Analysis
-
max time kernel
1200s -
max time network
1202s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-09-2021 07:53
Static task
static1
Behavioral task
behavioral1
Sample
t0ID2yWRERNRIz4.exe
Resource
win7-en-20210920
General
-
Target
t0ID2yWRERNRIz4.exe
-
Size
818KB
-
MD5
2fa809111f6953a10bcae39ef3f57aa7
-
SHA1
9415a9c252e39776162749c9131d96274cd6cac9
-
SHA256
7b4c1bf9a15a419080fe02866aa26f162f79d5e01763c6af5915b07988556223
-
SHA512
adb6b340237a62af5fced4c819bfa92317e15a4062dab379d97a1b2ecd9e5ace9fca9330872f7d4f01c2a0b96035d9a69a376d7f7c812fece8584326447933b9
Malware Config
Extracted
xloader
2.5
gjeh
http://www.getaudionow.com/gjeh/
carmator.com
bsbqrp.com
siemens-mp.com
dunnfloorcoverings.com
cpassminimedicalschools.info
howtodesignyourhomeoffice.com
famliytaste.com
freesocialmarketing.com
jejuhaenyeo.net
tradebot.icu
arzug.com
carrefour-solucoes.online
ladyom.com
aoironote.com
newmexicocarwreckattorney.com
wealthpatternsllc.net
thinkpinkalicous.com
prajapati.company
bjhwky.com
jsdigitalekuns.com
hada-kirara.xyz
cryptochatr.com
ehao5ahhl6.com
i8news-sv.website
12sky2limitless.online
royalknightent.store
dualvisionproductions.com
nextgenerationracingleague.com
1dy17.xyz
vineethnekuri.com
offlces.com
mmpluk.com
4kwallpapers.online
yakyu-eiga.com
advertisingresult.com
ktshandymanservices.com
reyizz.com
ethics.tools
cyberbesttechnology.com
glopik.com
claybycollins.com
buythedamnbike.com
7q3qq3.com
normanwagers.com
editoramandacaia.com
fscmyc.com
contactosasi.com
brightpretty.com
glavins.net
demoxyz.online
apnagas.com
drdavesea.com
wholeheartedfounder.com
gunpowderz.com
thegliderguy.com
drawcen.com
7777wns.com
tecmovco.com
a3chic.com
alattarherbs.com
tracks-clicks.com
appioservice.com
matthewwesco.club
lampshadefish.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3812-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3812-126-0x000000000041D460-mapping.dmp xloader behavioral2/memory/3768-133-0x0000000004DD0000-0x0000000004DF9000-memory.dmp xloader -
Executes dropped EXE 1 IoCs
Processes:
d8tpkrdfl.exepid process 3104 d8tpkrdfl.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chkdsk.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XRJ8BFHP = "C:\\Program Files (x86)\\B0dfl\\d8tpkrdfl.exe" chkdsk.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
t0ID2yWRERNRIz4.exeMSBuild.exechkdsk.exedescription pid process target process PID 628 set thread context of 3812 628 t0ID2yWRERNRIz4.exe MSBuild.exe PID 3812 set thread context of 2996 3812 MSBuild.exe Explorer.EXE PID 3768 set thread context of 2996 3768 chkdsk.exe Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
Explorer.EXEchkdsk.exedescription ioc process File opened for modification C:\Program Files (x86)\B0dfl\d8tpkrdfl.exe Explorer.EXE File opened for modification C:\Program Files (x86)\B0dfl\d8tpkrdfl.exe chkdsk.exe File opened for modification C:\Program Files (x86)\B0dfl Explorer.EXE File created C:\Program Files (x86)\B0dfl\d8tpkrdfl.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Modifies registry class 9 IoCs
Processes:
t0ID2yWRERNRIz4.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\Shell\open\command t0ID2yWRERNRIz4.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\Shell t0ID2yWRERNRIz4.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\Shell\open t0ID2yWRERNRIz4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\t0ID2yWRERNRIz4.exe\" \"%1\"" t0ID2yWRERNRIz4.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\DefaultIcon t0ID2yWRERNRIz4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\t0ID2yWRERNRIz4.exe" t0ID2yWRERNRIz4.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.gmkasm t0ID2yWRERNRIz4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.gmkasm\ = "GMKAssembler.Project" t0ID2yWRERNRIz4.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\GMKAssembler.Project t0ID2yWRERNRIz4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
t0ID2yWRERNRIz4.exeMSBuild.exechkdsk.exepid process 628 t0ID2yWRERNRIz4.exe 628 t0ID2yWRERNRIz4.exe 3812 MSBuild.exe 3812 MSBuild.exe 3812 MSBuild.exe 3812 MSBuild.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2996 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
MSBuild.exechkdsk.exepid process 3812 MSBuild.exe 3812 MSBuild.exe 3812 MSBuild.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
