Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 12:53
Static task
static1
Behavioral task
behavioral1
Sample
jvDX48oGKQdeYMi.exe
Resource
win7-en-20211208
General
-
Target
jvDX48oGKQdeYMi.exe
-
Size
383KB
-
MD5
99b9c988d90c490263510e46d63e1eb3
-
SHA1
8d805807d852e5e7746c995d3c0d7bdd6480ee9b
-
SHA256
e34c0a8218be6d3783e8cd61b8040b6b39004ad34e68c1cdb2f123b636e6b274
-
SHA512
ef837611568b5e8c2d6857a085e4bcf2f2f33a556819ade65fe1f4301c5de9c6cf3165d79c90ad9c6a9ddae431c17cb26438c6dc5684d76e4202f17ef2b33327
Malware Config
Extracted
xloader
2.5
wdc8
mygotomaid.com
joyoushealthandwellnessspa.com
wefundprojects.com
magicbasketbourse.net
vitos3.xyz
oligopoly.city
beauty-bihada.asia
visitnewrichmond.com
crgeniusworld.biz
bantasis.com
transsexual.pro
casagraph.com
eastjamrecords.com
howtotrainyourmustache.com
heiappropriate.xyz
bataperu.com
ces341.com
prajahitha.com
manuelagattegger.com
wolfpackmotorcycletours.com
yulietrojas.com
dariven.com
dd13thsept.net
kalpeshvasoya.com
theavarosecollection.com
bloody-randoms.com
yngo-arca.com
dealsoffer.xyz
marellaweddingplanner.com
seowongoopain.com
omightygod.com
dqblog.net
thethreadedbrow.com
medflex.center
filpify.com
chaletxp.com
santanderburge.com
171341.com
shannongroves.com
sisoow.quest
harleybowd.com
cardioflextech.com
exspv.com
permianbasinautismacademy.info
gardenchipvip.com
onsitemarketingsolutions.com
cvwerg.com
theketocopywriter.com
telarte-ceramicas.com
j2ig529zbahs.biz
oxygenii.com
extralegally.info
hbdlaq.com
themountainkings.com
fibliz.com
skyrangersfoundation.com
forbabylon.net
weilaiyitj.com
supplementstoreryp.com
thehappyartnook.com
houzzcoin.com
heyitsnew.com
jonnystokes.com
venuesgrantprogram.com
hamiltonrealestate.online
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/572-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1764-69-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1868 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
jvDX48oGKQdeYMi.exejvDX48oGKQdeYMi.exemstsc.exedescription pid process target process PID 900 set thread context of 572 900 jvDX48oGKQdeYMi.exe jvDX48oGKQdeYMi.exe PID 572 set thread context of 1200 572 jvDX48oGKQdeYMi.exe Explorer.EXE PID 1764 set thread context of 1200 1764 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
jvDX48oGKQdeYMi.exemstsc.exepid process 572 jvDX48oGKQdeYMi.exe 572 jvDX48oGKQdeYMi.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe 1764 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
jvDX48oGKQdeYMi.exemstsc.exepid process 572 jvDX48oGKQdeYMi.exe 572 jvDX48oGKQdeYMi.exe 572 jvDX48oGKQdeYMi.exe 1764 mstsc.exe 1764 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
jvDX48oGKQdeYMi.exemstsc.exedescription pid process Token: SeDebugPrivilege 572 jvDX48oGKQdeYMi.exe Token: SeDebugPrivilege 1764 mstsc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
jvDX48oGKQdeYMi.exeExplorer.EXEmstsc.exedescription pid process target process PID 900 wrote to memory of 572 900 jvDX48oGKQdeYMi.exe jvDX48oGKQdeYMi.exe PID 900 wrote to memory of 572 900 jvDX48oGKQdeYMi.exe jvDX48oGKQdeYMi.exe PID 900 wrote to memory of 572 900 jvDX48oGKQdeYMi.exe jvDX48oGKQdeYMi.exe PID 900 wrote to memory of 572 900 jvDX48oGKQdeYMi.exe jvDX48oGKQdeYMi.exe PID 900 wrote to memory of 572 900 jvDX48oGKQdeYMi.exe jvDX48oGKQdeYMi.exe PID 900 wrote to memory of 572 900 jvDX48oGKQdeYMi.exe jvDX48oGKQdeYMi.exe PID 900 wrote to memory of 572 900 jvDX48oGKQdeYMi.exe jvDX48oGKQdeYMi.exe PID 1200 wrote to memory of 1764 1200 Explorer.EXE mstsc.exe PID 1200 wrote to memory of 1764 1200 Explorer.EXE mstsc.exe PID 1200 wrote to memory of 1764 1200 Explorer.EXE mstsc.exe PID 1200 wrote to memory of 1764 1200 Explorer.EXE mstsc.exe PID 1764 wrote to memory of 1868 1764 mstsc.exe cmd.exe PID 1764 wrote to memory of 1868 1764 mstsc.exe cmd.exe PID 1764 wrote to memory of 1868 1764 mstsc.exe cmd.exe PID 1764 wrote to memory of 1868 1764 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jvDX48oGKQdeYMi.exe"C:\Users\Admin\AppData\Local\Temp\jvDX48oGKQdeYMi.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jvDX48oGKQdeYMi.exe"C:\Users\Admin\AppData\Local\Temp\jvDX48oGKQdeYMi.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\jvDX48oGKQdeYMi.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/572-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/572-64-0x0000000000830000-0x0000000000B33000-memory.dmpFilesize
3.0MB
-
memory/572-65-0x0000000000270000-0x0000000000281000-memory.dmpFilesize
68KB
-
memory/572-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/572-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/900-59-0x0000000005000000-0x0000000005062000-memory.dmpFilesize
392KB
-
memory/900-55-0x00000000001E0000-0x0000000000246000-memory.dmpFilesize
408KB
-
memory/900-58-0x00000000004F0000-0x00000000004FC000-memory.dmpFilesize
48KB
-
memory/900-57-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/900-56-0x00000000769D1000-0x00000000769D3000-memory.dmpFilesize
8KB
-
memory/1200-66-0x0000000004D90000-0x0000000004EB4000-memory.dmpFilesize
1.1MB
-
memory/1200-72-0x0000000004BD0000-0x0000000004C6D000-memory.dmpFilesize
628KB
-
memory/1764-68-0x00000000005F0000-0x00000000006F4000-memory.dmpFilesize
1.0MB
-
memory/1764-69-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1764-70-0x0000000002060000-0x0000000002363000-memory.dmpFilesize
3.0MB
-
memory/1764-71-0x0000000001C90000-0x0000000001ECC000-memory.dmpFilesize
2.2MB