Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-01-2022 14:35
Static task
static1
Behavioral task
behavioral1
Sample
f8f21b42.exe
Resource
win7-en-20211208
General
-
Target
f8f21b42.exe
-
Size
307KB
-
MD5
823e2111b364480598e2c0030cc945c8
-
SHA1
bdb030ca0f699ebcf3ada6d5fd2fc51d53fc9d76
-
SHA256
f8f21b428732d4136df057f3ef06f9fdc47b29de832838dcd030ef55e0c31891
-
SHA512
e7274a90df675b29ab59b8e5c74082411eec7296630814075b9d12a3c15415957289c5d9691c695bb354c2159e569dfa71470998e2c1bc617baa293e44943d05
Malware Config
Extracted
xloader
2.5
dtt3
edilononlineshop.com
cursosd.com
viellacharteredland.com
increasey0urenergylevels.codes
yjy-hotel.com
claym.xyz
reelsguide.com
gives-cardano.com
ashrafannuar.com
mammalians.com
rocketleaguedads.com
yubierp.com
minimi36.com
chn-chn.com
jagojp888.com
parsian-shetab.com
273351.com
mdtouhid.com
babedads.com
vallinam2.com
buro-tic.com
az-rent.net
shifaebio.xyz
circuitoalberghiero.com
xn--b1afb9b.xn--p1acf
canlioyundasin.online
sachainchirajaomega.com
scandinest.com
pluky.net
tpxcy.com
nbg.global
automountproducts.com
hghbj.com
beachsidecoatings.com
householdertips.com
coworkingspace.online
doujyou.com
tenloe053.xyz
udpbkp.biz
kondanginyuk.online
zipiter.com
christiankrog.com
reliantrecruitinggroup.com
acrylicus.com
cruelgirls.biz
oeinsulation.com
mapnft.xyz
leadersfort.com
foodroutine.com
mayerohio.info
systemofsolutions.com
gideonajibike.com
bigboobz.net
townofis.com
mhkxlgs.com
sussaautocare.com
quicktle.com
boutiquedangel.com
garrisonroadhouse.com
stiff-pols.art
cabalaconsultores.com
theweddinggame.net
themoneymagicians.com
overtonesa.com
janasflannels.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/468-55-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/768-61-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1296 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
f8f21b42.exepid process 1584 f8f21b42.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f8f21b42.exef8f21b42.exesystray.exedescription pid process target process PID 1584 set thread context of 468 1584 f8f21b42.exe f8f21b42.exe PID 468 set thread context of 1380 468 f8f21b42.exe Explorer.EXE PID 768 set thread context of 1380 768 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
f8f21b42.exesystray.exepid process 468 f8f21b42.exe 468 f8f21b42.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe 768 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
f8f21b42.exesystray.exepid process 468 f8f21b42.exe 468 f8f21b42.exe 468 f8f21b42.exe 768 systray.exe 768 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f8f21b42.exesystray.exedescription pid process Token: SeDebugPrivilege 468 f8f21b42.exe Token: SeDebugPrivilege 768 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
f8f21b42.exeExplorer.EXEsystray.exedescription pid process target process PID 1584 wrote to memory of 468 1584 f8f21b42.exe f8f21b42.exe PID 1584 wrote to memory of 468 1584 f8f21b42.exe f8f21b42.exe PID 1584 wrote to memory of 468 1584 f8f21b42.exe f8f21b42.exe PID 1584 wrote to memory of 468 1584 f8f21b42.exe f8f21b42.exe PID 1584 wrote to memory of 468 1584 f8f21b42.exe f8f21b42.exe PID 1584 wrote to memory of 468 1584 f8f21b42.exe f8f21b42.exe PID 1584 wrote to memory of 468 1584 f8f21b42.exe f8f21b42.exe PID 1380 wrote to memory of 768 1380 Explorer.EXE systray.exe PID 1380 wrote to memory of 768 1380 Explorer.EXE systray.exe PID 1380 wrote to memory of 768 1380 Explorer.EXE systray.exe PID 1380 wrote to memory of 768 1380 Explorer.EXE systray.exe PID 768 wrote to memory of 1296 768 systray.exe cmd.exe PID 768 wrote to memory of 1296 768 systray.exe cmd.exe PID 768 wrote to memory of 1296 768 systray.exe cmd.exe PID 768 wrote to memory of 1296 768 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8f21b42.exe"C:\Users\Admin\AppData\Local\Temp\f8f21b42.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8f21b42.exe"C:\Users\Admin\AppData\Local\Temp\f8f21b42.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\f8f21b42.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsdAAA3.tmp\dayetge.dllMD5
6c367de967d08e5a56ddf0802f26204a
SHA1975d2926553af44b0372204508d9aef2d2c71402
SHA256651c5d0de741458bb8a3786016481ca6f4e8b44e6991eeecb92b7f8d202394ef
SHA512cbfa3446a7220c602a17f9ec147c2e4c5fdda568d7b6081ddf76834b4095154e640d8e2d86b5d2741e8024a6ced21817281f8f05d9831cc2921c340a08fac53f
-
memory/468-55-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/468-57-0x0000000000740000-0x0000000000A43000-memory.dmpFilesize
3.0MB
-
memory/468-58-0x0000000000480000-0x0000000000491000-memory.dmpFilesize
68KB
-
memory/768-60-0x00000000004E0000-0x00000000004E5000-memory.dmpFilesize
20KB
-
memory/768-61-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/768-62-0x00000000020E0000-0x00000000023E3000-memory.dmpFilesize
3.0MB
-
memory/768-63-0x0000000001E10000-0x0000000001EA0000-memory.dmpFilesize
576KB
-
memory/1380-59-0x0000000004D20000-0x0000000004E1A000-memory.dmpFilesize
1000KB
-
memory/1380-64-0x0000000006A70000-0x0000000006B94000-memory.dmpFilesize
1.1MB
-
memory/1584-53-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB