Analysis
- max time kernel
168s - max time network
174s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/02/2022, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
8c6d84464096e6d1849c689708516a8d.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 8c6d84464096e6d1849c689708516a8d.exe
- Size 385KB
- Sample220217-wsl8fseabl
- SHA256 6370ffa17cea91839f8a40555da2ef41f0e97d539e4bdc60871a7783abcdd7f6
- MD5 8c6d84464096e6d1849c689708516a8d
- SHA1 8be47c3512da862eacddc5f4e1eddc55d0e8d4bb
- SHA512 02913ecf4ab9927c86efb3add83a9edf21de2269acc49b698296626242d5aa04cd89eb8ac267ddafac82d39a2fa099e7474cd70f13f22ab324d1c54f14fbe967
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
ahc8
Decoy
-
192451.com
-
wwwripostes.net
-
sirikhalsalaw.com
-
bitterbaybay.com
-
stella-scrubs.com
-
almanecermezcal.com
-
goodgood.online
-
translate-now.online
-
sincerefilm.com
-
quadrantforensics.com
-
johnfrenchart.com
-
plick-click.com
-
alnileen.com
-
tghi.xyz
-
172711.com
-
maymakita.com
-
punnyaseva.com
-
ukash-online.com
-
sho-yururi-blog.com
-
hebergement-solidaire.com
-
civicinfluencers.net
-
gzhf8888.com
-
kuleallstar.com
-
palisadeslodgecondos.com
-
holyhirschsprungs.com
-
azalearoseuk.com
-
jaggllc.com
-
italianrofrow.xyz
-
ioewur.xyz
-
3a5hlv.icu
-
kitcycle.com
-
estate.xyz
-
ankaraescortvip.xyz
-
richclubsite2001.xyz
-
kastore.website
-
515pleasantvalleyway.com
-
sittlermd.com
-
mytemple.group
-
tiny-wagen.com
-
sharaleesvintageflames.com
-
mentalesteem.com
-
sport-newss.online
-
fbve.space
-
lovingtruebloodindallas.com
-
eaglehospitality.biz
-
roofrepairnow.info
-
mcrosfts-updata.digital
-
cimpactinc.com
-
greatnotleyeast.com
-
lovely-tics.com
-
douglas-enterprise.com
-
dayannalima.online
-
ksodl.com
-
rainbowlampro.com
-
theinteriorsfurniture.com
-
eidmueller.email
-
cg020.online
-
gta6fuzhu.com
-
cinemaocity.com
-
hopeitivity.com
-
savageequipment.biz
-
groceriesbazaar.com
-
hempgotas.com
-
casino-pharaon-play.xyz
-
ralfrassendnk-login.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/2556-134-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4448-142-0x0000000000960000-0x0000000000989000-memory.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 4716 mgavd.exe 2556 mgavd.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4716 set thread context of 2556 4716 mgavd.exe 84 PID 2556 set thread context of 2620 2556 mgavd.exe 37 PID 4448 set thread context of 2620 4448 colorcpl.exe 37 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2556 mgavd.exe 2556 mgavd.exe 2556 mgavd.exe 2556 mgavd.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe 4448 colorcpl.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2620 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2556 mgavd.exe 2556 mgavd.exe 2556 mgavd.exe 4448 colorcpl.exe 4448 colorcpl.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2556 mgavd.exe Token: SeShutdownPrivilege 1672 svchost.exe Token: SeCreatePagefilePrivilege 1672 svchost.exe Token: SeShutdownPrivilege 1672 svchost.exe Token: SeCreatePagefilePrivilege 1672 svchost.exe Token: SeDebugPrivilege 4448 colorcpl.exe Token: SeShutdownPrivilege 1672 svchost.exe Token: SeCreatePagefilePrivilege 1672 svchost.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe Token: SeSecurityPrivilege 1144 TiWorker.exe Token: SeBackupPrivilege 1144 TiWorker.exe Token: SeRestorePrivilege 1144 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4020 wrote to memory of 4716 4020 8c6d84464096e6d1849c689708516a8d.exe 82 PID 4020 wrote to memory of 4716 4020 8c6d84464096e6d1849c689708516a8d.exe 82 PID 4020 wrote to memory of 4716 4020 8c6d84464096e6d1849c689708516a8d.exe 82 PID 4716 wrote to memory of 2556 4716 mgavd.exe 84 PID 4716 wrote to memory of 2556 4716 mgavd.exe 84 PID 4716 wrote to memory of 2556 4716 mgavd.exe 84 PID 4716 wrote to memory of 2556 4716 mgavd.exe 84 PID 4716 wrote to memory of 2556 4716 mgavd.exe 84 PID 4716 wrote to memory of 2556 4716 mgavd.exe 84 PID 2620 wrote to memory of 4448 2620 Explorer.EXE 85 PID 2620 wrote to memory of 4448 2620 Explorer.EXE 85 PID 2620 wrote to memory of 4448 2620 Explorer.EXE 85 PID 4448 wrote to memory of 5004 4448 colorcpl.exe 89 PID 4448 wrote to memory of 5004 4448 colorcpl.exe 89 PID 4448 wrote to memory of 5004 4448 colorcpl.exe 89
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\8c6d84464096e6d1849c689708516a8d.exe"C:\Users\Admin\AppData\Local\Temp\8c6d84464096e6d1849c689708516a8d.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\mgavd.exeC:\Users\Admin\AppData\Local\Temp\mgavd.exe C:\Users\Admin\AppData\Local\Temp\qkiged3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\mgavd.exeC:\Users\Admin\AppData\Local\Temp\mgavd.exe C:\Users\Admin\AppData\Local\Temp\qkiged4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2556
-
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\mgavd.exe"3⤵PID:5004
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1144