Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
15-03-2022 15:41
Static task
static1
Behavioral task
behavioral1
Sample
f44d75390275e2f15ea0111de765cdaede7436331101363ba1db17b74f8cd88e.js
Resource
win7-20220311-en
General
-
Target
f44d75390275e2f15ea0111de765cdaede7436331101363ba1db17b74f8cd88e.js
-
Size
864KB
-
MD5
fe330e62ee592637466d5def2358afa8
-
SHA1
62bb2ec1f62e38b9c2605ba661b85ac10cddefe0
-
SHA256
f44d75390275e2f15ea0111de765cdaede7436331101363ba1db17b74f8cd88e
-
SHA512
ba59ac6e0070aae34b5cc98b6ba041f21fbbb52cd2e4551bc30a0570aa48175abb2c2aef14886bfc54128d080558e5dfd20f8800f572d7286dfa242c7032a9d2
Malware Config
Extracted
xloader
2.5
qatv
sexycurvycool.com
webundefinedstaging.website
gaspeehaze.com
adomnaturals.com
best10canadianreviews.info
nikekogan.com
5537sbishop.info
khonnaisoi.com
cures8t.com
garthoaks.com
belvederepharmagroup.com
chivo.plus
qishanlin.top
ccjon1.com
biz-financeagency.com
bdqimeng88.top
3-little-pigs.com
ord13route.art
webku-trial.xyz
ncgf28.xyz
nickatwoodrealestate.com
123piezas.com
woodju.com
afmview.com
travessiacursos.com
shreerragroindustries.com
lilacw.com
travelingbrunchbesties.com
cityloot.net
healthspecialist.info
kaliseastrand.com
jecoman.com
ystmo.com
lifecoach.directory
callahaninsurancegroup.com
commercialglassreplacement.com
webesluts.com
h5aolyhh6.com
drgcatherine.com
ronas.top
thevoilagroup.com
diemcrypto.tools
invest68.com
eleinmsa.xyz
sddn3.xyz
7dakka.online
endesasoluciounica.com
authenticinvesments.com
texasjusticelawyers.com
canada-settlement.com
outlook-admins.com
primarywatch.com
kaboomslots.email
innoattic.com
upstreetbarbershop.com
trulyproofreading.com
calciumsignaling.com
13977999.com
sheriffindiana.biz
uncorrectly.com
jjyymh.com
worldpasspassport.com
yjwnktaz.com
royalknightent.store
swachharepolymix.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\bin.exe xloader C:\Users\Admin\AppData\Local\Temp\bin.exe xloader behavioral2/memory/4556-138-0x0000000000360000-0x0000000000389000-memory.dmp xloader behavioral2/memory/4512-142-0x0000000000C00000-0x0000000000C29000-memory.dmp xloader -
Blocklisted process makes network request 6 IoCs
Processes:
wscript.exeflow pid process 7 4284 wscript.exe 21 4284 wscript.exe 35 4284 wscript.exe 52 4284 wscript.exe 61 4284 wscript.exe 76 4284 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
bin.exepid process 4556 bin.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vFloVdiJJT.js wscript.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vFloVdiJJT.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\00FAYTSXGU = "\"C:\\Users\\Admin\\AppData\\Roaming\\vFloVdiJJT.js\"" wscript.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
bin.execontrol.exedescription pid process target process PID 4556 set thread context of 1048 4556 bin.exe Explorer.EXE PID 4512 set thread context of 1048 4512 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
bin.execontrol.exepid process 4556 bin.exe 4556 bin.exe 4556 bin.exe 4556 bin.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe 4512 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1048 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
bin.execontrol.exepid process 4556 bin.exe 4556 bin.exe 4556 bin.exe 4512 control.exe 4512 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
bin.execontrol.exedescription pid process Token: SeDebugPrivilege 4556 bin.exe Token: SeDebugPrivilege 4512 control.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
wscript.exeExplorer.EXEcontrol.exedescription pid process target process PID 2516 wrote to memory of 4284 2516 wscript.exe wscript.exe PID 2516 wrote to memory of 4284 2516 wscript.exe wscript.exe PID 2516 wrote to memory of 4556 2516 wscript.exe bin.exe PID 2516 wrote to memory of 4556 2516 wscript.exe bin.exe PID 2516 wrote to memory of 4556 2516 wscript.exe bin.exe PID 1048 wrote to memory of 4512 1048 Explorer.EXE control.exe PID 1048 wrote to memory of 4512 1048 Explorer.EXE control.exe PID 1048 wrote to memory of 4512 1048 Explorer.EXE control.exe PID 4512 wrote to memory of 1612 4512 control.exe cmd.exe PID 4512 wrote to memory of 1612 4512 control.exe cmd.exe PID 4512 wrote to memory of 1612 4512 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\f44d75390275e2f15ea0111de765cdaede7436331101363ba1db17b74f8cd88e.js2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\vFloVdiJJT.js"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\bin.exe"C:\Users\Admin\AppData\Local\Temp\bin.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4556 -
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\bin.exe"3⤵PID:1612
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\bin.exeMD5
d2bc603d4e0e7011f2b8ba93bcd75293
SHA19fb2540d65441714cfcf7e4cc2432a96255f1f6d
SHA256c70b39662e04b20fb68d78b0dc45694b6cc9c564c7c0535c286ee37fd1730d4b
SHA51249835fc13efa9406fb7d7b85247013f45eeaa3e3cd9d1ae2a5c867f9231afae08c1051799b3b137f79476065035bedf5953d999da12e43a761dc369dfe90956b
-
C:\Users\Admin\AppData\Local\Temp\bin.exeMD5
d2bc603d4e0e7011f2b8ba93bcd75293
SHA19fb2540d65441714cfcf7e4cc2432a96255f1f6d
SHA256c70b39662e04b20fb68d78b0dc45694b6cc9c564c7c0535c286ee37fd1730d4b
SHA51249835fc13efa9406fb7d7b85247013f45eeaa3e3cd9d1ae2a5c867f9231afae08c1051799b3b137f79476065035bedf5953d999da12e43a761dc369dfe90956b
-
C:\Users\Admin\AppData\Roaming\vFloVdiJJT.jsMD5
039b788c510573fb8d1c19038ad1ec14
SHA18c8928d097a198ddf6664d56191f74a9ac404804
SHA25628b87f27295a93bedcd9aed6896971a7bc9317194968e6f1f532b2b47d972b2d
SHA512a6755442e1936f61d35a6ce3af5c154fd0288a822029428c7675255aa97186b58185c2e53bdb94580256cc7c62eb6dce03cffff6388fd7942e699a020ecae00e
-
memory/1048-140-0x0000000002F50000-0x000000000302B000-memory.dmpFilesize
876KB
-
memory/1048-145-0x00000000085A0000-0x000000000872F000-memory.dmpFilesize
1.6MB
-
memory/4512-141-0x0000000000030000-0x0000000000057000-memory.dmpFilesize
156KB
-
memory/4512-142-0x0000000000C00000-0x0000000000C29000-memory.dmpFilesize
164KB
-
memory/4512-143-0x0000000002AD0000-0x0000000002E1A000-memory.dmpFilesize
3.3MB
-
memory/4512-144-0x0000000002900000-0x0000000002990000-memory.dmpFilesize
576KB
-
memory/4556-137-0x0000000000DD0000-0x000000000111A000-memory.dmpFilesize
3.3MB
-
memory/4556-138-0x0000000000360000-0x0000000000389000-memory.dmpFilesize
164KB
-
memory/4556-139-0x0000000000910000-0x0000000000921000-memory.dmpFilesize
68KB