Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
14-12-2021 12:12
Static task
static1
Behavioral task
behavioral1
Sample
tmp/femm.exe
Resource
win7-en-20211208
General
-
Target
tmp/femm.exe
-
Size
327KB
-
MD5
1fe6bb3b680c6b3efe92374bd5ea8b85
-
SHA1
356c0cc6df02a6fa30705e918141186bd0c78475
-
SHA256
a63e0773595f36b7ada59361abb3b0df6bf684188170da64325f7224265ecc62
-
SHA512
a1c8cd4bf5527facfb859fb9b29c24f4f62246a17bbedfab52f09c9ef1f59c4ac57c03e776da67055dbfc3911e0e81ae36a5fb7158a2c55fb1d17ab9af6f5e41
Malware Config
Extracted
xloader
2.5
ef6c
http://www.fis.photos/ef6c/
gicaredocs.com
govusergroup.com
conversationspit.com
brondairy.com
rjtherealest.com
xn--9m1bq8wgkag3rjvb.com
mylori.net
softandcute.store
ahljsm.com
shacksolid.com
weekendmusecollection.com
gaminghallarna.net
pgonline111.online
44mpt.xyz
ambrandt.com
eddytattoo.com
blendeqes.com
upinmyfeels.com
lacucinadesign.com
docomoau.xyz
xn--90armbk7e.online
xzq585858.net
kidzgovroom.com
lhznqyl.press
publicationsplace.com
jakante.com
csspadding.com
test-testjisdnsec.store
lafabriqueabeilleassurances.com
clf010.com
buybabysnuggle.com
uzmdrmustafaalperaykanat.com
levanttradegroup.com
arcflorals.com
kinglot2499.com
freekagyans.com
region10group.gmbh
yeyelm744.com
thehomedesigncentre.com
vngc.xyz
szesdkj.com
charlottewright.online
planetgreennetwork.com
pacifica7.com
analogueadapt.com
sensorypantry.com
narbaal.com
restaurant-utopia.xyz
golnay.com
szyyglass.com
redelirevearyseuiop.xyz
goldsteelconstruction.com
discovercotswoldcottages.com
geniuseven.net
apricitee.com
stopmoshenik.online
ya2gh.com
instatechnovelz.com
dbe648.com
seifjuban.com
conquershirts.store
totalcovidtravel.com
pamperotrabajo.com
satellitphonestore.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1240-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1240-63-0x000000000041D3D0-mapping.dmp xloader behavioral1/memory/1668-72-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1412 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
femm.exefemm.execmstp.exedescription pid process target process PID 1624 set thread context of 1240 1624 femm.exe femm.exe PID 1240 set thread context of 1404 1240 femm.exe Explorer.EXE PID 1668 set thread context of 1404 1668 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
femm.execmstp.exepid process 1240 femm.exe 1240 femm.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe 1668 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
femm.execmstp.exepid process 1240 femm.exe 1240 femm.exe 1240 femm.exe 1668 cmstp.exe 1668 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
femm.execmstp.exedescription pid process Token: SeDebugPrivilege 1240 femm.exe Token: SeDebugPrivilege 1668 cmstp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1404 Explorer.EXE 1404 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1404 Explorer.EXE 1404 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
femm.exeExplorer.EXEcmstp.exedescription pid process target process PID 1624 wrote to memory of 1240 1624 femm.exe femm.exe PID 1624 wrote to memory of 1240 1624 femm.exe femm.exe PID 1624 wrote to memory of 1240 1624 femm.exe femm.exe PID 1624 wrote to memory of 1240 1624 femm.exe femm.exe PID 1624 wrote to memory of 1240 1624 femm.exe femm.exe PID 1624 wrote to memory of 1240 1624 femm.exe femm.exe PID 1624 wrote to memory of 1240 1624 femm.exe femm.exe PID 1404 wrote to memory of 1668 1404 Explorer.EXE cmstp.exe PID 1404 wrote to memory of 1668 1404 Explorer.EXE cmstp.exe PID 1404 wrote to memory of 1668 1404 Explorer.EXE cmstp.exe PID 1404 wrote to memory of 1668 1404 Explorer.EXE cmstp.exe PID 1404 wrote to memory of 1668 1404 Explorer.EXE cmstp.exe PID 1404 wrote to memory of 1668 1404 Explorer.EXE cmstp.exe PID 1404 wrote to memory of 1668 1404 Explorer.EXE cmstp.exe PID 1668 wrote to memory of 1412 1668 cmstp.exe cmd.exe PID 1668 wrote to memory of 1412 1668 cmstp.exe cmd.exe PID 1668 wrote to memory of 1412 1668 cmstp.exe cmd.exe PID 1668 wrote to memory of 1412 1668 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\femm.exe"C:\Users\Admin\AppData\Local\Temp\tmp\femm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\femm.exe"C:\Users\Admin\AppData\Local\Temp\tmp\femm.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp\femm.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1240-64-0x0000000000B30000-0x0000000000E33000-memory.dmpFilesize
3.0MB
-
memory/1240-66-0x0000000000190000-0x00000000001A1000-memory.dmpFilesize
68KB
-
memory/1240-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1240-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1240-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1240-63-0x000000000041D3D0-mapping.dmp
-
memory/1404-75-0x0000000006AF0000-0x0000000006C0B000-memory.dmpFilesize
1.1MB
-
memory/1404-67-0x0000000004EC0000-0x0000000004F9C000-memory.dmpFilesize
880KB
-
memory/1412-70-0x0000000000000000-mapping.dmp
-
memory/1624-59-0x00000000009E0000-0x0000000000A2B000-memory.dmpFilesize
300KB
-
memory/1624-54-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/1624-58-0x00000000003D0000-0x00000000003D5000-memory.dmpFilesize
20KB
-
memory/1624-57-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/1624-56-0x0000000076C61000-0x0000000076C63000-memory.dmpFilesize
8KB
-
memory/1668-68-0x0000000000000000-mapping.dmp
-
memory/1668-71-0x0000000000290000-0x00000000002A8000-memory.dmpFilesize
96KB
-
memory/1668-72-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/1668-73-0x0000000001F80000-0x0000000002283000-memory.dmpFilesize
3.0MB
-
memory/1668-74-0x0000000000510000-0x00000000005A0000-memory.dmpFilesize
576KB