Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 07:33
Static task
static1
Behavioral task
behavioral1
Sample
b116243ed4215cbcb325a827d11cdc68.exe
Resource
win7-20220414-en
General
-
Target
b116243ed4215cbcb325a827d11cdc68.exe
-
Size
245KB
-
MD5
b116243ed4215cbcb325a827d11cdc68
-
SHA1
c9ef499d8ec2966dda389ce769012b4ad6661cbc
-
SHA256
ecd736b3ee17564a101bfdf8ff757edf53948a983ef1c1dd088cd9f214034990
-
SHA512
39543aa90882920e8ba46777eb092abb678471c7cc7876d1ad98b2d4b1c6f4f50669d18c764c3b655866a682acabe2b73e1958be5a4ebfc0973574d210393ef3
Malware Config
Extracted
xloader
2.5
bs8f
atmospheraglobal.com
dontshootima.com
bestofferusde.club
yourdigitalboss.com
breskizci.com
myarrovacoastwebsite.com
reasclerk.com
efrovida.com
wsmz.net
upneett.com
loefflerforgov.com
noida.info
trndystore.com
arhaldar.online
vivibanca.tech
mykrema.com
vseserialy.online
ridgewayinsua.com
heauxland.com
bestcollegecourses.com
scent-kart.xyz
handyman-prime.com
wrightpurpose.com
hellounio.com
wealthy-link-erp.com
josegal.com
texasdominionrealty.com
hespresso.net
dreamonetnpasumo5.xyz
videosmind.com
abbawaalema.quest
esmtoluca.com
2382108759.com
akbastionoffilamentousfungi.com
electramanpower.com
siguealpanda.com
alquilerfurgon.com
3-little-pigs.com
esolutions4u.com
thatgolfer.com
biom4rk.com
paramusapartments.com
mothergadgets.com
ktnreport.xyz
amxdrivers.com
buymyhomeallcash.com
lifeisthere.com
nous-citoyens.com
destimarketing.com
lawinepro.com
littlenorwayfarmhouse.com
realworldgb488.rest
qualinorm.com
capitaltechcorp.com
familybeautifull.com
continentaldeal.com
scratchforce.com
veganbreathing.com
hickoryfalls-pm.com
pascal-rocha.com
20kretirementplan.biz
lehome.store
hellanatural.com
hnythao.com
gnizdo.online
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1236-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1236-64-0x000000000041D440-mapping.dmp xloader behavioral1/memory/1236-67-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1112-74-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
fdwfm.exefdwfm.exepid process 624 fdwfm.exe 1236 fdwfm.exe -
Loads dropped DLL 3 IoCs
Processes:
b116243ed4215cbcb325a827d11cdc68.exefdwfm.exepid process 1320 b116243ed4215cbcb325a827d11cdc68.exe 1320 b116243ed4215cbcb325a827d11cdc68.exe 624 fdwfm.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
fdwfm.exefdwfm.exeNAPSTAT.EXEdescription pid process target process PID 624 set thread context of 1236 624 fdwfm.exe fdwfm.exe PID 1236 set thread context of 1280 1236 fdwfm.exe Explorer.EXE PID 1112 set thread context of 1280 1112 NAPSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
fdwfm.exeNAPSTAT.EXEpid process 1236 fdwfm.exe 1236 fdwfm.exe 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
fdwfm.exeNAPSTAT.EXEpid process 1236 fdwfm.exe 1236 fdwfm.exe 1236 fdwfm.exe 1112 NAPSTAT.EXE 1112 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fdwfm.exeNAPSTAT.EXEdescription pid process Token: SeDebugPrivilege 1236 fdwfm.exe Token: SeDebugPrivilege 1112 NAPSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1280 Explorer.EXE 1280 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
b116243ed4215cbcb325a827d11cdc68.exefdwfm.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 1320 wrote to memory of 624 1320 b116243ed4215cbcb325a827d11cdc68.exe fdwfm.exe PID 1320 wrote to memory of 624 1320 b116243ed4215cbcb325a827d11cdc68.exe fdwfm.exe PID 1320 wrote to memory of 624 1320 b116243ed4215cbcb325a827d11cdc68.exe fdwfm.exe PID 1320 wrote to memory of 624 1320 b116243ed4215cbcb325a827d11cdc68.exe fdwfm.exe PID 624 wrote to memory of 1236 624 fdwfm.exe fdwfm.exe PID 624 wrote to memory of 1236 624 fdwfm.exe fdwfm.exe PID 624 wrote to memory of 1236 624 fdwfm.exe fdwfm.exe PID 624 wrote to memory of 1236 624 fdwfm.exe fdwfm.exe PID 624 wrote to memory of 1236 624 fdwfm.exe fdwfm.exe PID 624 wrote to memory of 1236 624 fdwfm.exe fdwfm.exe PID 624 wrote to memory of 1236 624 fdwfm.exe fdwfm.exe PID 1280 wrote to memory of 1112 1280 Explorer.EXE NAPSTAT.EXE PID 1280 wrote to memory of 1112 1280 Explorer.EXE NAPSTAT.EXE PID 1280 wrote to memory of 1112 1280 Explorer.EXE NAPSTAT.EXE PID 1280 wrote to memory of 1112 1280 Explorer.EXE NAPSTAT.EXE PID 1112 wrote to memory of 1072 1112 NAPSTAT.EXE cmd.exe PID 1112 wrote to memory of 1072 1112 NAPSTAT.EXE cmd.exe PID 1112 wrote to memory of 1072 1112 NAPSTAT.EXE cmd.exe PID 1112 wrote to memory of 1072 1112 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b116243ed4215cbcb325a827d11cdc68.exe"C:\Users\Admin\AppData\Local\Temp\b116243ed4215cbcb325a827d11cdc68.