Analysis
- max time kernel
160s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
21/03/2022, 09:48
Static task
static1
Behavioral task
behavioral1
Sample
kk.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
- Target kk.exe
- Size 241KB
- Sample220321-lssecsbdan
- SHA256 ca5e82085e4621747c2ffd1de555b0cdc47cac5934575ed3de39c3b7095e0421
- MD5 8191878054ebbaf4005866f45927bf08
- SHA1 218f9946c84751db608882a7cae6465952cbc68b
- SHA512 6f6c99b0e82973ec52fb47a1efb4b571478d695b66b607a9cdf2e4508382d5947dc237b9e36025070af9b011fe77ae2872c6561fbd093352d8ddd695ed6de7e2
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
iqof
Decoy
-
downssandblasting.online
-
shopcongan.info
-
financeservicesolutions.com
-
ehiconao.com
-
15beverlydrive.com
-
happynize.net
-
findzx.net
-
kelly-peterson.xyz
-
datalign-exchange.com
-
kinemasterpro.pro
-
amage.agency
-
roleplayhr.com
-
movingikea.com
-
steinerikegeberg.com
-
nikolashadow.com
-
baumbestattung.net
-
mms12.xyz
-
cryptocurrencymarket.space
-
colt.business
-
neutralblocker.com
-
appleha.us
-
qknzutohbtro.mobi
-
muffchat.net
-
affordableorganizing.net
-
sypxjs.com
-
freeshopum.xyz
-
medicalwriting.club
-
decentralizedtitle.com
-
thelaiyaragroup.com
-
grannouncil.com
-
nbyjbxg.com
-
thepumps.art
-
owyheeland-fence.com
-
charcoutrements.com
-
studentloanhelp.net
-
cassandrajasmine.com
-
olddoor.art
-
seoclew.com
-
laytons-construction.com
-
jonathanweiler.net
-
bestofftlauderdale.net
-
budistx.com
-
brimfinacial.com
-
go2009.com
-
taishanyuan.com
-
iltayneast.quest
-
dskbrk.com
-
gaydatingtv.com
-
surrealtheft.com
-
chicagoflippingbiz.com
-
clrbrokenbowcabins.com
-
immovisiontahiti.com
-
bihada-news.asia
-
crowdyweather.com
-
hotsoft.info
-
lgldesignstories.com
-
satfacility.com
-
kitchentuneuphouston.com
-
vamossafaris.com
-
lcdelcampo.com
-
fashionpklmfu.xyz
-
anestesis.com
-
cwdwm.com
-
circleease.com
-
abodhakujena.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/1580-139-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1580-142-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3240-147-0x0000000000790000-0x00000000007B9000-memory.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 360 qkvhfs.exe 1580 qkvhfs.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 360 set thread context of 1580 360 qkvhfs.exe 85 PID 1580 set thread context of 2896 1580 qkvhfs.exe 42 PID 3240 set thread context of 2896 3240 cmstp.exe 42 - Drops file in Windows directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\f3535a3b47819a04c6d5ee18905493be086e801e svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\LZOCjtiHKk8= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BIT5C09.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT71E8.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\BIT9EAB.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BITB3BC.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BITBCA4.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT120C.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT1A8A.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\BIT9EDB.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\Cmn5TH6S2lFFnfMN8MLr2EoNUIAGzQo2UUjHGMEC99A= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\a3f602ea4d534d006919a2613d91f9506b383314 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BIT5B7C.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\9+dL4Puh6FM8puPxsBEX86BMeGqpuC0b7gf2fD9DLLo= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT694B.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT69AA.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BITBABD.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT7DA2.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\FTTOLXxEZk0li+ZNE2Uo= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\BITBBA8.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\e1a85885fd4453165061351651289cce8f8590c4 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BITC002.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\af66e12c1bb9d8519da21259d0fcd88c247cb4f1 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT7285.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\YZBnsYBVNBTl3Isrrjy7P0\BIT9DEF.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\fDFnweOZvFE= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\CsA9z1\SlUHUPO8bKnA\5ondRmJ90JlkPETuN535TWk= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d60cb501610b6a66743c55eade3ef996\BITBC55.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BITBEE8.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT196F.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\BIT6820.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT7E3F.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\2ef09e08315a593ec3af8ec57ab6a31e\6e15245aed25ee83b027521f9cf9ea812c9d016d svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\9d6172fa1dc41a48846593219fc6519f\BIT118E.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\BIT68EC.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\7752a73587b3362d505a041fe7f69ecd\F2WKV54ysEMEW9U+EfiUeJcNcgfNL4pMC5NmE0a3mAg= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\ca4af4339884f7018bf988ecac7702ff\612ad442b8740f4c57b8c84e6bf465ba4699118c svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\Jda7di8befpfPWz3DrhkMwwJL9XbuL8\BIT9C48.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d1d4bb0c910695f4fcf53d8f91faafa7\d9f2a302574bf135efc9dbd1a8083a336f7f52f0 svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 1580 qkvhfs.exe 1580 qkvhfs.exe 1580 qkvhfs.exe 1580 qkvhfs.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe 3240 cmstp.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2896 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1580 qkvhfs.exe 1580 qkvhfs.exe 1580 qkvhfs.exe 3240 cmstp.exe 3240 cmstp.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeDebugPrivilege 1580 qkvhfs.exe Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeDebugPrivilege 3240 cmstp.exe Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE Token: SeShutdownPrivilege 2896 Explorer.EXE Token: SeCreatePagefilePrivilege 2896 Explorer.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2896 Explorer.EXE 2896 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3588 wrote to memory of 360 3588 kk.exe 84 PID 3588 wrote to memory of 360 3588 kk.exe 84 PID 3588 wrote to memory of 360 3588 kk.exe 84 PID 360 wrote to memory of 1580 360 qkvhfs.exe 85 PID 360 wrote to memory of 1580 360 qkvhfs.exe 85 PID 360 wrote to memory of 1580 360 qkvhfs.exe 85 PID 360 wrote to memory of 1580 360 qkvhfs.exe 85 PID 360 wrote to memory of 1580 360 qkvhfs.exe 85 PID 360 wrote to memory of 1580 360 qkvhfs.exe 85 PID 2896 wrote to memory of 3240 2896 Explorer.EXE 86 PID 2896 wrote to memory of 3240 2896 Explorer.EXE 86 PID 2896 wrote to memory of 3240 2896 Explorer.EXE 86 PID 3240 wrote to memory of 3388 3240 cmstp.exe 88 PID 3240 wrote to memory of 3388 3240 cmstp.exe 88 PID 3240 wrote to memory of 3388 3240 cmstp.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\kk.exe"C:\Users\Admin\AppData\Local\Temp\kk.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\qkvhfs.exeC:\Users\Admin\AppData\Local\Temp\qkvhfs.exe C:\Users\Admin\AppData\Local\Temp\fjiwnck3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:360 -
C:\Users\Admin\AppData\Local\Temp\qkvhfs.exeC:\Users\Admin\AppData\Local\Temp\qkvhfs.exe C:\Users\Admin\AppData\Local\Temp\fjiwnck4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\qkvhfs.exe"3⤵PID:3388
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Drops file in Windows directory
PID:4100
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:3380