Analysis
-
max time kernel
146s -
max time network
140s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
25-11-2021 15:50
Static task
static1
Behavioral task
behavioral1
Sample
Se adjunta el pedido, proforma.exe
Resource
win7-en-20211104
General
-
Target
Se adjunta el pedido, proforma.exe
-
Size
714KB
-
MD5
deea7525a547ed7a9ef6c81b04478f3e
-
SHA1
b29c935913a55c9bad3979d05d97a6ebda871604
-
SHA256
413e8df7f149aa643aaa1ef70e953ab2112827b652f1cf05b6420ed6a119962d
-
SHA512
ddb161a25bdc6465ddba19c8781773006e8cbf7b8e909aae20eb4cc577b085c72d75bed40b0d4ab2363003759a344b1aad2235381ab3c10043b3e47e2ee9f139
Malware Config
Extracted
xloader
2.5
euv4
http://www.rematedeldia.com/euv4/
anniebapartments.com
hagenbicycles.com
herbalist101.com
southerncorrosion.net
kuechenpruefer.com
tajniezdrzi.quest
segurofunerarioar.com
boardsandbeamsdecor.com
alifdanismanlik.com
pkem.top
mddc.clinic
handejqr.com
crux-at.com
awp.email
hugsforbubbs.com
cielotherepy.com
turkcuyuz.com
teamidc.com
lankasirinspa.com
68135.online
oprimanumerodos.com
launchclik.com
customapronsnow.com
thecuratedpour.com
20dzwww.com
encludemedia.com
kreativevisibility.net
mehfeels.com
oecmgroup.com
alert78.info
1207rossmoyne.com
spbutoto.com
t1uba.com
protection-onepa.com
byausorsm26-plala.xyz
bestpleasure4u.com
allmnlenem.quest
mobilpartes.com
fabio.tools
bubu3cin.com
nathanmartinez.digital
shristiprintingplaces.com
silkyflawless.com
berylgrote.top
laidbackfurniture.store
leatherman-neal.com
uschargeport.com
the-pumps.com
deepootech.com
drimev.com
seo-art.agency
jasabacklinkweb20.com
tracynicolalamond.com
dandtglaziers.com
vulacils.com
bendyourtongue.com
gulfund.com
ahmadfaizlajis.com
595531.com
metavillagehub.com
librairie-adrienne.com
77777.store
gongwenbo.com
game2plays.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1748-61-0x0000000000000000-mapping.dmp xloader behavioral1/memory/1748-65-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/1496-73-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
mstsc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run mstsc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\HNUXN448_6- = "C:\\Program Files (x86)\\G-zp8d\\ThumbCacheqjstczi.exe" mstsc.exe -
Executes dropped EXE 1 IoCs
Processes:
ThumbCacheqjstczi.exepid process 1820 ThumbCacheqjstczi.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Se adjunta el pedido, proforma.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lxtcsmeg = "C:\\Users\\Admin\\Contacts\\Lxtcsmeg\\gemsctxL.url" Se adjunta el pedido, proforma.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
DpiScaling.exemstsc.exedescription pid process target process PID 1748 set thread context of 1360 1748 DpiScaling.exe Explorer.EXE PID 1496 set thread context of 1360 1496 mstsc.exe Explorer.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
mstsc.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\G-zp8d\ThumbCacheqjstczi.exe mstsc.exe File created C:\Program Files (x86)\G-zp8d\ThumbCacheqjstczi.exe Explorer.EXE -
Processes:
mstsc.exeExplorer.EXEdescription ioc process Key created \Registry\User\S-1-5-21-103686315-404690609-2047157615-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 mstsc.exe Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar Explorer.EXE Set value (int) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" Explorer.EXE -
Modifies registry class 3 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Explorer.EXE Set value (data) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
DpiScaling.exemstsc.exepid process 1748 DpiScaling.exe 1748 DpiScaling.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
DpiScaling.exemstsc.exepid process 1748 DpiScaling.exe 1748 DpiScaling.exe 1748 DpiScaling.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe 1496 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
DpiScaling.exemstsc.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1748 DpiScaling.exe Token: SeDebugPrivilege 1496 mstsc.exe Token: SeShutdownPrivilege 1360 Explorer.EXE Token: SeShutdownPrivilege 1360 Explorer.EXE -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
