Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 14:40
Static task
static1
Behavioral task
behavioral1
Sample
enquiry no. 2770034921.exe
Resource
win7-en-20211208
General
-
Target
enquiry no. 2770034921.exe
-
Size
381KB
-
MD5
5dde426d4383be37f818ee1205c50e11
-
SHA1
060c70157ceea0b08243a53e4baae2331b4449f8
-
SHA256
3f277a6819833eb0c7feab4e952301b4bac883e38ec8bd266093b6757d1920e8
-
SHA512
3b56d429b5d471cda4a8087dca70d74093bc3ac55a0cefba7949a76b254927d1ccadbbbf5a60554162817e930ed83ecf1515745763c0f13680c4ca9548054ac3
Malware Config
Extracted
xloader
2.5
gab7
mbb11.xyz
taishancable.com
karaoke-sega.com
mana-space.com
danielandkaela.com
ancorasports.com
magentaclass.com
tenloe045.xyz
colorbold.com
5starrentertainment.com
candgconstructiontx.com
664cqi.com
alexeykazakov.com
umrashed.space
thepowerof10.club
scotchwoodofficeworks.com
anelis.digital
label34.group
karimico.com
dogsforsaleinkenya.com
optamiaads.com
gobgamon.com
cfphin.com
parsian-shetab.com
lumensoycandles.com
rakyatnews.online
tiendasu.com
244.house
thecrazyfarm.com
ibotvideos.com
foxyreal.website
egeolabs.com
becu84ts.com
investorsank.com
sagekimgray.com
eco1tnpasumo5.xyz
jingtailan-china.com
covapa2.com
yijiaclcs.com
uni-mia.com
english-sports.info
thinkercleaningservice.com
doislot.xyz
studiosagesalon.com
xn--z4qv1cr56dk0k.group
greencrvn.com
kabloomevents.com
backgammondestinations.net
exploitporbrl.xyz
twoindividuals.com
innisfailcleaning.com
kontrolnb.com
pinaldrywall.com
boettcherlaw.com
nano-shred.com
arinatechnology.com
mfkplatinum.info
ddfddpistol.quest
scarpatostudiolegale.com
scatfilms.biz
investmentcomp.com
xemphimlatmat5.com
phsenterprises.com
accutitleagency.biz
i8news-be.website
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1072-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/452-68-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1772 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
enquiry no. 2770034921.exeenquiry no. 2770034921.exeNAPSTAT.EXEdescription pid process target process PID 1620 set thread context of 1072 1620 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 1072 set thread context of 1372 1072 enquiry no. 2770034921.exe Explorer.EXE PID 452 set thread context of 1372 452 NAPSTAT.EXE Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
enquiry no. 2770034921.exeNAPSTAT.EXEpid process 1072 enquiry no. 2770034921.exe 1072 enquiry no. 2770034921.exe 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE 452 NAPSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
enquiry no. 2770034921.exeNAPSTAT.EXEpid process 1072 enquiry no. 2770034921.exe 1072 enquiry no. 2770034921.exe 1072 enquiry no. 2770034921.exe 452 NAPSTAT.EXE 452 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
enquiry no. 2770034921.exeNAPSTAT.EXEdescription pid process Token: SeDebugPrivilege 1072 enquiry no. 2770034921.exe Token: SeDebugPrivilege 452 NAPSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1372 Explorer.EXE 1372 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
enquiry no. 2770034921.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 1620 wrote to memory of 1072 1620 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 1620 wrote to memory of 1072 1620 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 1620 wrote to memory of 1072 1620 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 1620 wrote to memory of 1072 1620 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 1620 wrote to memory of 1072 1620 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 1620 wrote to memory of 1072 1620 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 1620 wrote to memory of 1072 1620 enquiry no. 2770034921.exe enquiry no. 2770034921.exe PID 1372 wrote to memory of 452 1372 Explorer.EXE NAPSTAT.EXE PID 1372 wrote to memory of 452 1372 Explorer.EXE NAPSTAT.EXE PID 1372 wrote to memory of 452 1372 Explorer.EXE NAPSTAT.EXE PID 1372 wrote to memory of 452 1372 Explorer.EXE NAPSTAT.EXE PID 452 wrote to memory of 1772 452 NAPSTAT.EXE cmd.exe PID 452 wrote to memory of 1772 452 NAPSTAT.EXE cmd.exe PID 452 wrote to memory of 1772 452 NAPSTAT.EXE cmd.exe PID 452 wrote to memory of 1772 452 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\enquiry no. 2770034921.exe"C:\Users\Admin\AppData\Local\Temp\enquiry no. 2770034921.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\enquiry no. 2770034921.exe"C:\Users\Admin\AppData\Local\Temp\enquiry no. 2770034921.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\enquiry no. 2770034921.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/452-68-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/452-70-0x0000000000460000-0x00000000004F0000-memory.dmpFilesize
576KB
-
memory/452-69-0x0000000002240000-0x0000000002543000-memory.dmpFilesize
3.0MB
-
memory/452-67-0x0000000000390000-0x00000000003D6000-memory.dmpFilesize
280KB
-
memory/1072-64-0x0000000000AE0000-0x0000000000DE3000-memory.dmpFilesize
3.0MB
-
memory/1072-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1072-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1072-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1072-65-0x0000000000140000-0x0000000000151000-memory.dmpFilesize
68KB
-
memory/1372-66-0x0000000006FD0000-0x000000000710D000-memory.dmpFilesize
1.2MB
-
memory/1372-71-0x0000000004910000-0x00000000049B5000-memory.dmpFilesize
660KB
-
memory/1620-55-0x00000000010D0000-0x0000000001136000-memory.dmpFilesize
408KB
-
memory/1620-59-0x0000000004F50000-0x0000000004FB2000-memory.dmpFilesize
392KB
-
memory/1620-58-0x0000000000380000-0x000000000038C000-memory.dmpFilesize
48KB
-
memory/1620-57-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/1620-56-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB