Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
17-01-2022 18:34
Static task
static1
Behavioral task
behavioral1
Sample
KONUgynwW37Tb1K.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
KONUgynwW37Tb1K.exe
Resource
win10v2004-en-20220113
General
-
Target
KONUgynwW37Tb1K.exe
-
Size
398KB
-
MD5
bb040b47d2f6f564bb5fdb59ff610ced
-
SHA1
ff31a2d5284d43b4f2ffd27594bddf8352db3149
-
SHA256
425f5003a91d1ecced29d4e5a5746806d0b7d5d4a3833c13b88677a3c27eb0de
-
SHA512
c91949fea00e5cdddbee1daf914b1806f2b458a3bde2842f90d0f43d4e3247b952f8780443c4cce50c4c42c07ec32b4f514c87b427eca3a323087556b2eb7721
Malware Config
Extracted
xloader
2.5
cbgo
tablescaperendezvous4two.net
abktransportllc.net
roseevision.com
skategrindingwheels.com
robux-generator-free.xyz
yacusi.com
mgav35.xyz
paravocecommerce.com
venkatramanrm.com
freakyhamster.com
jenaashoponline.com
dmozlisting.com
lorrainekclark.store
handyman-prime.com
thecrashingbrains.com
ukpms.com
livingstonemines.com
papeisonline.com
chrisbakerpr.com
omnipets.store
anatox-lab.fr
missingthered.com
himalaya-nepalorganic.com
bitcoin-bot.xyz
velarusbet78.com
redesignyourpain.com
alonetogetherentertainment.com
sandywalling.com
solacegolf.com
charlottesbestroofcompany.com
stefanybeauty.com
webarate.com
experiencedlawfirms.com
lyfygthj.com
monoicstudios.com
rgamming.com
mintique.pro
totalwinerewards.com
praelatusproducts.com
daniloff.pro
qmir.digital
tatasteell.com
casatowerofficial.com
sunrisespaandbodywork.com
mgav66.xyz
bastnbt.com
fabiulaezeca.com
sunmountainautomotive.com
madgeniustalk.com
elite-hc.com
billcurdmusic.net
foxclothings.com
adtcmrac.com
buresdx.com
tothelaundry.com
bitconga.com
onlinebiyoloji.online
up-trend.store
kaarlehto.com
interview.online
grantgroupproperties.com
jpmhomes.net
yinlimine.xyz
roadtrippings.com
cottoneworld.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/632-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/632-63-0x000000000041D3D0-mapping.dmp xloader behavioral1/memory/632-68-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1464-73-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1840 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
KONUgynwW37Tb1K.exeKONUgynwW37Tb1K.exechkdsk.exedescription pid process target process PID 1632 set thread context of 632 1632 KONUgynwW37Tb1K.exe KONUgynwW37Tb1K.exe PID 632 set thread context of 1380 632 KONUgynwW37Tb1K.exe Explorer.EXE PID 632 set thread context of 1380 632 KONUgynwW37Tb1K.exe Explorer.EXE PID 1464 set thread context of 1380 1464 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
KONUgynwW37Tb1K.exechkdsk.exepid process 632 KONUgynwW37Tb1K.exe 632 KONUgynwW37Tb1K.exe 632 KONUgynwW37Tb1K.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe 1464 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
KONUgynwW37Tb1K.exechkdsk.exepid process 632 KONUgynwW37Tb1K.exe 632 KONUgynwW37Tb1K.exe 632 KONUgynwW37Tb1K.exe 632 KONUgynwW37Tb1K.exe 1464 chkdsk.exe 1464 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
KONUgynwW37Tb1K.exechkdsk.exedescription pid process Token: SeDebugPrivilege 632 KONUgynwW37Tb1K.exe Token: SeDebugPrivilege 1464 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
KONUgynwW37Tb1K.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1632 wrote to memory of 632 1632 KONUgynwW37Tb1K.exe KONUgynwW37Tb1K.exe PID 1632 wrote to memory of 632 1632 KONUgynwW37Tb1K.exe KONUgynwW37Tb1K.exe PID 1632 wrote to memory of 632 1632 KONUgynwW37Tb1K.exe KONUgynwW37Tb1K.exe PID 1632 wrote to memory of 632 1632 KONUgynwW37Tb1K.exe KONUgynwW37Tb1K.exe PID 1632 wrote to memory of 632 1632 KONUgynwW37Tb1K.exe KONUgynwW37Tb1K.exe PID 1632 wrote to memory of 632 1632 KONUgynwW37Tb1K.exe KONUgynwW37Tb1K.exe PID 1632 wrote to memory of 632 1632 KONUgynwW37Tb1K.exe KONUgynwW37Tb1K.exe PID 1632 wrote to memory of 632 1632 KONUgynwW37Tb1K.exe KONUgynwW37Tb1K.exe PID 1632 wrote to memory of 632 1632 KONUgynwW37Tb1K.exe KONUgynwW37Tb1K.exe PID 1632 wrote to memory of 632 1632 KONUgynwW37Tb1K.exe KONUgynwW37Tb1K.exe PID 1380 wrote to memory of 1464 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 1464 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 1464 1380 Explorer.EXE chkdsk.exe PID 1380 wrote to memory of 1464 1380 Explorer.EXE chkdsk.exe PID 1464 wrote to memory of 1840 1464 chkdsk.exe cmd.exe PID 1464 wrote to memory of 1840 1464 chkdsk.exe cmd.exe PID 1464 wrote to memory of 1840 1464 chkdsk.exe cmd.exe PID 1464 wrote to memory of 1840 1464 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\KONUgynwW37Tb1K.exe"C:\Users\Admin\AppData\Local\Temp\KONUgynwW37Tb1K.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\KONUgynwW37Tb1K.exe"C:\Users\Admin\AppData\Local\Temp\KONUgynwW37Tb1K.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\KONUgynwW37Tb1K.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/632-69-0x00000000001F0000-0x0000000000201000-memory.dmpFilesize
68KB
-
memory/632-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/632-66-0x0000000000150000-0x0000000000161000-memory.dmpFilesize
68KB
-
memory/632-65-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/632-68-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/632-63-0x000000000041D3D0-mapping.dmp
-
memory/632-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/632-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1380-77-0x00000000066B0000-0x00000000067A0000-memory.dmpFilesize
960KB
-
memory/1380-67-0x0000000006BD0000-0x0000000006D2E000-memory.dmpFilesize
1.4MB
-
memory/1380-70-0x00000000072B0000-0x00000000073F9000-memory.dmpFilesize
1.3MB
-
memory/1464-71-0x0000000000000000-mapping.dmp
-
memory/1464-76-0x00000000006B0000-0x0000000000740000-memory.dmpFilesize
576KB
-
memory/1464-73-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1464-74-0x0000000002030000-0x0000000002333000-memory.dmpFilesize
3.0MB
-
memory/1464-72-0x0000000000770000-0x0000000000777000-memory.dmpFilesize
28KB
-
memory/1632-59-0x0000000000EC0000-0x0000000000F1E000-memory.dmpFilesize
376KB
-
memory/1632-54-0x0000000001120000-0x000000000118A000-memory.dmpFilesize
424KB
-
memory/1632-58-0x00000000006A0000-0x00000000006B0000-memory.dmpFilesize
64KB
-
memory/1632-55-0x0000000001120000-0x000000000118A000-memory.dmpFilesize
424KB
-
memory/1632-56-0x0000000076141000-0x0000000076143000-memory.dmpFilesize
8KB
-
memory/1632-57-0x00000000048E0000-0x00000000048E1000-memory.dmpFilesize
4KB
-
memory/1840-75-0x0000000000000000-mapping.dmp