Analysis
-
max time kernel
159s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 09:04
Static task
static1
General
-
Target
074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exe
-
Size
737KB
-
MD5
6ae185ce909f0b66306100824c28bad1
-
SHA1
5f23a2d4b2c564c95606e537e557aa8251087746
-
SHA256
074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867
-
SHA512
01931c4d70f045957aa012a8912f483e11e0f069cee8fd304acc4cb7e44c838abbe1ea870d0e13ef8573967845ab2e1102d47eb76ce6b688904ceacaa8258ef7
Malware Config
Extracted
xloader
2.5
ahc8
methodicalservices.com
lojahelius.com
dxadxc.com
keshaunharris.club
hockeyengolfshop.online
sherranmanning.com
instylelimos.net
plick-click.com
tntexplode.com
movement-practice.net
nftlake.digital
134171.com
newhorizonseo.com
lm-solar.com
fahrrad-markt24.com
creatologiest.com
juststartmessy.com
sady-rossii-ural.com
blockchain-salt.com
bestoflakegeorge.guide
infinitymoversllc.com
javelephant.com
promocaozeraestoque.online
p60p.com
kreditineskorteleslt.com
chronicfit.store
onzep.store
shafiqandmudasir.com
vivemanku.online
chengfengdh.xyz
bets-bc-zrkqf.xyz
cellparts10.com
guardions.com
talenue.store
graffity-aws.com
buddingwsetcg.top
erikakorma.com
playex.ltd
jamaicarailways.com
nfthunter.art
ml-pilot.com
athleteteas.com
ruthdeliverance.info
medicmir.store
procurovariedades.com
undermour01.club
sneakeryeezy.com
dallmann.info
edm69.net
micj7870.com
silviomicalikush.xyz
activa.store
adeelnawaznj.com
travispilat.com
mercyships.kiwi
amazon939.com
talenterzllc.com
sbxip.com
phasernet.net
taggalla.com
pbspoolservices.com
34gjm.xyz
nuevochile.net
busdijogja.com
fyonkaly.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/3188-199-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral1/memory/3188-202-0x00000000047C0000-0x0000000004958000-memory.dmp xloader behavioral1/memory/1228-205-0x0000000000110000-0x0000000000139000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Iodqgrdelf = "C:\\Users\\Admin\\Contacts\\fledrgqdoI.url" 074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
logagent.exemstsc.exedescription pid process target process PID 3188 set thread context of 2892 3188 logagent.exe Explorer.EXE PID 1228 set thread context of 2892 1228 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
logagent.exemstsc.exepid process 3188 logagent.exe 3188 logagent.exe 3188 logagent.exe 3188 logagent.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe 1228 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2892 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
logagent.exemstsc.exepid process 3188 logagent.exe 3188 logagent.exe 3188 logagent.exe 1228 mstsc.exe 1228 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
logagent.exemstsc.exedescription pid process Token: SeDebugPrivilege 3188 logagent.exe Token: SeDebugPrivilege 1228 mstsc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exeExplorer.EXEdescription pid process target process PID 2608 wrote to memory of 3188 2608 074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exe logagent.exe PID 2608 wrote to memory of 3188 2608 074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exe logagent.exe PID 2608 wrote to memory of 3188 2608 074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exe logagent.exe PID 2608 wrote to memory of 3188 2608 074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exe logagent.exe PID 2608 wrote to memory of 3188 2608 074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exe logagent.exe PID 2608 wrote to memory of 3188 2608 074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exe logagent.exe PID 2892 wrote to memory of 1228 2892 Explorer.EXE mstsc.exe PID 2892 wrote to memory of 1228 2892 Explorer.EXE mstsc.exe PID 2892 wrote to memory of 1228 2892 Explorer.EXE mstsc.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exe"C:\Users\Admin\AppData\Local\Temp\074991cefc03a7683cb3c81e83c383010f45c130fdc6dafa13469bfffaf87867.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1228-204-0x0000000000A30000-0x0000000000D2C000-memory.dmpFilesize
3.0MB
-
memory/1228-205-0x0000000000110000-0x0000000000139000-memory.dmpFilesize
164KB
-
memory/1228-206-0x00000000044E0000-0x0000000004800000-memory.dmpFilesize
3.1MB
-
memory/1228-207-0x0000000004340000-0x00000000044D7000-memory.dmpFilesize
1.6MB
-
memory/2608-118-0x00000000021B0000-0x00000000021B1000-memory.dmpFilesize
4KB
-
memory/2892-203-0x0000000002E50000-0x0000000002F3C000-memory.dmpFilesize
944KB
-
memory/2892-208-0x0000000002FD0000-0x0000000003095000-memory.dmpFilesize
788KB
-
memory/3188-198-0x0000000002AC0000-0x0000000002AC1000-memory.dmpFilesize
4KB
-
memory/3188-199-0x0000000072480000-0x00000000724A9000-memory.dmpFilesize
164KB
-
memory/3188-200-0x0000000004960000-0x0000000004C80000-memory.dmpFilesize
3.1MB
-
memory/3188-202-0x00000000047C0000-0x0000000004958000-memory.dmpFilesize
1.6MB