Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
14-12-2021 12:12
Static task
static1
Behavioral task
behavioral1
Sample
tmp/femm.exe
Resource
win7-en-20211208
General
-
Target
tmp/femm.exe
-
Size
327KB
-
MD5
1fe6bb3b680c6b3efe92374bd5ea8b85
-
SHA1
356c0cc6df02a6fa30705e918141186bd0c78475
-
SHA256
a63e0773595f36b7ada59361abb3b0df6bf684188170da64325f7224265ecc62
-
SHA512
a1c8cd4bf5527facfb859fb9b29c24f4f62246a17bbedfab52f09c9ef1f59c4ac57c03e776da67055dbfc3911e0e81ae36a5fb7158a2c55fb1d17ab9af6f5e41
Malware Config
Extracted
xloader
2.5
ef6c
http://www.fis.photos/ef6c/
gicaredocs.com
govusergroup.com
conversationspit.com
brondairy.com
rjtherealest.com
xn--9m1bq8wgkag3rjvb.com
mylori.net
softandcute.store
ahljsm.com
shacksolid.com
weekendmusecollection.com
gaminghallarna.net
pgonline111.online
44mpt.xyz
ambrandt.com
eddytattoo.com
blendeqes.com
upinmyfeels.com
lacucinadesign.com
docomoau.xyz
xn--90armbk7e.online
xzq585858.net
kidzgovroom.com
lhznqyl.press
publicationsplace.com
jakante.com
csspadding.com
test-testjisdnsec.store
lafabriqueabeilleassurances.com
clf010.com
buybabysnuggle.com
uzmdrmustafaalperaykanat.com
levanttradegroup.com
arcflorals.com
kinglot2499.com
freekagyans.com
region10group.gmbh
yeyelm744.com
thehomedesigncentre.com
vngc.xyz
szesdkj.com
charlottewright.online
planetgreennetwork.com
pacifica7.com
analogueadapt.com
sensorypantry.com
narbaal.com
restaurant-utopia.xyz
golnay.com
szyyglass.com
redelirevearyseuiop.xyz
goldsteelconstruction.com
discovercotswoldcottages.com
geniuseven.net
apricitee.com
stopmoshenik.online
ya2gh.com
instatechnovelz.com
dbe648.com
seifjuban.com
conquershirts.store
totalcovidtravel.com
pamperotrabajo.com
satellitphonestore.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2212-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2212-125-0x000000000041D3D0-mapping.dmp xloader behavioral2/memory/2868-133-0x0000000000CD0000-0x0000000000CF9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
femm.exefemm.exechkdsk.exedescription pid process target process PID 948 set thread context of 2212 948 femm.exe femm.exe PID 2212 set thread context of 3056 2212 femm.exe Explorer.EXE PID 2868 set thread context of 3056 2868 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
femm.exechkdsk.exepid process 2212 femm.exe 2212 femm.exe 2212 femm.exe 2212 femm.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe 2868 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
femm.exechkdsk.exepid process 2212 femm.exe 2212 femm.exe 2212 femm.exe 2868 chkdsk.exe 2868 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
femm.exechkdsk.exedescription pid process Token: SeDebugPrivilege 2212 femm.exe Token: SeDebugPrivilege 2868 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
femm.exeExplorer.EXEchkdsk.exedescription pid process target process PID 948 wrote to memory of 2212 948 femm.exe femm.exe PID 948 wrote to memory of 2212 948 femm.exe femm.exe PID 948 wrote to memory of 2212 948 femm.exe femm.exe PID 948 wrote to memory of 2212 948 femm.exe femm.exe PID 948 wrote to memory of 2212 948 femm.exe femm.exe PID 948 wrote to memory of 2212 948 femm.exe femm.exe PID 3056 wrote to memory of 2868 3056 Explorer.EXE chkdsk.exe PID 3056 wrote to memory of 2868 3056 Explorer.EXE chkdsk.exe PID 3056 wrote to memory of 2868 3056 Explorer.EXE chkdsk.exe PID 2868 wrote to memory of 2620 2868 chkdsk.exe cmd.exe PID 2868 wrote to memory of 2620 2868 chkdsk.exe cmd.exe PID 2868 wrote to memory of 2620 2868 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\femm.exe"C:\Users\Admin\AppData\Local\Temp\tmp\femm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\femm.exe"C:\Users\Admin\AppData\Local\Temp\tmp\femm.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp\femm.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-115-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/948-117-0x0000000005740000-0x0000000005741000-memory.dmpFilesize
4KB
-
memory/948-118-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/948-119-0x0000000005240000-0x000000000573E000-memory.dmpFilesize
5.0MB
-
memory/948-120-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/948-121-0x00000000053E0000-0x00000000053E5000-memory.dmpFilesize
20KB
-
memory/948-122-0x0000000007A70000-0x0000000007A71000-memory.dmpFilesize
4KB
-
memory/948-123-0x0000000007A20000-0x0000000007A6B000-memory.dmpFilesize
300KB
-
memory/2212-128-0x0000000001760000-0x0000000001771000-memory.dmpFilesize
68KB
-
memory/2212-125-0x000000000041D3D0-mapping.dmp
-
memory/2212-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2212-127-0x0000000001420000-0x0000000001740000-memory.dmpFilesize
3.1MB
-
memory/2620-131-0x0000000000000000-mapping.dmp
-
memory/2868-130-0x0000000000000000-mapping.dmp
-
memory/2868-133-0x0000000000CD0000-0x0000000000CF9000-memory.dmpFilesize
164KB
-
memory/2868-134-0x0000000005500000-0x0000000005820000-memory.dmpFilesize
3.1MB
-
memory/2868-132-0x0000000001020000-0x000000000102A000-memory.dmpFilesize
40KB
-
memory/2868-135-0x0000000005280000-0x0000000005310000-memory.dmpFilesize
576KB
-
memory/3056-129-0x0000000005790000-0x00000000058D0000-memory.dmpFilesize
1.2MB
-
memory/3056-136-0x0000000002430000-0x00000000024FD000-memory.dmpFilesize
820KB