of 1308 1564 PO_#10292132.exe PO_#10292132.exe PID 1564 wrote to memory of 1308 1564 PO_#10292132.exe PO_#10292132.exe PID 1264 wrote to memory of 960 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 960 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 960 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 960 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 960 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 960 1264 Explorer.EXE cmstp.exe PID 1264 wrote to memory of 960 1264 Explorer.EXE cmstp.exe PID 960 wrote to memory of 748 960 cmstp.exe cmd.exe PID 960 wrote to memory of 748 960 cmstp.exe cmd.exe PID 960 wrote to memory of 748 960 cmstp.exe cmd.exe PID 960 wrote to memory of 748 960 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_#10292132.exe"C:\Users\Admin\AppData\Local\Temp\PO_#10292132.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_#10292132.exe"C:\Users\Admin\AppData\Local\Temp\PO_#10292132.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO_#10292132.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/748-72-0x0000000000000000-mapping.dmp
-
memory/960-73-0x0000000000820000-0x00000000008B0000-memory.dmpFilesize
576KB
-
memory/960-70-0x0000000001F60000-0x0000000002263000-memory.dmpFilesize
3.0MB
-
memory/960-71-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/960-69-0x0000000000450000-0x0000000000468000-memory.dmpFilesize
96KB
-
memory/960-68-0x0000000075821000-0x0000000075823000-memory.dmpFilesize
8KB
-
memory/960-67-0x0000000000000000-mapping.dmp
-
memory/1264-66-0x0000000006CE0000-0x0000000006E73000-memory.dmpFilesize
1.6MB
-
memory/1264-74-0x0000000005F90000-0x0000000006066000-memory.dmpFilesize
856KB
-
memory/1308-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1308-65-0x0000000000210000-0x0000000000221000-memory.dmpFilesize
68KB
-
memory/1308-64-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/1308-62-0x000000000041D420-mapping.dmp
-
memory/1308-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1308-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1564-54-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/1564-58-0x0000000000E40000-0x0000000000E8B000-memory.dmpFilesize
300KB
-
memory/1564-57-0x0000000000AC0000-0x0000000000AC6000-memory.dmpFilesize
24KB
-
memory/1564-56-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB