Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
15-12-2021 10:11
Static task
static1
Behavioral task
behavioral1
Sample
tmp/femp.exe
Resource
win7-en-20211208
General
-
Target
tmp/femp.exe
-
Size
344KB
-
MD5
c62a556b445ff8cf1b9e0b038a13137e
-
SHA1
7fefc1609a4e66d234abb47a1536857317bdb31b
-
SHA256
4b3af4ebfe94ecb1730c15620080935f619b6592fad681921968f986c030c0c3
-
SHA512
c372806da30c98b047d46f8e70cce90f93829fe484ff5eb49354bd132a846ff126ea4c7024e5fae8de60c96117d940ea4fe2d6c783c67987354c7eee99c4638e
Malware Config
Extracted
xloader
2.5
ef6c
http://www.fis.photos/ef6c/
gicaredocs.com
govusergroup.com
conversationspit.com
brondairy.com
rjtherealest.com
xn--9m1bq8wgkag3rjvb.com
mylori.net
softandcute.store
ahljsm.com
shacksolid.com
weekendmusecollection.com
gaminghallarna.net
pgonline111.online
44mpt.xyz
ambrandt.com
eddytattoo.com
blendeqes.com
upinmyfeels.com
lacucinadesign.com
docomoau.xyz
xn--90armbk7e.online
xzq585858.net
kidzgovroom.com
lhznqyl.press
publicationsplace.com
jakante.com
csspadding.com
test-testjisdnsec.store
lafabriqueabeilleassurances.com
clf010.com
buybabysnuggle.com
uzmdrmustafaalperaykanat.com
levanttradegroup.com
arcflorals.com
kinglot2499.com
freekagyans.com
region10group.gmbh
yeyelm744.com
thehomedesigncentre.com
vngc.xyz
szesdkj.com
charlottewright.online
planetgreennetwork.com
pacifica7.com
analogueadapt.com
sensorypantry.com
narbaal.com
restaurant-utopia.xyz
golnay.com
szyyglass.com
redelirevearyseuiop.xyz
goldsteelconstruction.com
discovercotswoldcottages.com
geniuseven.net
apricitee.com
stopmoshenik.online
ya2gh.com
instatechnovelz.com
dbe648.com
seifjuban.com
conquershirts.store
totalcovidtravel.com
pamperotrabajo.com
satellitphonestore.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3572-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3572-126-0x000000000041D3D0-mapping.dmp xloader behavioral2/memory/3572-131-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1764-136-0x0000000000C10000-0x0000000000C39000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
femp.exefemp.exeNETSTAT.EXEdescription pid process target process PID 2540 set thread context of 3572 2540 femp.exe femp.exe PID 3572 set thread context of 2892 3572 femp.exe Explorer.EXE PID 3572 set thread context of 2892 3572 femp.exe Explorer.EXE PID 1764 set thread context of 2892 1764 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1764 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
femp.exeNETSTAT.EXEpid process 3572 femp.exe 3572 femp.exe 3572 femp.exe 3572 femp.exe 3572 femp.exe 3572 femp.exe 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE 1764 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2892 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
femp.exeNETSTAT.EXEpid process 3572 femp.exe 3572 femp.exe 3572 femp.exe 3572 femp.exe 1764 NETSTAT.EXE 1764 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
femp.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 3572 femp.exe Token: SeDebugPrivilege 1764 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
femp.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 2540 wrote to memory of 3572 2540 femp.exe femp.exe PID 2540 wrote to memory of 3572 2540 femp.exe femp.exe PID 2540 wrote to memory of 3572 2540 femp.exe femp.exe PID 2540 wrote to memory of 3572 2540 femp.exe femp.exe PID 2540 wrote to memory of 3572 2540 femp.exe femp.exe PID 2540 wrote to memory of 3572 2540 femp.exe femp.exe PID 2892 wrote to memory of 1764 2892 Explorer.EXE NETSTAT.EXE PID 2892 wrote to memory of 1764 2892 Explorer.EXE NETSTAT.EXE PID 2892 wrote to memory of 1764 2892 Explorer.EXE NETSTAT.EXE PID 1764 wrote to memory of 3576 1764 NETSTAT.EXE cmd.exe PID 1764 wrote to memory of 3576 1764 NETSTAT.EXE cmd.exe PID 1764 wrote to memory of 3576 1764 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\femp.exe"C:\Users\Admin\AppData\Local\Temp\tmp\femp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp\femp.exe"C:\Users\Admin\AppData\Local\Temp\tmp\femp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp\femp.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1764-134-0x0000000000000000-mapping.dmp
-
memory/1764-135-0x0000000001320000-0x000000000132B000-memory.dmpFilesize
44KB
-
memory/1764-136-0x0000000000C10000-0x0000000000C39000-memory.dmpFilesize
164KB
-
memory/1764-137-0x00000000034D0000-0x00000000037F0000-memory.dmpFilesize
3.1MB
-
memory/1764-139-0x0000000000F40000-0x0000000000FD0000-memory.dmpFilesize
576KB
-
memory/2540-120-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/2540-123-0x0000000006200000-0x0000000006201000-memory.dmpFilesize
4KB
-
memory/2540-124-0x00000000061B0000-0x00000000061FB000-memory.dmpFilesize
300KB
-
memory/2540-122-0x0000000005400000-0x0000000005492000-memory.dmpFilesize
584KB
-
memory/2540-121-0x0000000005540000-0x0000000005545000-memory.dmpFilesize
20KB
-
memory/2540-116-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/2540-119-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/2540-118-0x0000000005A60000-0x0000000005A61000-memory.dmpFilesize
4KB
-
memory/2892-140-0x0000000006C10000-0x0000000006D35000-memory.dmpFilesize
1.1MB
-
memory/2892-133-0x0000000006FA0000-0x00000000070EC000-memory.dmpFilesize
1.3MB
-
memory/2892-130-0x00000000031A0000-0x0000000003284000-memory.dmpFilesize
912KB
-
memory/3572-129-0x0000000000FF0000-0x0000000001001000-memory.dmpFilesize
68KB
-
memory/3572-132-0x0000000001350000-0x0000000001361000-memory.dmpFilesize
68KB
-
memory/3572-131-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3572-128-0x0000000001030000-0x0000000001350000-memory.dmpFilesize
3.1MB
-
memory/3572-126-0x000000000041D3D0-mapping.dmp
-
memory/3572-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3576-138-0x0000000000000000-mapping.dmp