Analysis
- max time kernel
164s - max time network
175s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
22/02/2022, 04:19
Static task
static1
Behavioral task
behavioral1
Sample
jzFbN3X6HH4H0YC.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target jzFbN3X6HH4H0YC.exe
- Size 832KB
- Sample220222-exhmdsdefk
- SHA256 9b4ea9f90dc0bd79331fb576e8e11bfcd1aaca5d89eed706bba28e23d81819e6
- MD5 d261ff3ddf608797f8007f534d089590
- SHA1 12d139a8cad257fe8da2cd6a0e41a702b364d1e4
- SHA512 fc5d5a0d7986ac26461a7c34d5d70b5dbda258fd34c24fe277d2ec4fbe604c8bbd5d0e633a177392299ccbbedca405882a02f5bf1f89ae40baec0c813561d8f6
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
rmpc
Decoy
-
lrsdh.com
-
sugarcurd.com
-
genussqmzg.online
-
warkulat.net
-
topstitched.com
-
sman1kotatambaloka.xyz
-
hireprowriter.com
-
robroyrecords.com
-
merlinreport.com
-
topofluna.com
-
planident.com
-
hokashoesingapore.com
-
buckitload.com
-
xn--0k1a.com
-
mynba2k22.com
-
thiccblanket.com
-
zayedhealth.clinic
-
alfer-srl.com
-
sunnysikka.com
-
sdtcbh.com
-
izzat.green
-
princealwaleed.com
-
cesiesis.com
-
alternativedata.company
-
chriscrown.xyz
-
fsyetuo.com
-
gmat-easy.online
-
daadoosh.com
-
sectorfarmaceutico.com
-
loueofficial.com
-
daddybearbodywork.com
-
dtmrealtyspi.com
-
contact-europe.com
-
meltingpotspot.com
-
baojiangou.com
-
escuelaacupunturaimai.com
-
bboldit.com
-
drawerfuid.com
-
sdysjskj.com
-
nbslktwx.com
-
nashvilleholdings.com
-
bajrangiexch9.com
-
cryptowhaledone.com
-
kai6agfw.com
-
silhouette-consult.com
-
vegane-adventskalender.info
-
6dianliu.com
-
virboss.online
-
mocmynghe.com
-
lilbimbi.com
-
dpsxsec.com
-
odnamyslowa.xyz
-
meetmedubai.com
-
rafke.online
-
unusual696.club
-
chathamwaste.com
-
yjaxx.com
-
eurostyl.net
-
krnlfree.com
-
urbandevelopers.net
-
k9surg.com
-
eazlabor.net
-
ttt-asia.com
-
12y0-blog.com
-
lktdjvbwepiw.mobi
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/1376-137-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1376-139-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2660-145-0x0000000000810000-0x0000000000839000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1100 set thread context of 1376 1100 jzFbN3X6HH4H0YC.exe 79 PID 1376 set thread context of 2404 1376 jzFbN3X6HH4H0YC.exe 26 PID 2660 set thread context of 2404 2660 cmmon32.exe 26 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 46 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4132" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "14.285035" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.126949" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "16.644545" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4140" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1376 jzFbN3X6HH4H0YC.exe 1376 jzFbN3X6HH4H0YC.exe 1376 jzFbN3X6HH4H0YC.exe 1376 jzFbN3X6HH4H0YC.exe 2660 cmmon32.exe 2660 cmmon32.exe 2660 cmmon32.exe 2660 cmmon32.exe 2660 cmmon32.exe 2660 cmmon32.exe 2660 cmmon32.exe 2660 cmmon32.exe 2660 cmmon32.exe 2660 cmmon32.exe 2660 cmmon32.exe 2660 cmmon32.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1376 jzFbN3X6HH4H0YC.exe 1376 jzFbN3X6HH4H0YC.exe 1376 jzFbN3X6HH4H0YC.exe 2660 cmmon32.exe 2660 cmmon32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe Token: SeRestorePrivilege 1840 TiWorker.exe Token: SeSecurityPrivilege 1840 TiWorker.exe Token: SeBackupPrivilege 1840 TiWorker.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1100 wrote to memory of 1376 1100 jzFbN3X6HH4H0YC.exe 79 PID 1100 wrote to memory of 1376 1100 jzFbN3X6HH4H0YC.exe 79 PID 1100 wrote to memory of 1376 1100 jzFbN3X6HH4H0YC.exe 79 PID 1100 wrote to memory of 1376 1100 jzFbN3X6HH4H0YC.exe 79 PID 1100 wrote to memory of 1376 1100 jzFbN3X6HH4H0YC.exe 79 PID 1100 wrote to memory of 1376 1100 jzFbN3X6HH4H0YC.exe 79 PID 2404 wrote to memory of 2660 2404 Explorer.EXE 80 PID 2404 wrote to memory of 2660 2404 Explorer.EXE 80 PID 2404 wrote to memory of 2660 2404 Explorer.EXE 80 PID 2660 wrote to memory of 4056 2660 cmmon32.exe 81 PID 2660 wrote to memory of 4056 2660 cmmon32.exe 81 PID 2660 wrote to memory of 4056 2660 cmmon32.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\jzFbN3X6HH4H0YC.exe"C:\Users\Admin\AppData\Local\Temp\jzFbN3X6HH4H0YC.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\jzFbN3X6HH4H0YC.exe"C:\Users\Admin\AppData\Local\Temp\jzFbN3X6HH4H0YC.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1376
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\jzFbN3X6HH4H0YC.exe"3⤵PID:4056
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3604
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Modifies data under HKEY_USERS
PID:4020
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1840