Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
20-01-2022 10:32
Static task
static1
Behavioral task
behavioral1
Sample
SNO22 PriceLetter595406_RACX-159814.exe
Resource
win7-en-20211208
General
-
Target
SNO22 PriceLetter595406_RACX-159814.exe
-
Size
373KB
-
MD5
7692a9ecc1b4d092387cffe6faa8d762
-
SHA1
37e70527d40c881115036ae2de66e3685d3a8f10
-
SHA256
22c8527c55a52f56653e38bf1f2dbc8ccc06ab0f0ab16879138f30037b710b0a
-
SHA512
e0c02c683d444ad442c1758113f875687df702402270dc7705b1b12c49e8c88e82b022f88f8d5a1767a43fdcf0f41a2bdbf281703b9dc97c322dd2cf68ff765a
Malware Config
Extracted
xloader
2.5
p8ce
wishmeluck1.xyz
nawabumi.com
terra.fish
eoraipsumami.quest
awakeningyourid.com
csyein.com
tslsinteligentes.com
cataractusa.com
capitalwheelstogo.com
staffremotely.com
trashbinwasher.com
blaneyparkrendezvous.com
yolrt.com
northendtaproom.com
showgeini.com
b95206.com
almcpersonaltraining.com
lovabledoodleshome.com
woodlandstationcondos.com
nikahlive.com
sassholesentiments.com
bupis44.info
salahiheartclinic.com
loveandpersonality.com
electric-cortex.com
beijixing-zs.com
proper-sa.com
legacyfamilypartners.com
psidsamor.com
schotinderoos.com
kosma-concept.com
onitled.com
zscyyds.xyz
mannatgroups.com
radweb-demo.com
lambanghieuquangcao.info
antabatik.com
lerongclub.com
mobssvipshop.com
dr-walther.com
ibexitconsultants.com
cnyprospects.com
j9mkt64.com
archer-claims.com
lggrandinn.com
jowhp.com
outdoormz.store
cantikgroup.company
2brothersprinting.com
ginamodernart.com
koupeespen.quest
senerants.tech
designthrottle.com
emquality.com
cerulesafe.com
orascomservice.com
skinsotight.com
premiumconciergemarbella.com
cottagepor.xyz
gwayav.com
johnguidesyou.com
corporativokale.com
jskswj.com
xinico.info
gebaeudetechnik-burscheid.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4040-306-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1432-312-0x0000000000BC0000-0x0000000000BE9000-memory.dmp xloader -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
SNO22 PriceLetter595406_RACX-159814.exeSNO22 PriceLetter595406_RACX-159814.execscript.exedescription pid process target process PID 3644 set thread context of 4040 3644 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 4040 set thread context of 2424 4040 SNO22 PriceLetter595406_RACX-159814.exe Explorer.EXE PID 1432 set thread context of 2424 1432 cscript.exe Explorer.EXE -
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
SNO22 PriceLetter595406_RACX-159814.execscript.exepid process 4040 SNO22 PriceLetter595406_RACX-159814.exe 4040 SNO22 PriceLetter595406_RACX-159814.exe 4040 SNO22 PriceLetter595406_RACX-159814.exe 4040 SNO22 PriceLetter595406_RACX-159814.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe 1432 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2424 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
SNO22 PriceLetter595406_RACX-159814.execscript.exepid process 4040 SNO22 PriceLetter595406_RACX-159814.exe 4040 SNO22 PriceLetter595406_RACX-159814.exe 4040 SNO22 PriceLetter595406_RACX-159814.exe 1432 cscript.exe 1432 cscript.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
SNO22 PriceLetter595406_RACX-159814.execscript.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4040 SNO22 PriceLetter595406_RACX-159814.exe Token: SeDebugPrivilege 1432 cscript.exe Token: SeShutdownPrivilege 2424 Explorer.EXE Token: SeCreatePagefilePrivilege 2424 Explorer.EXE Token: SeShutdownPrivilege 2424 Explorer.EXE Token: SeCreatePagefilePrivilege 2424 Explorer.EXE Token: SeShutdownPrivilege 2424 Explorer.EXE Token: SeCreatePagefilePrivilege 2424 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SNO22 PriceLetter595406_RACX-159814.exeExplorer.EXEcscript.exedescription pid process target process PID 3644 wrote to memory of 4040 3644 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 3644 wrote to memory of 4040 3644 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 3644 wrote to memory of 4040 3644 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 3644 wrote to memory of 4040 3644 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 3644 wrote to memory of 4040 3644 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 3644 wrote to memory of 4040 3644 SNO22 PriceLetter595406_RACX-159814.exe SNO22 PriceLetter595406_RACX-159814.exe PID 2424 wrote to memory of 1432 2424 Explorer.EXE cscript.exe PID 2424 wrote to memory of 1432 2424 Explorer.EXE cscript.exe PID 2424 wrote to memory of 1432 2424 Explorer.EXE cscript.exe PID 1432 wrote to memory of 336 1432 cscript.exe cmd.exe PID 1432 wrote to memory of 336 1432 cscript.exe cmd.exe PID 1432 wrote to memory of 336 1432 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SNO22 PriceLetter595406_RACX-159814.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 279abbe49442db908f67ea628b329132 u3pCchQsYkujnCz7FYwSeA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1432-314-0x0000000004D70000-0x0000000004E00000-memory.dmpFilesize
576KB
-
memory/1432-313-0x0000000004F10000-0x000000000525A000-memory.dmpFilesize
3.3MB
-
memory/1432-311-0x0000000000ED0000-0x0000000000EF7000-memory.dmpFilesize
156KB
-
memory/1432-312-0x0000000000BC0000-0x0000000000BE9000-memory.dmpFilesize
164KB
-
memory/2424-310-0x0000000007CB0000-0x0000000007DAD000-memory.dmpFilesize
1012KB
-
memory/2424-315-0x0000000007BB0000-0x0000000007CA5000-memory.dmpFilesize
980KB
-
memory/3644-133-0x00000000051E0000-0x00000000051EA000-memory.dmpFilesize
40KB
-
memory/3644-305-0x0000000007990000-0x0000000007A2C000-memory.dmpFilesize
624KB
-
memory/3644-134-0x0000000005090000-0x0000000005122000-memory.dmpFilesize
584KB
-
memory/3644-130-0x0000000000720000-0x0000000000784000-memory.dmpFilesize
400KB
-
memory/3644-132-0x0000000005130000-0x00000000051C2000-memory.dmpFilesize
584KB
-
memory/3644-131-0x00000000057D0000-0x0000000005D74000-memory.dmpFilesize
5.6MB
-
memory/4040-308-0x0000000000EB0000-0x000000000165A000-memory.dmpFilesize
7.7MB
-
memory/4040-309-0x0000000000E40000-0x0000000000E51000-memory.dmpFilesize
68KB
-
memory/4040-306-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB