xloader | 6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

General

Target

HTK TT600202109300860048866 Payment Proof.pdf.exe
Size

461KB
MD5

f12bf73a1cb81b5ddd8dd6ed66e610f1
SHA1

cb8b0497c95512bf9233823f7d20937424c87207
SHA256

6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33
SHA512

385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Score

10^/10

xloader euzn loader persistence rat spyware stealer

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060
Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral5/memory/1788-124-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral5/memory/1788-125-0x000000000041D420-mapping.dmp	xloader
behavioral5/memory/396-133-0x0000000000B50000-0x0000000000B79000-memory.dmp	xloader
behavioral5/memory/3316-152-0x000000000041D420-mapping.dmp	xloader

Executes dropped EXE 2 IoCs

Processes:

IconCachervwlyv.exeIconCachervwlyv.exe

pid process

2176 IconCachervwlyv.exe
3316 IconCachervwlyv.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2176	IconCachervwlyv.exe
3316	IconCachervwlyv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

colorcpl.exe

description	ioc	process
Key created	\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	colorcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ARSTZVHPEN = "C:\\Program Files (x86)\\Z7nax7bm\\IconCachervwlyv.exe"	colorcpl.exe

Drops file in System32 directory 4 IoCs

Processes:

OfficeC2RClient.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-shm	OfficeC2RClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	OfficeC2RClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db	OfficeC2RClient.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-wal	OfficeC2RClient.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

HTK TT600202109300860048866 Payment Proof.pdf.exeHTK TT600202109300860048866 Payment Proof.pdf.execolorcpl.exeIconCachervwlyv.exe

description	pid	process	target process
PID 1988 set thread context of 1788	1988	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 1788 set thread context of 2604	1788	HTK TT600202109300860048866 Payment Proof.pdf.exe	Explorer.EXE
PID 396 set thread context of 2604	396	colorcpl.exe	Explorer.EXE
PID 2176 set thread context of 3316	2176	IconCachervwlyv.exe	IconCachervwlyv.exe

Drops file in Program Files directory 4 IoCs

Processes:

colorcpl.exeExplorer.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\Z7nax7bm\IconCachervwlyv.exe	colorcpl.exe
File opened for modification	C:\Program Files (x86)\Z7nax7bm	Explorer.EXE
File created	C:\Program Files (x86)\Z7nax7bm\IconCachervwlyv.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Z7nax7bm\IconCachervwlyv.exe	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

colorcpl.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	colorcpl.exe

Modifies data under HKEY_USERS 23 IoCs

Processes:

OfficeC2RClient.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides	OfficeC2RClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\Volatile	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData	OfficeC2RClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1"	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation	OfficeC2RClient.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe	OfficeC2RClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,941 10,1329 15,941 15,941 6,1329 100,1329 6"	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun	OfficeC2RClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2"	OfficeC2RClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeC2RClient.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,17110988,7153487,39965824,17962391,17962392,3702920,3462423,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeC2RClient.exe

Modifies registry class 47 IoCs

Processes:

Explorer.EXEFileSyncConfig.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\Attributes = "17"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INSTANCE\INITPROPERTYBAG	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\WOW6432NODE\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\System.IsPinnedToNameSpaceTree = "1"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	Explorer.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\Attributes = "4034920525"	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SortOrderIndex = "66"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe,0"	FileSyncConfig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	Explorer.EXE
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DEFAULTICON	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\CLSID = "{0E5AAE11-A475-4c5b-AB00-C66DE400274E}"	FileSyncConfig.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder\FolderValueFlags = "40"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag	FileSyncConfig.exe
Key deleted	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\SysWow64\\shell32.dll"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\InitPropertyBag\TargetKnownFolder = "{a52bba46-e9e1-435f-b3d9-28daa648c0f6}"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\DefaultIcon	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder	FileSyncConfig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

