Analysis
-
max time kernel
188s -
max time network
198s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 12:17
Static task
static1
Behavioral task
behavioral1
Sample
4tWrWVF8FkB9IrJ.exe
Resource
win7-en-20211208
General
-
Target
4tWrWVF8FkB9IrJ.exe
-
Size
414KB
-
MD5
edcc11c57c2fb4d186e43c373e26767e
-
SHA1
9213cc1be29f552bb97312cba2d7976a682c77bb
-
SHA256
72417f2e53964171cecc3819ad3033955ef54b7eb0d7cb542fe089d4f19c5f5d
-
SHA512
efafe40f26016e6e7853b94f43431b29ce75cf14c92feba4f15cadcd9fd18080d0b770e0dbbff992616d0842c6d5d6c661151cc6776fae3cb6d2d49cb6e6476e
Malware Config
Extracted
xloader
2.5
cbgo
tablescaperendezvous4two.net
abktransportllc.net
roseevision.com
skategrindingwheels.com
robux-generator-free.xyz
yacusi.com
mgav35.xyz
paravocecommerce.com
venkatramanrm.com
freakyhamster.com
jenaashoponline.com
dmozlisting.com
lorrainekclark.store
handyman-prime.com
thecrashingbrains.com
ukpms.com
livingstonemines.com
papeisonline.com
chrisbakerpr.com
omnipets.store
anatox-lab.fr
missingthered.com
himalaya-nepalorganic.com
bitcoin-bot.xyz
velarusbet78.com
redesignyourpain.com
alonetogetherentertainment.com
sandywalling.com
solacegolf.com
charlottesbestroofcompany.com
stefanybeauty.com
webarate.com
experiencedlawfirms.com
lyfygthj.com
monoicstudios.com
rgamming.com
mintique.pro
totalwinerewards.com
praelatusproducts.com
daniloff.pro
qmir.digital
tatasteell.com
casatowerofficial.com
sunrisespaandbodywork.com
mgav66.xyz
bastnbt.com
fabiulaezeca.com
sunmountainautomotive.com
madgeniustalk.com
elite-hc.com
billcurdmusic.net
foxclothings.com
adtcmrac.com
buresdx.com
tothelaundry.com
bitconga.com
onlinebiyoloji.online
up-trend.store
kaarlehto.com
interview.online
grantgroupproperties.com
jpmhomes.net
yinlimine.xyz
roadtrippings.com
cottoneworld.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3512-127-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3512-130-0x0000000000A80000-0x0000000000C13000-memory.dmp xloader behavioral2/memory/2836-134-0x0000000002EC0000-0x0000000002EE9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
4tWrWVF8FkB9IrJ.exe4tWrWVF8FkB9IrJ.exemsdt.exedescription pid process target process PID 3764 set thread context of 3512 3764 4tWrWVF8FkB9IrJ.exe 4tWrWVF8FkB9IrJ.exe PID 3512 set thread context of 3004 3512 4tWrWVF8FkB9IrJ.exe Explorer.EXE PID 2836 set thread context of 3004 2836 msdt.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
4tWrWVF8FkB9IrJ.exe4tWrWVF8FkB9IrJ.exemsdt.exepid process 3764 4tWrWVF8FkB9IrJ.exe 3764 4tWrWVF8FkB9IrJ.exe 3512 4tWrWVF8FkB9IrJ.exe 3512 4tWrWVF8FkB9IrJ.exe 3512 4tWrWVF8FkB9IrJ.exe 3512 4tWrWVF8FkB9IrJ.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe 2836 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3004 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
4tWrWVF8FkB9IrJ.exemsdt.exepid process 3512 4tWrWVF8FkB9IrJ.exe 3512 4tWrWVF8FkB9IrJ.exe 3512 4tWrWVF8FkB9IrJ.exe 2836 msdt.exe 2836 msdt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4tWrWVF8FkB9IrJ.exe4tWrWVF8FkB9IrJ.exemsdt.exedescription pid process Token: SeDebugPrivilege 3764 4tWrWVF8FkB9IrJ.exe Token: SeDebugPrivilege 3512 4tWrWVF8FkB9IrJ.exe Token: SeDebugPrivilege 2836 msdt.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