Se adjunta el pedido, proforma.exeExplorer.EXEmstsc.exedescription pid process target process PID 1072 wrote to memory of 1748 1072 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 1072 wrote to memory of 1748 1072 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 1072 wrote to memory of 1748 1072 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 1072 wrote to memory of 1748 1072 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 1072 wrote to memory of 1748 1072 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 1072 wrote to memory of 1748 1072 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 1072 wrote to memory of 1748 1072 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 1360 wrote to memory of 1496 1360 Explorer.EXE mstsc.exe PID 1360 wrote to memory of 1496 1360 Explorer.EXE mstsc.exe PID 1360 wrote to memory of 1496 1360 Explorer.EXE mstsc.exe PID 1360 wrote to memory of 1496 1360 Explorer.EXE mstsc.exe PID 1496 wrote to memory of 1480 1496 mstsc.exe cmd.exe PID 1496 wrote to memory of 1480 1496 mstsc.exe cmd.exe PID 1496 wrote to memory of 1480 1496 mstsc.exe cmd.exe PID 1496 wrote to memory of 1480 1496 mstsc.exe cmd.exe PID 1496 wrote to memory of 1976 1496 mstsc.exe Firefox.exe PID 1496 wrote to memory of 1976 1496 mstsc.exe Firefox.exe PID 1496 wrote to memory of 1976 1496 mstsc.exe Firefox.exe PID 1496 wrote to memory of 1976 1496 mstsc.exe Firefox.exe PID 1360 wrote to memory of 1820 1360 Explorer.EXE ThumbCacheqjstczi.exe PID 1360 wrote to memory of 1820 1360 Explorer.EXE ThumbCacheqjstczi.exe PID 1360 wrote to memory of 1820 1360 Explorer.EXE ThumbCacheqjstczi.exe PID 1360 wrote to memory of 1820 1360 Explorer.EXE ThumbCacheqjstczi.exe PID 1496 wrote to memory of 1976 1496 mstsc.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Se adjunta el pedido, proforma.exe"C:\Users\Admin\AppData\Local\Temp\Se adjunta el pedido, proforma.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\G-zp8d\ThumbCacheqjstczi.exe"C:\Program Files (x86)\G-zp8d\ThumbCacheqjstczi.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\G-zp8d\ThumbCacheqjstczi.exeMD5
8c9da2e414e713d3daff1f18223ae11b
SHA19ef90d73fa4d852be9b803a5e990cc908aab8a94
SHA25660b2a9d679f14f92e284ad21395da53652db137e45ec6473d9033e6c3fe6a37f
SHA512adc712d94e8226729b336a348e9376d68f1e006871e7a0151f312e125e96226e74bc75e87efd709e31c5cb322a9ed68e2912c9fd03bd6e6800f5900f712105d7
-
C:\Program Files (x86)\G-zp8d\ThumbCacheqjstczi.exeMD5
8c9da2e414e713d3daff1f18223ae11b
SHA19ef90d73fa4d852be9b803a5e990cc908aab8a94
SHA25660b2a9d679f14f92e284ad21395da53652db137e45ec6473d9033e6c3fe6a37f
SHA512adc712d94e8226729b336a348e9376d68f1e006871e7a0151f312e125e96226e74bc75e87efd709e31c5cb322a9ed68e2912c9fd03bd6e6800f5900f712105d7
-
memory/1072-56-0x0000000000301000-0x0000000000315000-memory.dmpFilesize
80KB
-
memory/1072-57-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1072-55-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/1360-68-0x0000000004290000-0x0000000004348000-memory.dmpFilesize
736KB
-
memory/1360-76-0x0000000006880000-0x0000000006960000-memory.dmpFilesize
896KB
-
memory/1480-71-0x0000000000000000-mapping.dmp
-
memory/1496-74-0x00000000020D0000-0x00000000023D3000-memory.dmpFilesize
3.0MB
-
memory/1496-72-0x0000000000A30000-0x0000000000B34000-memory.dmpFilesize
1.0MB
-
memory/1496-75-0x0000000001F40000-0x0000000001FD0000-memory.dmpFilesize
576KB
-
memory/1496-69-0x0000000000000000-mapping.dmp
-
memory/1496-73-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/1748-66-0x0000000001F80000-0x0000000002283000-memory.dmpFilesize
3.0MB
-
memory/1748-67-0x0000000000280000-0x0000000000291000-memory.dmpFilesize
68KB
-
memory/1748-64-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/1748-65-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/1748-61-0x0000000000000000-mapping.dmp
-
memory/1748-59-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1748-58-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/1820-77-0x0000000000000000-mapping.dmp
-
memory/1820-80-0x0000000072F01000-0x0000000072F03000-memory.dmpFilesize
8KB