Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
14-12-2021 12:06
Static task
static1
Behavioral task
behavioral1
Sample
tmp/femp.exe
Resource
win7-en-20211208
General
-
Target
tmp/femp.exe
-
Size
344KB
-
MD5
c62a556b445ff8cf1b9e0b038a13137e
-
SHA1
7fefc1609a4e66d234abb47a1536857317bdb31b
-
SHA256
4b3af4ebfe94ecb1730c15620080935f619b6592fad681921968f986c030c0c3
-
SHA512
c372806da30c98b047d46f8e70cce90f93829fe484ff5eb49354bd132a846ff126ea4c7024e5fae8de60c96117d940ea4fe2d6c783c67987354c7eee99c4638e
Malware Config
Extracted
xloader
2.5
ef6c
http://www.fis.photos/ef6c/
gicaredocs.com
govusergroup.com
conversationspit.com
brondairy.com
rjtherealest.com
xn--9m1bq8wgkag3rjvb.com
mylori.net
softandcute.store
ahljsm.com
shacksolid.com
weekendmusecollection.com
gaminghallarna.net
pgonline111.online
44mpt.xyz
ambrandt.com
eddytattoo.com
blendeqes.com
upinmyfeels.com
lacucinadesign.com
docomoau.xyz
xn--90armbk7e.online
xzq585858.net
kidzgovroom.com
lhznqyl.press
publicationsplace.com
jakante.com
csspadding.com
test-testjisdnsec.store
lafabriqueabeilleassurances.com
clf010.com
buybabysnuggle.com
uzmdrmustafaalperaykanat.com
levanttradegroup.com
arcflorals.com
kinglot2499.com
freekagyans.com
region10group.gmbh
yeyelm744.com
thehomedesigncentre.com
vngc.xyz
szesdkj.com
charlottewright.online
planetgreennetwork.com
pacifica7.com
analogueadapt.com
sensorypantry.com
narbaal.com
restaurant-utopia.xyz
golnay.com
szyyglass.com
redelirevearyseuiop.xyz
goldsteelconstruction.com
discovercotswoldcottages.com
geniuseven.net
apricitee.com
stopmoshenik.online
ya2gh.com
instatechnovelz.com
dbe648.com
seifjuban.com
conquershirts.store
totalcovidtravel.com
pamperotrabajo.com
satellitphonestore.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4392-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4392-125-0x000000000041D3D0-mapping.dmp xloader behavioral2/memory/4392-130-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4468-135-0x0000000000590000-0x00000000005B9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
femp.exefemp.execmd.exedescription pid process target process PID 3824 set thread context of 4392 3824 femp.exe femp.exe PID 4392 set thread context of 3032 4392 femp.exe Explorer.EXE PID 4392 set thread context of 3032 4392 femp.exe Explorer.EXE PID 4468 set thread context of 3032 4468 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
femp.execmd.exepid process 4392 femp.exe 4392 femp.exe 4392 femp.exe 4392 femp.exe 4392 femp.exe 4392 femp.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe 4468 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3032 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
femp.execmd.exepid process 4392 femp.exe 4392 femp.exe 4392 femp.exe 4392 femp.exe 4468 cmd.exe 4468 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
femp.execmd.exedescription pid process Token: SeDebugPrivilege 4392 femp.exe Token: SeDebugPrivilege 4468 cmd.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
femp.exeExplorer.EXEcmd.exedescription pid process target process PID 3824 wrote to memory of 4392 3824 femp.exe femp.exe PID 3824 wrote to memory of 4392 3824 femp.exe femp.exe PID 3824 wrote to memory of 4392 3824 femp.exe femp.exe PID 3824 wrote to memory of 4392 3824 femp.exe femp.exe PID 3824 wrote to memory of 4392 3824 femp.exe femp.exe PID 3824 wrote to memory of 4392 3824 femp.exe femp.exe PID 3032 wrote to memory of 4468 3032 Explorer.EXE cmd.exe PID 3032 wrote to memory of 4468 3032 Explorer.EXE cmd.exe PID 3032 wrote to memory of 4468 3032 Explorer.EXE cmd.exe PID 4468 wrote to memory of 3260 4468 cmd.exe cmd.exe PID 4468 wrote to memory of 3260 4468 cmd.exe cmd.exe PID 4468 wrote to memory of 3260 4468 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\femp.exe"C:\Users\Admin\AppData\Local\Temp\tmp\femp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\femp.exe"C:\Users\Admin\AppData\Local\Temp\tmp\femp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp\femp.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3032-129-0x00000000067A0000-0x00000000068ED000-memory.dmpFilesize
1.3MB
-
memory/3032-139-0x00000000035A0000-0x0000000003633000-memory.dmpFilesize
588KB
-
memory/3032-132-0x0000000003350000-0x0000000003404000-memory.dmpFilesize
720KB
-
memory/3260-137-0x0000000000000000-mapping.dmp
-
memory/3824-117-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/3824-118-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/3824-119-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/3824-120-0x0000000004E40000-0x000000000533E000-memory.dmpFilesize
5.0MB
-
memory/3824-121-0x0000000004E10000-0x0000000004E15000-memory.dmpFilesize
20KB
-
memory/3824-122-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/3824-123-0x0000000005A90000-0x0000000005ADB000-memory.dmpFilesize
300KB
-
memory/3824-115-0x0000000000460000-0x0000000000461000-memory.dmpFilesize
4KB
-
memory/4392-128-0x0000000001180000-0x0000000001191000-memory.dmpFilesize
68KB
-
memory/4392-130-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4392-127-0x0000000001730000-0x0000000001A50000-memory.dmpFilesize
3.1MB
-
memory/4392-131-0x00000000011B0000-0x00000000012FA000-memory.dmpFilesize
1.3MB
-
memory/4392-125-0x000000000041D3D0-mapping.dmp
-
memory/4392-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4468-133-0x0000000000000000-mapping.dmp
-
memory/4468-134-0x0000000000BC0000-0x0000000000C19000-memory.dmpFilesize
356KB
-
memory/4468-135-0x0000000000590000-0x00000000005B9000-memory.dmpFilesize
164KB
-
memory/4468-136-0x0000000003190000-0x00000000034B0000-memory.dmpFilesize
3.1MB
-
memory/4468-138-0x0000000002FE0000-0x0000000003070000-memory.dmpFilesize
576KB