Analysis
- max time kernel
4294211s - max time network
149s - platform
windows7_x64 - resource
win7-20220310-en - submitted
21/03/2022, 03:05
Static task
static1
Behavioral task
behavioral1
Sample
sample2.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
sample2.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target sample2.exe
- Size 202KB
- Sample220321-dk7kbahbfl
- SHA256 236f4e149402cba69141e6055a113a68f2bd86539365210afb9861f4e2d3ad5f
- MD5 e05d85acc62b2795bfb94a681e64e20f
- SHA1 7cb195e05a78a39cacb0c0d4d4fa23e4c3366785
- SHA512 afba13ceb7ed1c24ed480f11be6352d0722ab22fa83a37d43663886ca83da0c7f6e4f9c6db48ab134da3968e0c5b18b9cebe3a1874389a616f51975755f8a24a
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- suricata: ET MALWARE User-Agent (Xmaker)
suricata: ET MALWARE User-Agent (Xmaker)
- Executes dropped EXE 5 IoCs
pid Process 2024 sample2.exe 828 sample2.exe 1512 sample2.exe 1316 sample2.exe 1956 sample2.exe - Deletes itself 1 IoCs
pid Process 1680 svchost.exe - Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 myexternalip.com 4 myexternalip.com 6 myexternalip.com 8 myexternalip.com - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Roaming\sample2.exe svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\sample2.exe svchost.exe File created C:\Windows\System32\config\systemprofile\AppData\Roaming\client_id svchost.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27 PID 948 wrote to memory of 1964 948 sample2.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample2.exe"C:\Users\Admin\AppData\Local\Temp\sample2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\system32\svchost.exesvchost.exe2⤵PID:1964
-
C:\Users\Admin\AppData\Roaming\sample2.exeC:\Users\Admin\AppData\Roaming\sample2.exe "C:\Users\Admin\AppData\Local\Temp\sample2.exe"3⤵
- Executes dropped EXE
PID:2024 -
C:\Windows\system32\svchost.exesvchost.exe "C:\Users\Admin\AppData\Local\Temp\sample2.exe"4⤵
- Deletes itself
PID:1680
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {9EA984C8-DAB8-41CA-9BB4-A5ECD39B231E} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:396
-
C:\Users\Admin\AppData\Roaming\sample2.exeC:\Users\Admin\AppData\Roaming\sample2.exe2⤵
- Executes dropped EXE
PID:828 -
C:\Windows\system32\svchost.exesvchost.exe3⤵
- Drops file in System32 directory
PID:852 -
C:\Windows\system32\config\systemprofile\AppData\Roaming\sample2.exeC:\Windows\system32\config\systemprofile\AppData\Roaming\sample2.exe "C:\Users\Admin\AppData\Roaming\sample2.exe"4⤵
- Executes dropped EXE
PID:1512 -
C:\Windows\system32\svchost.exesvchost.exe "C:\Users\Admin\AppData\Roaming\sample2.exe"5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1856
-
-
-
-
-
C:\Windows\system32\config\systemprofile\AppData\Roaming\sample2.exeC:\Windows\system32\config\systemprofile\AppData\Roaming\sample2.exe2⤵
- Executes dropped EXE
PID:1316 -
C:\Windows\system32\svchost.exesvchost.exe3⤵
- Modifies data under HKEY_USERS
PID:904
-
-
-
C:\Windows\system32\config\systemprofile\AppData\Roaming\sample2.exeC:\Windows\system32\config\systemprofile\AppData\Roaming\sample2.exe2⤵
- Executes dropped EXE
PID:1956 -
C:\Windows\system32\svchost.exesvchost.exe3⤵
- Modifies data under HKEY_USERS
PID:1992
-
-