Analysis
- max time kernel
181s - max time network
180s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
10/02/2022, 07:37
Static task
static1
Behavioral task
behavioral1
Sample
5ee1ef0817bb2681ca8322cc48568626.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 5ee1ef0817bb2681ca8322cc48568626.exe
- Size 372KB
- Sample220210-jfwvxagdfp
- SHA256 daf64aefe626d474f355e5d42de574fd52bc7f8afe382dce0e174e1cf4b23bf1
- MD5 5ee1ef0817bb2681ca8322cc48568626
- SHA1 9411fdbfdea26e209a6d9ae10d667fe50cb339da
- SHA512 14b7bdadf2ff42163a7b95897a2a0a23f16ce0a49088304a00c3075a20628067220a3472d705e5e886d16b0ab2fcf12d189914a425bb0cf419bbf328e6479c5b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
asus
Decoy
-
telomeye.com
-
camopants.net
-
thewealthwisdom.com
-
revolution-car.net
-
taketime2think.info
-
cornholetournamentsnearme.com
-
qinkewang.com
-
nft-online.store
-
tryoppos.net
-
academiapeniel.com
-
ilc-co.com
-
nationwidewine.online
-
petalicious.online
-
sadsacks.online
-
icateratlanta.com
-
diplomj-nsk.com
-
bluegreendi.com
-
lucashost.xyz
-
fcv99.com
-
type22.net
-
nekonoiruseikatsu.com
-
mot-associates.com
-
luxuryhomeandwellness.com
-
sedro-woolleyapartments.com
-
kuechenmann.com
-
xn--2es77o3w1bruk.mobi
-
miloslavskaya.online
-
intheshower.club
-
tonesify.com
-
onewellcy.com
-
ribbash.digital
-
ungalfresh.com
-
guillermoreyes.net
-
saltanatroleplay.com
-
sonyagivensrealty.com
-
yayouhuo.com
-
cnfet.net
-
pro-galaktika.space
-
mailsportalexpensas.com
-
plugandplaychallenge.net
-
cpw882.com
-
almallas.com
-
pinsnbrims.com
-
siyangtambola.com
-
3ebeasaap4.com
-
american-iraqi.com
-
elenazhilina.com
-
lmi-russia.com
-
blhsports.club
-
bumabagi.com
-
driiven.net
-
super-journaltolooktoday.info
-
nanjinghu.com
-
griffin-intl-ltd.com
-
fantacyfishingleague.net
-
9963d.com
-
slrp.info
-
castellanacustomboats.space
-
henfund.xyz
-
robiniapresentsc.com
-
thisfinghouse.com
-
adventuresegypttours.com
-
linaxnina.com
-
hollywoodzeal.com
-
popxgroup.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/2460-135-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1664-143-0x0000000000320000-0x0000000000349000-memory.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 2280 tkvcpycy.exe 2460 tkvcpycy.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2280 set thread context of 2460 2280 tkvcpycy.exe 87 PID 2460 set thread context of 3020 2460 tkvcpycy.exe 33 PID 1664 set thread context of 3020 1664 msdt.exe 33 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 2460 tkvcpycy.exe 2460 tkvcpycy.exe 2460 tkvcpycy.exe 2460 tkvcpycy.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe 1664 msdt.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3020 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2460 tkvcpycy.exe 2460 tkvcpycy.exe 2460 tkvcpycy.exe 1664 msdt.exe 1664 msdt.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2460 tkvcpycy.exe Token: SeDebugPrivilege 1664 msdt.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3900 svchost.exe Token: SeCreatePagefilePrivilege 3900 svchost.exe Token: SeShutdownPrivilege 3900 svchost.exe Token: SeCreatePagefilePrivilege 3900 svchost.exe Token: SeShutdownPrivilege 3900 svchost.exe Token: SeCreatePagefilePrivilege 3900 svchost.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeSecurityPrivilege 3656 TiWorker.exe Token: SeRestorePrivilege 3656 TiWorker.exe Token: SeBackupPrivilege 3656 TiWorker.exe Token: SeBackupPrivilege 3656 TiWorker.exe Token: SeRestorePrivilege 3656 TiWorker.exe Token: SeSecurityPrivilege 3656 TiWorker.exe Token: SeBackupPrivilege 3656 TiWorker.exe Token: SeRestorePrivilege 3656 TiWorker.exe Token: SeSecurityPrivilege 3656 TiWorker.exe Token: SeBackupPrivilege 3656 TiWorker.exe Token: SeRestorePrivilege 3656 TiWorker.exe Token: SeSecurityPrivilege 3656 TiWorker.exe Token: SeBackupPrivilege 3656 TiWorker.exe Token: SeRestorePrivilege 3656 TiWorker.exe Token: SeSecurityPrivilege 3656 TiWorker.exe Token: SeBackupPrivilege 3656 TiWorker.exe Token: SeRestorePrivilege 3656 TiWorker.exe Token: SeSecurityPrivilege 3656 TiWorker.exe Token: SeBackupPrivilege 3656 TiWorker.exe Token: SeRestorePrivilege 3656 TiWorker.exe Token: SeSecurityPrivilege 3656 TiWorker.exe Token: SeBackupPrivilege 3656 TiWorker.exe Token: SeRestorePrivilege 3656 TiWorker.exe Token: SeSecurityPrivilege 3656 TiWorker.exe Token: SeBackupPrivilege 3656 TiWorker.exe Token: SeRestorePrivilege 3656 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2340 wrote to memory of 2280 2340 5ee1ef0817bb2681ca8322cc48568626.exe 86 PID 2340 wrote to memory of 2280 2340 5ee1ef0817bb2681ca8322cc48568626.exe 86 PID 2340 wrote to memory of 2280 2340 5ee1ef0817bb2681ca8322cc48568626.exe 86 PID 2280 wrote to memory of 2460 2280 tkvcpycy.exe 87 PID 2280 wrote to memory of 2460 2280 tkvcpycy.exe 87 PID 2280 wrote to memory of 2460 2280 tkvcpycy.exe 87 PID 2280 wrote to memory of 2460 2280 tkvcpycy.exe 87 PID 2280 wrote to memory of 2460 2280 tkvcpycy.exe 87 PID 2280 wrote to memory of 2460 2280 tkvcpycy.exe 87 PID 3020 wrote to memory of 1664 3020 Explorer.EXE 88 PID 3020 wrote to memory of 1664 3020 Explorer.EXE 88 PID 3020 wrote to memory of 1664 3020 Explorer.EXE 88 PID 1664 wrote to memory of 3648 1664 msdt.exe 89 PID 1664 wrote to memory of 3648 1664 msdt.exe 89 PID 1664 wrote to memory of 3648 1664 msdt.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\5ee1ef0817bb2681ca8322cc48568626.exe"C:\Users\Admin\AppData\Local\Temp\5ee1ef0817bb2681ca8322cc48568626.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\tkvcpycy.exeC:\Users\Admin\AppData\Local\Temp\tkvcpycy.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\tkvcpycy.exeC:\Users\Admin\AppData\Local\Temp\tkvcpycy.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tkvcpycy.exe"3⤵PID:3648
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3900
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3656