Analysis
- max time kernel
179s - max time network
201s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
10/02/2022, 07:26
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Fatura Siparisi.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Proforma Fatura Siparisi.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target Proforma Fatura Siparisi.exe
- Size 961KB
- Sample220210-h9rbvagbd2
- SHA256 31fa37041b3f218ac8e44e16ae4bc549e962ce1cda58a1df870179ee94ed1753
- MD5 341bc3b87842ce7869d240b26ea2810b
- SHA1 a843015746729c5876a5c28ad06248c0d1b68771
- SHA512 e9879fcb163d47bf811468c1552d73780e4f4d71e6e35216a6b807410b5547c9fd0c4bc415fb31fb700e5e34a5aa112b207b58a9f0153e7f8d86a6f5c830f1b6
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
euv4
Decoy
-
anniebapartments.com
-
hagenbicycles.com
-
herbalist101.com
-
southerncorrosion.net
-
kuechenpruefer.com
-
tajniezdrzi.quest
-
segurofunerarioar.com
-
boardsandbeamsdecor.com
-
alifdanismanlik.com
-
pkem.top
-
mddc.clinic
-
handejqr.com
-
crux-at.com
-
awp.email
-
hugsforbubbs.com
-
cielotherepy.com
-
turkcuyuz.com
-
teamidc.com
-
lankasirinspa.com
-
68135.online
-
oprimanumerodos.com
-
launchclik.com
-
customapronsnow.com
-
thecuratedpour.com
-
20dzwww.com
-
encludemedia.com
-
kreativevisibility.net
-
mehfeels.com
-
oecmgroup.com
-
alert78.info
-
1207rossmoyne.com
-
spbutoto.com
-
t1uba.com
-
protection-onepa.com
-
byausorsm26-plala.xyz
-
bestpleasure4u.com
-
allmnlenem.quest
-
mobilpartes.com
-
fabio.tools
-
bubu3cin.com
-
nathanmartinez.digital
-
shristiprintingplaces.com
-
silkyflawless.com
-
berylgrote.top
-
laidbackfurniture.store
-
leatherman-neal.com
-
uschargeport.com
-
the-pumps.com
-
deepootech.com
-
drimev.com
-
seo-art.agency
-
jasabacklinkweb20.com
-
tracynicolalamond.com
-
dandtglaziers.com
-
vulacils.com
-
bendyourtongue.com
-
gulfund.com
-
ahmadfaizlajis.com
-
595531.com
-
metavillagehub.com
-
librairie-adrienne.com
-
77777.store
-
gongwenbo.com
-
game2plays.com
-
rematedeldia.com
Signatures
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/4196-134-0x0000000072480000-0x00000000724A9000-memory.dmp xloader behavioral2/memory/2384-143-0x0000000000850000-0x0000000000879000-memory.dmp xloader - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fqcqmaoh = "C:\\Users\\Admin\\hoamqcqF.url" Proforma Fatura Siparisi.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4196 set thread context of 2620 4196 logagent.exe 42 PID 2384 set thread context of 2620 2384 cmstp.exe 42 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4196 logagent.exe 4196 logagent.exe 4196 logagent.exe 4196 logagent.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe 2384 cmstp.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2620 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4196 logagent.exe 4196 logagent.exe 4196 logagent.exe 2384 cmstp.exe 2384 cmstp.exe - Suspicious use of AdjustPrivilegeToken 47 IoCs
description pid Process Token: SeDebugPrivilege 4196 logagent.exe Token: SeShutdownPrivilege 1700 svchost.exe Token: SeCreatePagefilePrivilege 1700 svchost.exe Token: SeShutdownPrivilege 1700 svchost.exe Token: SeCreatePagefilePrivilege 1700 svchost.exe Token: SeDebugPrivilege 2384 cmstp.exe Token: SeShutdownPrivilege 1700 svchost.exe Token: SeCreatePagefilePrivilege 1700 svchost.exe Token: SeShutdownPrivilege 2620 Explorer.EXE Token: SeCreatePagefilePrivilege 2620 Explorer.EXE Token: SeShutdownPrivilege 2620 Explorer.EXE Token: SeCreatePagefilePrivilege 2620 Explorer.EXE Token: SeSecurityPrivilege 4204 TiWorker.exe Token: SeRestorePrivilege 4204 TiWorker.exe Token: SeBackupPrivilege 4204 TiWorker.exe Token: SeBackupPrivilege 4204 TiWorker.exe Token: SeRestorePrivilege 4204 TiWorker.exe Token: SeSecurityPrivilege 4204 TiWorker.exe Token: SeBackupPrivilege 4204 TiWorker.exe Token: SeRestorePrivilege 4204 TiWorker.exe Token: SeSecurityPrivilege 4204 TiWorker.exe Token: SeBackupPrivilege 4204 TiWorker.exe Token: SeRestorePrivilege 4204 TiWorker.exe Token: SeSecurityPrivilege 4204 TiWorker.exe Token: SeBackupPrivilege 4204 TiWorker.exe Token: SeRestorePrivilege 4204 TiWorker.exe Token: SeSecurityPrivilege 4204 TiWorker.exe Token: SeBackupPrivilege 4204 TiWorker.exe Token: SeRestorePrivilege 4204 TiWorker.exe Token: SeSecurityPrivilege 4204 TiWorker.exe Token: SeBackupPrivilege 4204 TiWorker.exe Token: SeRestorePrivilege 4204 TiWorker.exe Token: SeSecurityPrivilege 4204 TiWorker.exe Token: SeBackupPrivilege 4204 TiWorker.exe Token: SeRestorePrivilege 4204 TiWorker.exe Token: SeSecurityPrivilege 4204 TiWorker.exe Token: SeBackupPrivilege 4204 TiWorker.exe Token: SeRestorePrivilege 4204 TiWorker.exe Token: SeSecurityPrivilege 4204 TiWorker.exe Token: SeBackupPrivilege 4204 TiWorker.exe Token: SeRestorePrivilege 4204 TiWorker.exe Token: SeSecurityPrivilege 4204 TiWorker.exe Token: SeBackupPrivilege 4204 TiWorker.exe Token: SeRestorePrivilege 4204 TiWorker.exe Token: SeSecurityPrivilege 4204 TiWorker.exe Token: SeShutdownPrivilege 2620 Explorer.EXE Token: SeCreatePagefilePrivilege 2620 Explorer.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2620 Explorer.EXE 2620 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4728 wrote to memory of 4196 4728 Proforma Fatura Siparisi.exe 91 PID 4728 wrote to memory of 4196 4728 Proforma Fatura Siparisi.exe 91 PID 4728 wrote to memory of 4196 4728 Proforma Fatura Siparisi.exe 91 PID 4728 wrote to memory of 4196 4728 Proforma Fatura Siparisi.exe 91 PID 4728 wrote to memory of 4196 4728 Proforma Fatura Siparisi.exe 91 PID 4728 wrote to memory of 4196 4728 Proforma Fatura Siparisi.exe 91 PID 2620 wrote to memory of 2384 2620 Explorer.EXE 92 PID 2620 wrote to memory of 2384 2620 Explorer.EXE 92 PID 2620 wrote to memory of 2384 2620 Explorer.EXE 92 PID 2384 wrote to memory of 2228 2384 cmstp.exe 96 PID 2384 wrote to memory of 2228 2384 cmstp.exe 96 PID 2384 wrote to memory of 2228 2384 cmstp.exe 96
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\Proforma Fatura Siparisi.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Fatura Siparisi.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4196
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\logagent.exe"3⤵PID:2228
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1700
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4204