Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
11-03-2022 23:29
Static task
static1
Behavioral task
behavioral1
Sample
Cslmw.exe
Resource
win7-20220311-en
General
-
Target
Cslmw.exe
-
Size
23KB
-
MD5
f252b7a35b4b4af6a7dee8840b1e7132
-
SHA1
e9fa1a744adc80c91203aaf06e4edbcd25cac199
-
SHA256
4a5a4b370430e4f8fed7a3e8e7deb08321740497e0e693482352d2db973dbabd
-
SHA512
389e94b834f64609e8b2a861f5697a3b5b7eee4e2f71b76ae19a616560bd1f8d1d3396cf13e657c41792e43caedd61fe6641983819bbf83f8625fbd693c65af5
Malware Config
Extracted
xloader
2.5
ssac
beautybybrin.com
oregemo.com
prospectoriq.com
blazermid.com
cloudnineloans.com
myyntisofta.com
filoupoils.com
web-solutiontnpasumo3.xyz
becbares.com
lines-hikkoshi.com
ohayouwww.com
writingdadsobituarywithdad.com
bridalbaes.com
jamshir.com
rangertots.com
dankbrobeans.com
titan111.com
uplearns.info
maxicashprokil.xyz
evc24.com
mingshan888.com
thehomefurnishings.com
jjyive.space
vtkk.info
state-attorney.online
zoho.systems
nd300.com
ivermectinforanimals.ca
gruppobenedetto.com
planet99angka.xyz
astrotiq.com
fangshensj.com
ocean.limited
zalaridumpf.quest
cursolibreonline.com
lifein.art
identspactures.com
nfltvgo.com
chronicfit.store
mariajosereina.com
hebbz764776341.com
anpxlmmspix.mobi
mydevhub.tech
nobelrealm.com
dentalteamny.com
patinerd.com
socratisbey.xyz
hnylcwfs.com
yujieqin.com
midorato.com
sunglowdragon.com
americaplr.com
cxqdscape.com
situsgacor.xyz
sattlerei-dortmund.com
life120lospaccio.com
riddleme.one
perpustakaan-geominerba.online
renatafaceandbodyskincare.com
allkoreas.com
myvisitiq.com
candlesallday.com
poleador.com
4hsp116.com
homesbyvw.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4292-136-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4292-138-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4848-144-0x0000000001200000-0x0000000001229000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Cslmw.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Knolmy = "\"C:\\Users\\Admin\\AppData\\Roaming\\Onqsw\\Knolmy.exe\"" Cslmw.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Cslmw.exeCslmw.exechkdsk.exedescription pid process target process PID 600 set thread context of 4292 600 Cslmw.exe Cslmw.exe PID 4292 set thread context of 2712 4292 Cslmw.exe Explorer.EXE PID 4848 set thread context of 2712 4848 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
Cslmw.exeCslmw.exechkdsk.exepid process 600 Cslmw.exe 600 Cslmw.exe 4292 Cslmw.exe 4292 Cslmw.exe 4292 Cslmw.exe 4292 Cslmw.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe 4848 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2712 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Cslmw.exechkdsk.exepid process 4292 Cslmw.exe 4292 Cslmw.exe 4292 Cslmw.exe 4848 chkdsk.exe 4848 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Cslmw.exeCslmw.exechkdsk.exedescription pid process Token: SeDebugPrivilege 600 Cslmw.exe Token: SeDebugPrivilege 4292 Cslmw.exe Token: SeDebugPrivilege 4848 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Cslmw.exeExplorer.EXEchkdsk.exedescription pid process target process PID 600 wrote to memory of 4292 600 Cslmw.exe Cslmw.exe PID 600 wrote to memory of 4292 600 Cslmw.exe Cslmw.exe PID 600 wrote to memory of 4292 600 Cslmw.exe Cslmw.exe PID 600 wrote to memory of 4292 600 Cslmw.exe Cslmw.exe PID 600 wrote to memory of 4292 600 Cslmw.exe Cslmw.exe PID 600 wrote to memory of 4292 600 Cslmw.exe Cslmw.exe PID 2712 wrote to memory of 4848 2712 Explorer.EXE chkdsk.exe PID 2712 wrote to memory of 4848 2712 Explorer.EXE chkdsk.exe PID 2712 wrote to memory of 4848 2712 Explorer.EXE chkdsk.exe PID 4848 wrote to memory of 780 4848 chkdsk.exe cmd.exe PID 4848 wrote to memory of 780 4848 chkdsk.exe cmd.exe PID 4848 wrote to memory of 780 4848 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cslmw.exe"C:\Users\Admin\AppData\Local\Temp\Cslmw.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Cslmw.exeC:\Users\Admin\AppData\Local\Temp\Cslmw.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Cslmw.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/600-130-0x0000000000FD0000-0x0000000000FDC000-memory.dmpFilesize
48KB
-
memory/600-131-0x0000000005F30000-0x00000000064D4000-memory.dmpFilesize
5.6MB
-
memory/600-132-0x0000000074DF0000-0x00000000755A0000-memory.dmpFilesize
7.7MB
-
memory/600-133-0x0000000005A20000-0x0000000005AB2000-memory.dmpFilesize
584KB
-
memory/600-134-0x0000000005980000-0x000000000598A000-memory.dmpFilesize
40KB
-
memory/600-135-0x0000000005980000-0x0000000005F24000-memory.dmpFilesize
5.6MB
-
memory/2712-147-0x0000000002DC0000-0x0000000002EAE000-memory.dmpFilesize
952KB
-
memory/2712-142-0x0000000002AB0000-0x0000000002B72000-memory.dmpFilesize
776KB
-
memory/4292-139-0x00000000013F0000-0x000000000173A000-memory.dmpFilesize
3.3MB
-
memory/4292-141-0x00000000013B0000-0x00000000013C1000-memory.dmpFilesize
68KB
-
memory/4292-140-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/4292-138-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4292-136-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4848-144-0x0000000001200000-0x0000000001229000-memory.dmpFilesize
164KB
-
memory/4848-143-0x0000000000670000-0x000000000067A000-memory.dmpFilesize
40KB
-
memory/4848-145-0x0000000001A40000-0x0000000001D8A000-memory.dmpFilesize
3.3MB
-
memory/4848-146-0x0000000001770000-0x0000000001800000-memory.dmpFilesize
576KB