HTK TT600202109300860048866 Payment Proof.pdf.execolorcpl.exe

pid	process
1788	HTK TT600202109300860048866 Payment Proof.pdf.exe
1788	HTK TT600202109300860048866 Payment Proof.pdf.exe
1788	HTK TT600202109300860048866 Payment Proof.pdf.exe
1788	HTK TT600202109300860048866 Payment Proof.pdf.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2604 Explorer.EXE

pid	process
2604	Explorer.EXE

Suspicious behavior: MapViewOfSection 7 IoCs

Processes:

HTK TT600202109300860048866 Payment Proof.pdf.execolorcpl.exe

pid	process
1788	HTK TT600202109300860048866 Payment Proof.pdf.exe
1788	HTK TT600202109300860048866 Payment Proof.pdf.exe
1788	HTK TT600202109300860048866 Payment Proof.pdf.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe
396	colorcpl.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

HTK TT600202109300860048866 Payment Proof.pdf.execolorcpl.exeExplorer.EXEIconCachervwlyv.exe

description	pid	process
Token: SeDebugPrivilege	1788	HTK TT600202109300860048866 Payment Proof.pdf.exe
Token: SeDebugPrivilege	396	colorcpl.exe
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeDebugPrivilege	3316	IconCachervwlyv.exe
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE
Token: SeShutdownPrivilege	2604	Explorer.EXE
Token: SeCreatePagefilePrivilege	2604	Explorer.EXE

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

Explorer.EXE

pid process

2604 Explorer.EXE
2604 Explorer.EXE
2604 Explorer.EXE
2604 Explorer.EXE
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OfficeC2RClient.exe

pid process

1476 OfficeC2RClient.exe

pid	process
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE
2604	Explorer.EXE

pid	process
1476	OfficeC2RClient.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

HTK TT600202109300860048866 Payment Proof.pdf.exeExplorer.EXEcolorcpl.exeIconCachervwlyv.exe

description	pid	process	target process
PID 1988 wrote to memory of 1788	1988	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 1988 wrote to memory of 1788	1988	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 1988 wrote to memory of 1788	1988	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 1988 wrote to memory of 1788	1988	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 1988 wrote to memory of 1788	1988	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 1988 wrote to memory of 1788	1988	HTK TT600202109300860048866 Payment Proof.pdf.exe	HTK TT600202109300860048866 Payment Proof.pdf.exe
PID 2604 wrote to memory of 396	2604	Explorer.EXE	colorcpl.exe
PID 2604 wrote to memory of 396	2604	Explorer.EXE	colorcpl.exe
PID 2604 wrote to memory of 396	2604	Explorer.EXE	colorcpl.exe
PID 396 wrote to memory of 2228	396	colorcpl.exe	cmd.exe
PID 396 wrote to memory of 2228	396	colorcpl.exe	cmd.exe
PID 396 wrote to memory of 2228	396	colorcpl.exe	cmd.exe
PID 396 wrote to memory of 2076	396	colorcpl.exe	cmd.exe
PID 396 wrote to memory of 2076	396	colorcpl.exe	cmd.exe
PID 396 wrote to memory of 2076	396	colorcpl.exe	cmd.exe
PID 396 wrote to memory of 2148	396	colorcpl.exe	Firefox.exe
PID 396 wrote to memory of 2148	396	colorcpl.exe	Firefox.exe
PID 2604 wrote to memory of 2176	2604	Explorer.EXE	IconCachervwlyv.exe
PID 2604 wrote to memory of 2176	2604	Explorer.EXE	IconCachervwlyv.exe
PID 2604 wrote to memory of 2176	2604	Explorer.EXE	IconCachervwlyv.exe
PID 396 wrote to memory of 2148	396	colorcpl.exe	Firefox.exe
PID 2176 wrote to memory of 3316	2176	IconCachervwlyv.exe	IconCachervwlyv.exe
PID 2176 wrote to memory of 3316	2176	IconCachervwlyv.exe	IconCachervwlyv.exe
PID 2176 wrote to memory of 3316	2176	IconCachervwlyv.exe	IconCachervwlyv.exe
PID 2176 wrote to memory of 3316	2176	IconCachervwlyv.exe	IconCachervwlyv.exe
PID 2176 wrote to memory of 3316	2176	IconCachervwlyv.exe	IconCachervwlyv.exe
PID 2176 wrote to memory of 3316	2176	IconCachervwlyv.exe	IconCachervwlyv.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2604

