Analysis
-
max time kernel
156s -
max time network
155s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-11-2021 15:50
Static task
static1
Behavioral task
behavioral1
Sample
Se adjunta el pedido, proforma.exe
Resource
win7-en-20211104
General
-
Target
Se adjunta el pedido, proforma.exe
-
Size
714KB
-
MD5
deea7525a547ed7a9ef6c81b04478f3e
-
SHA1
b29c935913a55c9bad3979d05d97a6ebda871604
-
SHA256
413e8df7f149aa643aaa1ef70e953ab2112827b652f1cf05b6420ed6a119962d
-
SHA512
ddb161a25bdc6465ddba19c8781773006e8cbf7b8e909aae20eb4cc577b085c72d75bed40b0d4ab2363003759a344b1aad2235381ab3c10043b3e47e2ee9f139
Malware Config
Extracted
xloader
2.5
euv4
http://www.rematedeldia.com/euv4/
anniebapartments.com
hagenbicycles.com
herbalist101.com
southerncorrosion.net
kuechenpruefer.com
tajniezdrzi.quest
segurofunerarioar.com
boardsandbeamsdecor.com
alifdanismanlik.com
pkem.top
mddc.clinic
handejqr.com
crux-at.com
awp.email
hugsforbubbs.com
cielotherepy.com
turkcuyuz.com
teamidc.com
lankasirinspa.com
68135.online
oprimanumerodos.com
launchclik.com
customapronsnow.com
thecuratedpour.com
20dzwww.com
encludemedia.com
kreativevisibility.net
mehfeels.com
oecmgroup.com
alert78.info
1207rossmoyne.com
spbutoto.com
t1uba.com
protection-onepa.com
byausorsm26-plala.xyz
bestpleasure4u.com
allmnlenem.quest
mobilpartes.com
fabio.tools
bubu3cin.com
nathanmartinez.digital
shristiprintingplaces.com
silkyflawless.com
berylgrote.top
laidbackfurniture.store
leatherman-neal.com
uschargeport.com
the-pumps.com
deepootech.com
drimev.com
seo-art.agency
jasabacklinkweb20.com
tracynicolalamond.com
dandtglaziers.com
vulacils.com
bendyourtongue.com
gulfund.com
ahmadfaizlajis.com
595531.com
metavillagehub.com
librairie-adrienne.com
77777.store
gongwenbo.com
game2plays.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1020-120-0x0000000000000000-mapping.dmp xloader behavioral2/memory/1020-123-0x0000000073D80000-0x0000000073DA9000-memory.dmp xloader behavioral2/memory/348-129-0x0000000000250000-0x0000000000279000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Se adjunta el pedido, proforma.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lxtcsmeg = "C:\\Users\\Admin\\Contacts\\Lxtcsmeg\\gemsctxL.url" Se adjunta el pedido, proforma.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
DpiScaling.exewlanext.exedescription pid process target process PID 1020 set thread context of 3024 1020 DpiScaling.exe Explorer.EXE PID 348 set thread context of 3024 348 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 56 IoCs
Processes:
DpiScaling.exewlanext.exepid process 1020 DpiScaling.exe 1020 DpiScaling.exe 1020 DpiScaling.exe 1020 DpiScaling.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe 348 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DpiScaling.exewlanext.exepid process 1020 DpiScaling.exe 1020 DpiScaling.exe 1020 DpiScaling.exe 348 wlanext.exe 348 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DpiScaling.exewlanext.exedescription pid process Token: SeDebugPrivilege 1020 DpiScaling.exe Token: SeDebugPrivilege 348 wlanext.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Se adjunta el pedido, proforma.exeExplorer.EXEwlanext.exedescription pid process target process PID 2768 wrote to memory of 1020 2768 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 2768 wrote to memory of 1020 2768 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 2768 wrote to memory of 1020 2768 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 2768 wrote to memory of 1020 2768 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 2768 wrote to memory of 1020 2768 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 2768 wrote to memory of 1020 2768 Se adjunta el pedido, proforma.exe DpiScaling.exe PID 3024 wrote to memory of 348 3024 Explorer.EXE wlanext.exe PID 3024 wrote to memory of 348 3024 Explorer.EXE wlanext.exe PID 3024 wrote to memory of 348 3024 Explorer.EXE wlanext.exe PID 348 wrote to memory of 60 348 wlanext.exe cmd.exe PID 348 wrote to memory of 60 348 wlanext.exe cmd.exe PID 348 wrote to memory of 60 348 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\Se adjunta el pedido, proforma.exe"C:\Users\Admin\AppData\Local\Temp\Se adjunta el pedido, proforma.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1020 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵PID:60
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/60-131-0x0000000000000000-mapping.dmp
-
memory/348-127-0x0000000000000000-mapping.dmp
-
memory/348-132-0x00000000029B0000-0x0000000002A40000-memory.dmpFilesize
576KB
-
memory/348-130-0x0000000002CF0000-0x0000000003010000-memory.dmpFilesize
3.1MB
-
memory/348-128-0x0000000000350000-0x0000000000367000-memory.dmpFilesize
92KB
-
memory/348-129-0x0000000000250000-0x0000000000279000-memory.dmpFilesize
164KB
-
memory/1020-123-0x0000000073D80000-0x0000000073DA9000-memory.dmpFilesize
164KB
-
memory/1020-125-0x0000000004B70000-0x0000000004B81000-memory.dmpFilesize
68KB
-
memory/1020-124-0x0000000004D20000-0x0000000005040000-memory.dmpFilesize
3.1MB
-
memory/1020-122-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/1020-120-0x0000000000000000-mapping.dmp
-
memory/2768-118-0x0000000002210000-0x0000000002211000-memory.dmpFilesize
4KB
-
memory/2768-119-0x0000000002901000-0x0000000002915000-memory.dmpFilesize
80KB
-
memory/3024-126-0x0000000006490000-0x00000000065D9000-memory.dmpFilesize
1.3MB
-
memory/3024-133-0x0000000002F70000-0x0000000003036000-memory.dmpFilesize
792KB