Processes:
t0ID2yWRERNRIz4.exeMSBuild.exechkdsk.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 628 t0ID2yWRERNRIz4.exe Token: SeDebugPrivilege 3812 MSBuild.exe Token: SeDebugPrivilege 3768 chkdsk.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
t0ID2yWRERNRIz4.exeExplorer.EXEchkdsk.exedescription pid process target process PID 628 wrote to memory of 3812 628 t0ID2yWRERNRIz4.exe MSBuild.exe PID 628 wrote to memory of 3812 628 t0ID2yWRERNRIz4.exe MSBuild.exe PID 628 wrote to memory of 3812 628 t0ID2yWRERNRIz4.exe MSBuild.exe PID 628 wrote to memory of 3812 628 t0ID2yWRERNRIz4.exe MSBuild.exe PID 628 wrote to memory of 3812 628 t0ID2yWRERNRIz4.exe MSBuild.exe PID 628 wrote to memory of 3812 628 t0ID2yWRERNRIz4.exe MSBuild.exe PID 2996 wrote to memory of 3768 2996 Explorer.EXE chkdsk.exe PID 2996 wrote to memory of 3768 2996 Explorer.EXE chkdsk.exe PID 2996 wrote to memory of 3768 2996 Explorer.EXE chkdsk.exe PID 3768 wrote to memory of 1244 3768 chkdsk.exe cmd.exe PID 3768 wrote to memory of 1244 3768 chkdsk.exe cmd.exe PID 3768 wrote to memory of 1244 3768 chkdsk.exe cmd.exe PID 3768 wrote to memory of 4032 3768 chkdsk.exe Firefox.exe PID 3768 wrote to memory of 4032 3768 chkdsk.exe Firefox.exe PID 2996 wrote to memory of 3104 2996 Explorer.EXE d8tpkrdfl.exe PID 2996 wrote to memory of 3104 2996 Explorer.EXE d8tpkrdfl.exe PID 2996 wrote to memory of 3104 2996 Explorer.EXE d8tpkrdfl.exe PID 3768 wrote to memory of 4032 3768 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\t0ID2yWRERNRIz4.exe"C:\Users\Admin\AppData\Local\Temp\t0ID2yWRERNRIz4.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\B0dfl\d8tpkrdfl.exe"C:\Program Files (x86)\B0dfl\d8tpkrdfl.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\B0dfl\d8tpkrdfl.exeMD5
9af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
C:\Program Files (x86)\B0dfl\d8tpkrdfl.exeMD5
9af17c8393f0970ee5136bd3ffa27001
SHA14b285b72c1a11285a25f31f2597e090da6bbc049
SHA25671d6a7a3fe5f8dc878cd5bdeca0e09177efb85c01e9a8a10a95262cabefaa019
SHA512b90f7de7d5ce72dccb264c7ba609e173c529b9d99ed9a63f88632bc58b1a994bbb727365f519c73b979f8918bd6de3c39a9f0347eb3a4bccdce4b2772a6516a3
-
memory/628-123-0x0000000007AF0000-0x0000000007B56000-memory.dmpFilesize
408KB
-
memory/628-116-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/628-118-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/628-120-0x0000000005A10000-0x0000000005A11000-memory.dmpFilesize
4KB
-
memory/628-121-0x0000000005DD0000-0x0000000005DED000-memory.dmpFilesize
116KB
-
memory/628-122-0x00000000078B0000-0x00000000078B1000-memory.dmpFilesize
4KB
-
memory/628-114-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/628-124-0x0000000007BF0000-0x0000000007C26000-memory.dmpFilesize
216KB
-
memory/628-117-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/628-119-0x0000000004CF0000-0x0000000004CF1000-memory.dmpFilesize
4KB
-
memory/1244-131-0x0000000000000000-mapping.dmp
-
memory/2996-129-0x00000000053F0000-0x0000000005567000-memory.dmpFilesize
1.5MB
-
memory/2996-136-0x0000000005570000-0x00000000056EE000-memory.dmpFilesize
1.5MB
-
memory/3104-137-0x0000000000000000-mapping.dmp
-
memory/3104-143-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/3104-142-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/3104-141-0x0000000000A40000-0x0000000000A41000-memory.dmpFilesize
4KB
-
memory/3104-140-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/3768-130-0x0000000000000000-mapping.dmp
-
memory/3768-135-0x00000000054B0000-0x0000000005540000-memory.dmpFilesize
576KB
-
memory/3768-133-0x0000000004DD0000-0x0000000004DF9000-memory.dmpFilesize
164KB
-
memory/3768-134-0x0000000005000000-0x000000000514A000-memory.dmpFilesize
1.3MB
-
memory/3768-132-0x0000000000180000-0x000000000018A000-memory.dmpFilesize
40KB
-
memory/3812-127-0x0000000001080000-0x00000000013A0000-memory.dmpFilesize
3.1MB
-
memory/3812-128-0x0000000000C20000-0x0000000000D6A000-memory.dmpFilesize
1.3MB
-
memory/3812-126-0x000000000041D460-mapping.dmp
-
memory/3812-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4032-145-0x00007FF645F20000-0x00007FF645FB3000-memory.dmpFilesize
588KB
-
memory/4032-144-0x0000000000000000-mapping.dmp
-
memory/4032-146-0x000001E675770000-0x000001E675814000-memory.dmpFilesize
656KB