Analysis
- max time kernel
158s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
09/02/2022, 16:19
Static task
static1
Behavioral task
behavioral1
Sample
e0f1e3b823d0cddfa31461ab72ea9406.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target e0f1e3b823d0cddfa31461ab72ea9406.exe
- Size 263KB
- Sample220209-tsh5pabahn
- SHA256 af7abd08a5752f55f59e38b2bd9568943ada7d2b23ddc3324b735beebd8846ce
- MD5 e0f1e3b823d0cddfa31461ab72ea9406
- SHA1 d13ac912867e46b4a88abc1ea35516fc95759a96
- SHA512 57b1019dbeade18f07be6ee66662f501e7b210ac74bbd0e2a78ba7e0d0c655c90409dfc6c64b31b32ceab44404279f20f7d1a621b64e651556f1d44dde6c20d0
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
o6tg
Decoy
-
turkscaicosonline.com
-
novelfoodtech.com
-
zgrmfww.com
-
gestionalcliente24hrs.store
-
postrojka.com
-
tapissier-uzes.com
-
tobytram.one
-
preamblegames.com
-
clicklinkzs.com
-
franksenen.com
-
beautygateway.net
-
foils-online.com
-
aout.us
-
promarkoperations.com
-
alignatura.com
-
changemylifefast.info
-
minbex.icu
-
internethustlersociety.com
-
chinacqn.com
-
fibsh.com
-
878971.com
-
diy-shisha.com
-
smarthomesecurity.online
-
orimsglow.com
-
platterwax.xyz
-
ipinksheets.com
-
robertatoschi.com
-
mieventi.com
-
qumuras.info
-
anyoneh.com
-
lovegasboutique.com
-
elimchambers.com
-
nanopicomedia.com
-
getoken.net
-
thechristmaslightingstore.com
-
progressivecapital.net
-
ott-leszek.com
-
flaneur.city
-
srikrishnadental.com
-
bantasis.com
-
forhims.jobs
-
sscmdpt.com
-
americanpawnaz.com
-
greatdayplumbing.com
-
skinstorecenter.com
-
chaoticcomicscrafts.com
-
farhadhossain.us
-
c-soi.com
-
http01.com
-
tjweifukeji.com
-
controldatasa.com
-
fitlearningphoenix.solutions
-
polecatroofing.com
-
xrxgqf.website
-
helmettips.com
-
caesarscasiono.com
-
dmfcommercialrealty.com
-
risecards.com
-
energycolumbus.com
-
slot138gacor.com
-
votenoahring.com
-
trigatefinancial.com
-
cuework.com
-
victorianalpine.com
-
makvik.online
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/1956-134-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1956-137-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1404-143-0x00000000007D0000-0x00000000007F9000-memory.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 2160 xbtzqwy.exe 1956 xbtzqwy.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2160 set thread context of 1956 2160 xbtzqwy.exe 83 PID 1956 set thread context of 3020 1956 xbtzqwy.exe 30 PID 1404 set thread context of 3020 1404 cmmon32.exe 30 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1956 xbtzqwy.exe 1956 xbtzqwy.exe 1956 xbtzqwy.exe 1956 xbtzqwy.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe 1404 cmmon32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3020 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1956 xbtzqwy.exe 1956 xbtzqwy.exe 1956 xbtzqwy.exe 1404 cmmon32.exe 1404 cmmon32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1956 xbtzqwy.exe Token: SeDebugPrivilege 1404 cmmon32.exe Token: SeShutdownPrivilege 4032 svchost.exe Token: SeCreatePagefilePrivilege 4032 svchost.exe Token: SeShutdownPrivilege 4032 svchost.exe Token: SeCreatePagefilePrivilege 4032 svchost.exe Token: SeShutdownPrivilege 4032 svchost.exe Token: SeCreatePagefilePrivilege 4032 svchost.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe Token: SeSecurityPrivilege 2136 TiWorker.exe Token: SeBackupPrivilege 2136 TiWorker.exe Token: SeRestorePrivilege 2136 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2160 1748 e0f1e3b823d0cddfa31461ab72ea9406.exe 82 PID 1748 wrote to memory of 2160 1748 e0f1e3b823d0cddfa31461ab72ea9406.exe 82 PID 1748 wrote to memory of 2160 1748 e0f1e3b823d0cddfa31461ab72ea9406.exe 82 PID 2160 wrote to memory of 1956 2160 xbtzqwy.exe 83 PID 2160 wrote to memory of 1956 2160 xbtzqwy.exe 83 PID 2160 wrote to memory of 1956 2160 xbtzqwy.exe 83 PID 2160 wrote to memory of 1956 2160 xbtzqwy.exe 83 PID 2160 wrote to memory of 1956 2160 xbtzqwy.exe 83 PID 2160 wrote to memory of 1956 2160 xbtzqwy.exe 83 PID 3020 wrote to memory of 1404 3020 Explorer.EXE 84 PID 3020 wrote to memory of 1404 3020 Explorer.EXE 84 PID 3020 wrote to memory of 1404 3020 Explorer.EXE 84 PID 1404 wrote to memory of 2280 1404 cmmon32.exe 88 PID 1404 wrote to memory of 2280 1404 cmmon32.exe 88 PID 1404 wrote to memory of 2280 1404 cmmon32.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\e0f1e3b823d0cddfa31461ab72ea9406.exe"C:\Users\Admin\AppData\Local\Temp\e0f1e3b823d0cddfa31461ab72ea9406.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\xbtzqwy.exeC:\Users\Admin\AppData\Local\Temp\xbtzqwy.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\xbtzqwy.exeC:\Users\Admin\AppData\Local\Temp\xbtzqwy.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\xbtzqwy.exe"3⤵PID:2280
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4032
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2136