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fdwfm.exeC:\Users\Admin\AppData\Local\Temp\fdwfm.exe C:\Users\Admin\AppData\Local\Temp\dimjwfh3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fdwfm.exeC:\Users\Admin\AppData\Local\Temp\fdwfm.exe C:\Users\Admin\AppData\Local\Temp\dimjwfh4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\fdwfm.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\07psh9jxx8mb5tFilesize
163KB
MD52c8a5acbcf62c17a33d922b3b195e5f2
SHA14d8f1fd37d8a88fce9a413e50953616a2a79a4a7
SHA256a4a062a6f2ba7f29ef472549256f378c72ce26b94466acd3a313eb6d61fbc664
SHA512e96420d378adf2b601b067a8d6426a4544b0c42dcca850ba3e342167899f3245bd2b5d4655015e39b26e3465566c10d1576253f5c104904362ea27700fadc24c
-
C:\Users\Admin\AppData\Local\Temp\dimjwfhFilesize
4KB
MD5cb63c004083d462107d544017b29f953
SHA120896ed8b2ef0f60cd37cea225f0174ac4a4fe6b
SHA256da7cb9a05a5d27d1d6a2817bee8478627bbaaea1dcc393cd58f32b461462d4c7
SHA512aa0475bd3bda49f7d032a53b5dc98d8029718f9bc15b209c8cf8f5515cd59e3e20209908d8d9df139c38420f23bd69808bb1b452adb1e0576d9834ba0a465445
-
C:\Users\Admin\AppData\Local\Temp\fdwfm.exeFilesize
74KB
MD520a453ac2dfd314bf1f374bb0171681e
SHA1cf673d84f74b343061b923a8cd90936344cb5bc4
SHA25626a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0
SHA512ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642
-
C:\Users\Admin\AppData\Local\Temp\fdwfm.exeFilesize
74KB
MD520a453ac2dfd314bf1f374bb0171681e
SHA1cf673d84f74b343061b923a8cd90936344cb5bc4
SHA25626a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0
SHA512ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642
-
C:\Users\Admin\AppData\Local\Temp\fdwfm.exeFilesize
74KB
MD520a453ac2dfd314bf1f374bb0171681e
SHA1cf673d84f74b343061b923a8cd90936344cb5bc4
SHA25626a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0
SHA512ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642
-
\Users\Admin\AppData\Local\Temp\fdwfm.exeFilesize
74KB
MD520a453ac2dfd314bf1f374bb0171681e
SHA1cf673d84f74b343061b923a8cd90936344cb5bc4
SHA25626a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0
SHA512ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642
-
\Users\Admin\AppData\Local\Temp\fdwfm.exeFilesize
74KB
MD520a453ac2dfd314bf1f374bb0171681e
SHA1cf673d84f74b343061b923a8cd90936344cb5bc4
SHA25626a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0
SHA512ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642
-
\Users\Admin\AppData\Local\Temp\fdwfm.exeFilesize
74KB
MD520a453ac2dfd314bf1f374bb0171681e
SHA1cf673d84f74b343061b923a8cd90936344cb5bc4
SHA25626a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0
SHA512ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642
-
memory/624-57-0x0000000000000000-mapping.dmp
-
memory/1072-72-0x0000000000000000-mapping.dmp
-
memory/1112-71-0x0000000000000000-mapping.dmp
-
memory/1112-76-0x00000000003D0000-0x0000000000460000-memory.dmpFilesize
576KB
-
memory/1112-75-0x0000000002030000-0x0000000002333000-memory.dmpFilesize
3.0MB
-
memory/1112-74-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/1112-73-0x0000000000BE0000-0x0000000000C26000-memory.dmpFilesize
280KB
-
memory/1236-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1236-69-0x00000000003B0000-0x00000000003C1000-memory.dmpFilesize
68KB
-
memory/1236-68-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/1236-67-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1236-64-0x000000000041D440-mapping.dmp
-
memory/1280-70-0x0000000005110000-0x00000000051E1000-memory.dmpFilesize
836KB
-
memory/1280-77-0x0000000002C50000-0x0000000002CF6000-memory.dmpFilesize
664KB
-
memory/1320-54-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB