Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
08-11-2021 07:08
Static task
static1
Behavioral task
behavioral1
Sample
Enquiry Reference Number 0025559278.exe
Resource
win7-en-20211104
General
-
Target
Enquiry Reference Number 0025559278.exe
-
Size
744KB
-
MD5
cd9435966d20de265bc5f6f40daff4a3
-
SHA1
76cb2ab21a6009275ba3dcbe256a15a211833f35
-
SHA256
45790f1cc3cb37ecfe541981ddf9d25684d92576cceb6bdb809f345014de84f0
-
SHA512
95b3749be5950d52c3124df37971a0d03f3c7dd10168df13d9d2a2e523f6c435e51866207d9263f12164d86ab9e310ad098175ef59b9f1d83c678197cb44d528
Malware Config
Extracted
xloader
2.5
u0n0
http://www.52xjg3.xyz/u0n0/
learnwithvr.net
minismi2.com
slimfitbottle.com
gzartisan.com
fullfamilyclub.com
adaptationstudios.com
domynt.com
aboydnfuid.com
dirtroaddesigns.net
timhortons-ca.xyz
gladiator-111.com
breakingza.com
njjbds.com
keithrgordon.com
litestore365.host
unichromegame.com
wundversorgung-tirol.com
wholistic-choice.com
shingletownrrn.com
kapikenya.com
kermmehienon.quest
harunowellness.com
avrknastyrke.quest
mpujadas.com
bonbyk.xyz
twozilla.com
abrahamguestacademy.com
canwasysce.com
cangshu76.xyz
clinicadeconsultanta.com
fazdesignmalta.com
localcommunityspace.com
subdlt.com
gothambody.net
tongtongticket.com
giadinhmarket.xyz
jessaniholdings.com
sebika.com
infinitygamesonline.net
denton4.com
ctenemuhos.quest
governerdsummerfun.com
69988.club
2pnlx3.biz
radhikamobilerajasen.online
myborntoshare.com
mdkfsdf.info
dj6688a.com
feelinthorny.com
minimart.digital
offprize.xyz
niallsinclair.com
iclouds.today
xn--80ajy8a.xn--80asehdb
marionutrishop.com
yanglaowenku.com
youngmotorist.com
unavidaparaserfeliz.com
linknhomkin.com
webwarez.net
sabrinaxmendes.com
nurix.agency
bancosabadellnow.com
totalpopsociety.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/916-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/916-126-0x000000000041D440-mapping.dmp xloader behavioral2/memory/2580-133-0x0000000000D50000-0x0000000000D79000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Enquiry Reference Number 0025559278.exeEnquiry Reference Number 0025559278.exewscript.exedescription pid process target process PID 2732 set thread context of 916 2732 Enquiry Reference Number 0025559278.exe Enquiry Reference Number 0025559278.exe PID 916 set thread context of 3056 916 Enquiry Reference Number 0025559278.exe Explorer.EXE PID 2580 set thread context of 3056 2580 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
Enquiry Reference Number 0025559278.exewscript.exepid process 916 Enquiry Reference Number 0025559278.exe 916 Enquiry Reference Number 0025559278.exe 916 Enquiry Reference Number 0025559278.exe 916 Enquiry Reference Number 0025559278.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe 2580 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Enquiry Reference Number 0025559278.exewscript.exepid process 916 Enquiry Reference Number 0025559278.exe 916 Enquiry Reference Number 0025559278.exe 916 Enquiry Reference Number 0025559278.exe 2580 wscript.exe 2580 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Enquiry Reference Number 0025559278.exewscript.exedescription pid process Token: SeDebugPrivilege 916 Enquiry Reference Number 0025559278.exe Token: SeDebugPrivilege 2580 wscript.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Enquiry Reference Number 0025559278.exeExplorer.EXEwscript.exedescription pid process target process PID 2732 wrote to memory of 916 2732 Enquiry Reference Number 0025559278.exe Enquiry Reference Number 0025559278.exe PID 2732 wrote to memory of 916 2732 Enquiry Reference Number 0025559278.exe Enquiry Reference Number 0025559278.exe PID 2732 wrote to memory of 916 2732 Enquiry Reference Number 0025559278.exe Enquiry Reference Number 0025559278.exe PID 2732 wrote to memory of 916 2732 Enquiry Reference Number 0025559278.exe Enquiry Reference Number 0025559278.exe PID 2732 wrote to memory of 916 2732 Enquiry Reference Number 0025559278.exe Enquiry Reference Number 0025559278.exe PID 2732 wrote to memory of 916 2732 Enquiry Reference Number 0025559278.exe Enquiry Reference Number 0025559278.exe PID 3056 wrote to memory of 2580 3056 Explorer.EXE wscript.exe PID 3056 wrote to memory of 2580 3056 Explorer.EXE wscript.exe PID 3056 wrote to memory of 2580 3056 Explorer.EXE wscript.exe PID 2580 wrote to memory of 1608 2580 wscript.exe cmd.exe PID 2580 wrote to memory of 1608 2580 wscript.exe cmd.exe PID 2580 wrote to memory of 1608 2580 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Enquiry Reference Number 0025559278.exe"C:\Users\Admin\AppData\Local\Temp\Enquiry Reference Number 0025559278.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Enquiry Reference Number 0025559278.exe"C:\Users\Admin\AppData\Local\Temp\Enquiry Reference Number 0025559278.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Enquiry Reference Number 0025559278.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/916-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/916-129-0x0000000001590000-0x00000000015A1000-memory.dmpFilesize
68KB
-
memory/916-128-0x00000000015B0000-0x00000000018D0000-memory.dmpFilesize
3.1MB
-
memory/916-126-0x000000000041D440-mapping.dmp
-
memory/1608-134-0x0000000000000000-mapping.dmp
-
memory/2580-133-0x0000000000D50000-0x0000000000D79000-memory.dmpFilesize
164KB
-
memory/2580-131-0x0000000000000000-mapping.dmp
-
memory/2580-136-0x0000000004D10000-0x0000000004DA0000-memory.dmpFilesize
576KB
-
memory/2580-135-0x0000000004F90000-0x00000000052B0000-memory.dmpFilesize
3.1MB
-
memory/2580-132-0x0000000000E60000-0x0000000000E87000-memory.dmpFilesize
156KB
-
memory/2732-115-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2732-119-0x0000000004BF0000-0x0000000004BF1000-memory.dmpFilesize
4KB
-
memory/2732-118-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/2732-120-0x0000000004C40000-0x000000000513E000-memory.dmpFilesize
5.0MB
-
memory/2732-122-0x0000000006FC0000-0x0000000006FC7000-memory.dmpFilesize
28KB
-
memory/2732-121-0x00000000072B0000-0x00000000072B1000-memory.dmpFilesize
4KB
-
memory/2732-117-0x0000000005140000-0x0000000005141000-memory.dmpFilesize
4KB
-
memory/2732-124-0x00000000087D0000-0x0000000008816000-memory.dmpFilesize
280KB
-
memory/2732-123-0x0000000008870000-0x0000000008871000-memory.dmpFilesize
4KB
-
memory/3056-130-0x00000000025C0000-0x00000000026AB000-memory.dmpFilesize
940KB
-
memory/3056-137-0x0000000005050000-0x0000000005114000-memory.dmpFilesize
784KB