4tWrWVF8FkB9IrJ.exeExplorer.EXEmsdt.exedescription pid process target process PID 3764 wrote to memory of 2828 3764 4tWrWVF8FkB9IrJ.exe 4tWrWVF8FkB9IrJ.exe PID 3764 wrote to memory of 2828 3764 4tWrWVF8FkB9IrJ.exe 4tWrWVF8FkB9IrJ.exe PID 3764 wrote to memory of 2828 3764 4tWrWVF8FkB9IrJ.exe 4tWrWVF8FkB9IrJ.exe PID 3764 wrote to memory of 3512 3764 4tWrWVF8FkB9IrJ.exe 4tWrWVF8FkB9IrJ.exe PID 3764 wrote to memory of 3512 3764 4tWrWVF8FkB9IrJ.exe 4tWrWVF8FkB9IrJ.exe PID 3764 wrote to memory of 3512 3764 4tWrWVF8FkB9IrJ.exe 4tWrWVF8FkB9IrJ.exe PID 3764 wrote to memory of 3512 3764 4tWrWVF8FkB9IrJ.exe 4tWrWVF8FkB9IrJ.exe PID 3764 wrote to memory of 3512 3764 4tWrWVF8FkB9IrJ.exe 4tWrWVF8FkB9IrJ.exe PID 3764 wrote to memory of 3512 3764 4tWrWVF8FkB9IrJ.exe 4tWrWVF8FkB9IrJ.exe PID 3004 wrote to memory of 2836 3004 Explorer.EXE msdt.exe PID 3004 wrote to memory of 2836 3004 Explorer.EXE msdt.exe PID 3004 wrote to memory of 2836 3004 Explorer.EXE msdt.exe PID 2836 wrote to memory of 3972 2836 msdt.exe cmd.exe PID 2836 wrote to memory of 3972 2836 msdt.exe cmd.exe PID 2836 wrote to memory of 3972 2836 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4tWrWVF8FkB9IrJ.exe"C:\Users\Admin\AppData\Local\Temp\4tWrWVF8FkB9IrJ.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4tWrWVF8FkB9IrJ.exe"C:\Users\Admin\AppData\Local\Temp\4tWrWVF8FkB9IrJ.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\4tWrWVF8FkB9IrJ.exe"C:\Users\Admin\AppData\Local\Temp\4tWrWVF8FkB9IrJ.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\4tWrWVF8FkB9IrJ.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2836-135-0x00000000043F0000-0x0000000004580000-memory.dmpFilesize
1.6MB
-
memory/2836-134-0x0000000002EC0000-0x0000000002EE9000-memory.dmpFilesize
164KB
-
memory/2836-133-0x0000000004580000-0x00000000048A0000-memory.dmpFilesize
3.1MB
-
memory/2836-132-0x00000000000B0000-0x0000000000223000-memory.dmpFilesize
1.4MB
-
memory/3004-136-0x00000000028C0000-0x000000000297B000-memory.dmpFilesize
748KB
-
memory/3004-131-0x0000000006A50000-0x0000000006B9E000-memory.dmpFilesize
1.3MB
-
memory/3512-127-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3512-130-0x0000000000A80000-0x0000000000C13000-memory.dmpFilesize
1.6MB
-
memory/3512-129-0x0000000000EF0000-0x0000000001210000-memory.dmpFilesize
3.1MB
-
memory/3764-122-0x0000000005290000-0x000000000529A000-memory.dmpFilesize
40KB
-
memory/3764-126-0x0000000006260000-0x00000000062BE000-memory.dmpFilesize
376KB
-
memory/3764-125-0x000000007EF10000-0x000000007EF11000-memory.dmpFilesize
4KB
-
memory/3764-124-0x0000000005DA0000-0x0000000005DAE000-memory.dmpFilesize
56KB
-
memory/3764-123-0x0000000005E30000-0x0000000005ECC000-memory.dmpFilesize
624KB
-
memory/3764-118-0x0000000000A00000-0x0000000000A6E000-memory.dmpFilesize
440KB
-
memory/3764-121-0x0000000005330000-0x000000000582E000-memory.dmpFilesize
5.0MB
-
memory/3764-120-0x0000000005330000-0x00000000053C2000-memory.dmpFilesize
584KB
-
memory/3764-119-0x0000000005830000-0x0000000005D2E000-memory.dmpFilesize
5.0MB