C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988

C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1788

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
3⤵
PID:2228

C:\Windows\SysWOW64\cmd.exe
/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
3⤵
PID:2076

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:2148

C:\Program Files (x86)\Z7nax7bm\IconCachervwlyv.exe
"C:\Program Files (x86)\Z7nax7bm\IconCachervwlyv.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2176

C:\Program Files (x86)\Z7nax7bm\IconCachervwlyv.exe
"C:\Program Files (x86)\Z7nax7bm\IconCachervwlyv.exe"
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3316

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"
1⤵
- Modifies registry class
PID:2432

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1476

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Z7nax7bm\IconCachervwlyv.exe
MD5
f12bf73a1cb81b5ddd8dd6ed66e610f1

SHA1
cb8b0497c95512bf9233823f7d20937424c87207

SHA256
6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

SHA512
385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Download Submit
C:\Program Files (x86)\Z7nax7bm\IconCachervwlyv.exe
MD5
f12bf73a1cb81b5ddd8dd6ed66e610f1

SHA1
cb8b0497c95512bf9233823f7d20937424c87207

SHA256
6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

SHA512
385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Download Submit
C:\Program Files (x86)\Z7nax7bm\IconCachervwlyv.exe
MD5
f12bf73a1cb81b5ddd8dd6ed66e610f1

SHA1
cb8b0497c95512bf9233823f7d20937424c87207

SHA256
6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

SHA512
385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Download Submit
C:\Users\Admin\AppData\Local\Temp\DB1
MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
memory/396-134-0x0000000004C60000-0x0000000004F80000-memory.dmp

Filesize
3.1MB

Download
memory/396-135-0x0000000004AC0000-0x0000000004B50000-memory.dmp

Filesize
576KB

Download
memory/396-130-0x0000000000000000-mapping.dmp

Download
memory/396-132-0x0000000001170000-0x0000000001189000-memory.dmp

Filesize
100KB

Download
memory/396-133-0x0000000000B50000-0x0000000000B79000-memory.dmp

Filesize
164KB

Download
memory/1788-124-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1788-125-0x000000000041D420-mapping.dmp

Download
memory/1788-126-0x0000000001940000-0x0000000001C60000-memory.dmp

Filesize
3.1MB

Download
memory/1788-128-0x00000000018F0000-0x0000000001901000-memory.dmp

Filesize
68KB

Download
memory/1988-123-0x00000000056D0000-0x000000000571B000-memory.dmp

Filesize
300KB

Download
memory/1988-119-0x0000000004980000-0x0000000004E7E000-memory.dmp

Filesize
5.0MB

Download
memory/1988-117-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/1988-115-0x00000000000E0000-0x00000000000E1000-memory.dmp

Filesize
4KB

Download
memory/1988-122-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/1988-121-0x0000000004A10000-0x0000000004A17000-memory.dmp

Filesize
28KB

Download
memory/1988-118-0x0000000004A20000-0x0000000004A21000-memory.dmp

Filesize
4KB

Download
memory/1988-120-0x0000000004990000-0x0000000004991000-memory.dmp

Filesize
4KB

Download
memory/2076-137-0x0000000000000000-mapping.dmp

Download
memory/2176-139-0x0000000000000000-mapping.dmp

Download
memory/2176-148-0x0000000005810000-0x0000000005D0E000-memory.dmp

Filesize
5.0MB

Download
memory/2228-131-0x0000000000000000-mapping.dmp

Download
memory/2604-136-0x0000000006BB0000-0x0000000006CF5000-memory.dmp

Filesize
1.3MB

Download
memory/2604-129-0x0000000006790000-0x0000000006924000-memory.dmp

Filesize
1.6MB

Download
memory/3316-152-0x000000000041D420-mapping.dmp

Download
memory/3316-154-0x0000000000EC0000-0x00000000011E0000-memory.dmp

Filesize
3.1MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads