Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
29-10-2021 07:35
Static task
static1
Behavioral task
behavioral1
Sample
PO_#10292132.exe
Resource
win7-en-20210920
General
-
Target
PO_#10292132.exe
-
Size
377KB
-
MD5
026df37a937471af093a3e8bc8636b7b
-
SHA1
57d0b25b3dd1d648c710c3ff5e44041d39d0cafc
-
SHA256
28b77890ae9535db2da6bf03e7c41471d173b86fa67b907dafa38aede34fc148
-
SHA512
6efdd2b07055c93e9b18d169ed5f5a9d9aca550b76874ff36c1d6dc8687942bb401916463b85e410def704cdacb8e58d4311336605976bb3426439d557c698c0
Malware Config
Extracted
xloader
2.5
op08
http://www.jjmpestman.com/op08/
youva.online
bbyyn1.xyz
cuttizy.com
octoorder.com
empiredigitaldating.com
giuseppedelcampo.com
kingstons.info
kwanta.info
soulworkerrush.com
sookrit.com
flambeauxartpottery.com
360metaverse.online
adnilm.com
interiordesignhampshire.com
bitpaynumber.support
aliancafm.com
tivohub.xyz
xn--ucy193f.com
smartmapom.com
thelifeofrileyelizabeth.com
marlissfilms.com
radio-fm63-riom.com
termlifeinsurancerates.website
eldoradocash.com
industrialrocketlamp.com
fritzsisland.com
xchange.direct
gesunde-felle.com
cannabis-entreprise.com
imagineyouarehome.com
minxsystem.com
buddeltown.store
themagentospecialist.com
clusterpushchile.com
iniciar-es.cloud
lexhire.com
halston4corners.com
seikotrader.com
picsedits.net
credit-suisse-csx.com
sensinfo.art
uncoverthesecrets.com
kidfromtherock.club
eyeque.center
jobportalsg.com
wxhhdc.com
9146dx.com
ces341.com
madgeniustalk.com
oilelm.com
icd10withai.com
aranzaval.com
byglz.com
jl129.com
comettelectric.com
high-clicks3.com
davidfettermd.com
yashjo.com
663198.com
xn--2z1b43tzub2whod1gw2m.com
ryanhelm.com
emkabodrum.com
erickdechavez.com
atlantamodernhomes.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3492-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3492-125-0x000000000041D420-mapping.dmp xloader behavioral2/memory/404-132-0x0000000000E00000-0x0000000000E29000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO_#10292132.exePO_#10292132.exeraserver.exedescription pid process target process PID 2012 set thread context of 3492 2012 PO_#10292132.exe PO_#10292132.exe PID 3492 set thread context of 3008 3492 PO_#10292132.exe Explorer.EXE PID 404 set thread context of 3008 404 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
PO_#10292132.exeraserver.exepid process 3492 PO_#10292132.exe 3492 PO_#10292132.exe 3492 PO_#10292132.exe 3492 PO_#10292132.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe 404 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO_#10292132.exeraserver.exepid process 3492 PO_#10292132.exe 3492 PO_#10292132.exe 3492 PO_#10292132.exe 404 raserver.exe 404 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO_#10292132.exeraserver.exedescription pid process Token: SeDebugPrivilege 3492 PO_#10292132.exe Token: SeDebugPrivilege 404 raserver.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO_#10292132.exeExplorer.EXEraserver.exedescription pid process target process PID 2012 wrote to memory of 3492 2012 PO_#10292132.exe PO_#10292132.exe PID 2012 wrote to memory of 3492 2012 PO_#10292132.exe PO_#10292132.exe PID 2012 wrote to memory of 3492 2012 PO_#10292132.exe PO_#10292132.exe PID 2012 wrote to memory of 3492 2012 PO_#10292132.exe PO_#10292132.exe PID 2012 wrote to memory of 3492 2012 PO_#10292132.exe PO_#10292132.exe PID 2012 wrote to memory of 3492 2012 PO_#10292132.exe PO_#10292132.exe PID 3008 wrote to memory of 404 3008 Explorer.EXE raserver.exe PID 3008 wrote to memory of 404 3008 Explorer.EXE raserver.exe PID 3008 wrote to memory of 404 3008 Explorer.EXE raserver.exe PID 404 wrote to memory of 684 404 raserver.exe cmd.exe PID 404 wrote to memory of 684 404 raserver.exe cmd.exe PID 404 wrote to memory of 684 404 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_#10292132.exe"C:\Users\Admin\AppData\Local\Temp\PO_#10292132.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO_#10292132.exe"C:\Users\Admin\AppData\Local\Temp\PO_#10292132.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO_#10292132.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/404-130-0x0000000000000000-mapping.dmp
-
memory/404-135-0x0000000001080000-0x0000000001110000-memory.dmpFilesize
576KB
-
memory/404-133-0x0000000004560000-0x0000000004880000-memory.dmpFilesize
3.1MB
-
memory/404-132-0x0000000000E00000-0x0000000000E29000-memory.dmpFilesize
164KB
-
memory/404-131-0x0000000001140000-0x000000000115F000-memory.dmpFilesize
124KB
-
memory/684-134-0x0000000000000000-mapping.dmp
-
memory/2012-121-0x0000000005700000-0x0000000005706000-memory.dmpFilesize
24KB
-
memory/2012-119-0x00000000052D0000-0x0000000005362000-memory.dmpFilesize
584KB
-
memory/2012-117-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/2012-118-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/2012-123-0x0000000008BE0000-0x0000000008C2B000-memory.dmpFilesize
300KB
-
memory/2012-120-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/2012-115-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/2012-122-0x0000000008C30000-0x0000000008C31000-memory.dmpFilesize
4KB
-
memory/3008-129-0x00000000053E0000-0x00000000054E3000-memory.dmpFilesize
1.0MB
-
memory/3008-136-0x0000000002C70000-0x0000000002D57000-memory.dmpFilesize
924KB
-
memory/3492-127-0x0000000001A30000-0x0000000001D50000-memory.dmpFilesize
3.1MB
-
memory/3492-128-0x0000000001940000-0x0000000001951000-memory.dmpFilesize
68KB
-
memory/3492-125-0x000000000041D420-mapping.dmp
-
memory/3492-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB