Analysis
-
max time kernel
155s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 21:30
Static task
static1
Behavioral task
behavioral1
Sample
TT Transmitted Copy TRVTT2200390.exe
Resource
win7-en-20211208
General
-
Target
TT Transmitted Copy TRVTT2200390.exe
-
Size
706KB
-
MD5
e08f07a15096d5eda6b9af217640692b
-
SHA1
d97dde29c20cc83def959ede08e0194db4cd3453
-
SHA256
071d14c83f00ed98e9c00926273cc741b6de2c4d74b7c02b63dce652ae5b8735
-
SHA512
dc529b138f4083608551dd0028c8d971724a06432000b56f8baf9b787a0e810248f4892a8ad68276f0416d01a52473bc96c6025814f6bde3c434bb8e940c6291
Malware Config
Extracted
xloader
2.5
n8bs
monese-bank.com
silkypumps.xyz
tashabouvier.com
eduardoleonsilva.com
pinnaclecorporaterentals.com
megafluids.com
worldwidecarfans.com
benjamlnesq.com
unitedraxiapp.com
thetanheroes.com
jypmore.quest
indianasheriffs.biz
saintinstead.com
alldansmx.com
trulyproofreading.com
indotogel369.com
mermadekusse.store
radosenterprisellc.com
gseequalservices.com
techride.xyz
2031corp.com
centelytics.com
payperlivecalls.com
iphone13promax.guide
leadslingerstraining.com
generateideasint.com
afgelocal2741.com
n-visionlearning.com
strumagokart.quest
noisesocial.com
completefilmguide.com
mawuyrapaulin.com
heptagonfx.com
hype-clicks.com
uxog0.online
932381.com
trumpetrofnky.xyz
samudombang.com
hairtederionos.com
10karmy.com
nangniubanchanviet.online
brooklynprowellness.com
rockstarcleaningclub.com
rollnwin.top
breastextra.com
zahad-riedel.com
xuebqufvcdbgbqypuywgntpy.store
blogging2success.com
cnshippingagency.com
danielquasar.net
allthingsdog.info
legaltulsa.com
pure-impression.store
jonbeedle.com
ndtailgateofchampions.com
steelhorserescue.com
smart-realy.com
rebornmkt.com
zaktheme.xyz
myfranciscanshoe.com
linkedinupdate.com
fulviopires.com
magicspaces.digital
avtoshop761.com
myveguiolcusbyopappgroup.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3496-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3496-128-0x0000000001480000-0x0000000001614000-memory.dmp xloader behavioral2/memory/3752-131-0x0000000002860000-0x0000000002889000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
TT Transmitted Copy TRVTT2200390.exeTT Transmitted Copy TRVTT2200390.execontrol.exedescription pid process target process PID 912 set thread context of 3496 912 TT Transmitted Copy TRVTT2200390.exe TT Transmitted Copy TRVTT2200390.exe PID 3496 set thread context of 3056 3496 TT Transmitted Copy TRVTT2200390.exe Explorer.EXE PID 3752 set thread context of 3056 3752 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
TT Transmitted Copy TRVTT2200390.execontrol.exepid process 3496 TT Transmitted Copy TRVTT2200390.exe 3496 TT Transmitted Copy TRVTT2200390.exe 3496 TT Transmitted Copy TRVTT2200390.exe 3496 TT Transmitted Copy TRVTT2200390.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe 3752 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3056 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
TT Transmitted Copy TRVTT2200390.execontrol.exepid process 3496 TT Transmitted Copy TRVTT2200390.exe 3496 TT Transmitted Copy TRVTT2200390.exe 3496 TT Transmitted Copy TRVTT2200390.exe 3752 control.exe 3752 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TT Transmitted Copy TRVTT2200390.execontrol.exedescription pid process Token: SeDebugPrivilege 3496 TT Transmitted Copy TRVTT2200390.exe Token: SeDebugPrivilege 3752 control.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
TT Transmitted Copy TRVTT2200390.exeExplorer.EXEcontrol.exedescription pid process target process PID 912 wrote to memory of 3496 912 TT Transmitted Copy TRVTT2200390.exe TT Transmitted Copy TRVTT2200390.exe PID 912 wrote to memory of 3496 912 TT Transmitted Copy TRVTT2200390.exe TT Transmitted Copy TRVTT2200390.exe PID 912 wrote to memory of 3496 912 TT Transmitted Copy TRVTT2200390.exe TT Transmitted Copy TRVTT2200390.exe PID 912 wrote to memory of 3496 912 TT Transmitted Copy TRVTT2200390.exe TT Transmitted Copy TRVTT2200390.exe PID 912 wrote to memory of 3496 912 TT Transmitted Copy TRVTT2200390.exe TT Transmitted Copy TRVTT2200390.exe PID 912 wrote to memory of 3496 912 TT Transmitted Copy TRVTT2200390.exe TT Transmitted Copy TRVTT2200390.exe PID 3056 wrote to memory of 3752 3056 Explorer.EXE control.exe PID 3056 wrote to memory of 3752 3056 Explorer.EXE control.exe PID 3056 wrote to memory of 3752 3056 Explorer.EXE control.exe PID 3752 wrote to memory of 2740 3752 control.exe cmd.exe PID 3752 wrote to memory of 2740 3752 control.exe cmd.exe PID 3752 wrote to memory of 2740 3752 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3496 -
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"3⤵PID:2740
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/912-123-0x0000000008140000-0x00000000081DC000-memory.dmpFilesize
624KB
-
memory/912-124-0x00000000082E0000-0x000000000833E000-memory.dmpFilesize
376KB
-
memory/912-115-0x0000000000D20000-0x0000000000DD8000-memory.dmpFilesize
736KB
-
memory/912-118-0x0000000005700000-0x0000000005792000-memory.dmpFilesize
584KB
-
memory/912-119-0x0000000005740000-0x000000000574A000-memory.dmpFilesize
40KB
-
memory/912-120-0x0000000007AC0000-0x0000000007B60000-memory.dmpFilesize
640KB
-
memory/912-121-0x0000000007C10000-0x0000000007C1E000-memory.dmpFilesize
56KB
-
memory/912-122-0x0000000007DD0000-0x0000000007E1B000-memory.dmpFilesize
300KB
-
memory/912-117-0x0000000005830000-0x00000000058C2000-memory.dmpFilesize
584KB
-
memory/912-116-0x0000000005D30000-0x000000000622E000-memory.dmpFilesize
5.0MB
-
memory/3056-134-0x0000000005C10000-0x0000000005D53000-memory.dmpFilesize
1.3MB
-
memory/3056-129-0x0000000002590000-0x000000000266C000-memory.dmpFilesize
880KB
-
memory/3496-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3496-128-0x0000000001480000-0x0000000001614000-memory.dmpFilesize
1.6MB
-
memory/3496-127-0x0000000001620000-0x0000000001940000-memory.dmpFilesize
3.1MB
-
memory/3752-130-0x00000000001C0000-0x00000000001E0000-memory.dmpFilesize
128KB
-
memory/3752-131-0x0000000002860000-0x0000000002889000-memory.dmpFilesize
164KB
-
memory/3752-132-0x0000000004470000-0x0000000004790000-memory.dmpFilesize
3.1MB
-
memory/3752-133-0x00000000042D0000-0x000000000446E000-memory.dmpFilesize
1.6MB