Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
09/08/2021, 05:26
Static task
static1
Behavioral task
behavioral1
Sample
CTM_USD55,000.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target CTM_USD55,000.exe
- Size 229KB
- Sample210809-kpmant6t9s
- SHA256 0f09b5a5ad2bf792ed543e2b170d969e40591157ed92b5766c3cc3ab7deb2df1
- MD5 f3df2367a79e7f135a7ddaefb423ae40
- SHA1 a08be77c9e91a124e251155643086b3a91f0364c
- SHA512 7fac3bf55ceecb2c6c81d65485098164de00f977415b349dc198c2ef9145792032b9a27302e2cc1c1c1e7d5d33c9dfeb38d6c530f6d26e5f6e2eb505b0f64244
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.3
Campaign
-
noi6
C2
-
http://www.offshoresrilanka.com/noi6/
Decoy
-
yow.today
-
rkdreamcreations.com
-
etheriumtech.com
-
stretchwrench.com
-
kiddiecruise.com
-
stickforward.com
-
videocineproduccion.com
-
roofinginamerica.com
-
amarillasnuevomexico.com
-
armfieldmillerripley.com
-
macyburn.club
-
lvbaoshan.com
-
shopshelponline.com
-
thebunnybrands.com
-
newsxplor.com
-
momunani.com
-
rebelnqueen.com
-
tusguitarras.com
-
nexab2b.com
-
e3office.express
-
restpostenboerse.com
-
empdx.net
-
treekium.com
-
kuyumcusigortasi.com
-
icufashionaccessories.com
-
olv.design
-
vraniqi-plast.com
-
metalate.com
-
salondelalocura.com
-
parivarthanarchitects.com
-
lovewithjanel.community
-
thelifeprotectgroup.com
-
tukangphoto.com
-
seguridadcusaem.com
-
europeisawesome.com
-
celinbag.com
-
e-basvuru-hizmetleri.com
-
myfojwinx.icu
-
wecamptee.com
-
weihang0769.com
-
onlinecolorization.com
-
vaccinocovid19.info
-
novastreaming.net
-
menuhaliving.com
-
gayderjoes.com
-
pantysniffershop.com
-
powerbie.com
-
naplesebike.com
-
chipinsideyourbrain.com
-
thegioicaytrongnha.com
-
downtowntallyretreat.com
-
latiaov.net
-
albanyfence.com
-
ttzya.com
-
jvillehatchery.com
-
shaonix.com
-
swaphomeloans.com
-
hotelsasian.com
-
truckcar.info
-
papocabecaepescoco.net
-
dekodizajn.com
-
bulukx.com
-
turbochargeyourwriting.com
-
lcscards-veilig.icu
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/3556-116-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4088-122-0x0000000000770000-0x0000000000799000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 632 set thread context of 3556 632 CTM_USD55,000.exe 76 PID 3556 set thread context of 2428 3556 CTM_USD55,000.exe 21 PID 4088 set thread context of 2428 4088 raserver.exe 21 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3556 CTM_USD55,000.exe 3556 CTM_USD55,000.exe 3556 CTM_USD55,000.exe 3556 CTM_USD55,000.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe 4088 raserver.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2428 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 632 CTM_USD55,000.exe 3556 CTM_USD55,000.exe 3556 CTM_USD55,000.exe 3556 CTM_USD55,000.exe 4088 raserver.exe 4088 raserver.exe - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 3556 CTM_USD55,000.exe Token: SeShutdownPrivilege 2428 Explorer.EXE Token: SeCreatePagefilePrivilege 2428 Explorer.EXE Token: SeShutdownPrivilege 2428 Explorer.EXE Token: SeCreatePagefilePrivilege 2428 Explorer.EXE Token: SeShutdownPrivilege 2428 Explorer.EXE Token: SeCreatePagefilePrivilege 2428 Explorer.EXE Token: SeShutdownPrivilege 2428 Explorer.EXE Token: SeCreatePagefilePrivilege 2428 Explorer.EXE Token: SeDebugPrivilege 4088 raserver.exe Token: SeShutdownPrivilege 2428 Explorer.EXE Token: SeCreatePagefilePrivilege 2428 Explorer.EXE Token: SeShutdownPrivilege 2428 Explorer.EXE Token: SeCreatePagefilePrivilege 2428 Explorer.EXE Token: SeShutdownPrivilege 2428 Explorer.EXE Token: SeCreatePagefilePrivilege 2428 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2428 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 632 wrote to memory of 3556 632 CTM_USD55,000.exe 76 PID 632 wrote to memory of 3556 632 CTM_USD55,000.exe 76 PID 632 wrote to memory of 3556 632 CTM_USD55,000.exe 76 PID 632 wrote to memory of 3556 632 CTM_USD55,000.exe 76 PID 2428 wrote to memory of 4088 2428 Explorer.EXE 77 PID 2428 wrote to memory of 4088 2428 Explorer.EXE 77 PID 2428 wrote to memory of 4088 2428 Explorer.EXE 77 PID 4088 wrote to memory of 3580 4088 raserver.exe 80 PID 4088 wrote to memory of 3580 4088 raserver.exe 80 PID 4088 wrote to memory of 3580 4088 raserver.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\CTM_USD55,000.exe"C:\Users\Admin\AppData\Local\Temp\CTM_USD55,000.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\CTM_USD55,000.exe"C:\Users\Admin\AppData\Local\Temp\CTM_USD55,000.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3556
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\CTM_USD55,000.exe"3⤵PID:3580
-
-