Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
30/03/2022, 12:50
Static task
static1
Behavioral task
behavioral1
Sample
5b9d23eb5a8f6d5578897abbecfe3d37.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
General
- Target 5b9d23eb5a8f6d5578897abbecfe3d37.exe
- Size 719KB
- Sample220330-p2xl8agcel
- SHA256 0bd840a10d4463fe31116ce57b0b674a6d10176d910cf7bcd9ba360cfcb9f3a6
- MD5 5b9d23eb5a8f6d5578897abbecfe3d37
- SHA1 9f18252fcdede3fc2b753b6192ccb242182c2e29
- SHA512 3c0e899868d291a8b701778380a30aa36b25ed74d2558297c23e57a2a4a953f50ebe98cc4ef30ed40d68717b2af4fec286c3bda15c1e0c24ce94ddede74b2908
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
foi3
Decoy
-
bmhdyw.com
-
rombutan.com
-
dugerits.com
-
teamsheetz.com
-
jobalrtforme.com
-
tracoschop.com
-
scoopdoggy.online
-
skydaddy.guru
-
france-ais.com
-
mall-mrc.com
-
petitsiteentreamis.com
-
caixadepandora.club
-
resortcottages19.com
-
marcopolotogo.com
-
kolekonieczka.com
-
kloecker-versicherungen.com
-
howtofindahotniche.com
-
jiancanshu.com
-
solheimdesign.com
-
kipnesrealtygroup.com
-
enjoy2m.xyz
-
stateministermoi.com
-
tecnophone.net
-
kai6agfw.com
-
dubaicars.online
-
winnigst0re.com
-
yeniicozum.com
-
geoakva.com
-
alexandernestor.com
-
kaelte-fath.com
-
health2earn.com
-
just-bussiness.online
-
logoterapia.info
-
trendzpk.com
-
avida2015.com
-
unitedtrials.net
-
securetravel.company
-
lucro-fx.com
-
sazuthedev.com
-
morgan555.top
-
jewellerycapitol.com
-
ardisdr.online
-
desertvalleyoutdoors.com
-
signup.coupons
-
iphone13pro.supplies
-
asgard888game.com
-
njkhmj.com
-
kdg123.com
-
sixzebras.com
-
jobby.guide
-
astronomygames.online
-
piyingren.top
-
iphone13pro.guide
-
chainreaction-au.website
-
iwk.info
-
jinshunsoft.com
-
lizethperez.com
-
supertry.online
-
higoshouten.com
-
pericumix.com
-
tjginde.com
-
alegalit.com
-
albadaya.com
-
artrascents.com
-
revolvewsefsu.top
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/2332-133-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2712-140-0x00000000006D0000-0x00000000006F9000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1932 set thread context of 2332 1932 5b9d23eb5a8f6d5578897abbecfe3d37.exe 79 PID 2332 set thread context of 3024 2332 aspnet_compiler.exe 45 PID 2712 set thread context of 3024 2712 control.exe 45 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 2332 aspnet_compiler.exe 2332 aspnet_compiler.exe 2332 aspnet_compiler.exe 2332 aspnet_compiler.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe 2712 control.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2332 aspnet_compiler.exe 2332 aspnet_compiler.exe 2332 aspnet_compiler.exe 2712 control.exe 2712 control.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1932 5b9d23eb5a8f6d5578897abbecfe3d37.exe Token: SeDebugPrivilege 2332 aspnet_compiler.exe Token: SeDebugPrivilege 2712 control.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2332 1932 5b9d23eb5a8f6d5578897abbecfe3d37.exe 79 PID 1932 wrote to memory of 2332 1932 5b9d23eb5a8f6d5578897abbecfe3d37.exe 79 PID 1932 wrote to memory of 2332 1932 5b9d23eb5a8f6d5578897abbecfe3d37.exe 79 PID 1932 wrote to memory of 2332 1932 5b9d23eb5a8f6d5578897abbecfe3d37.exe 79 PID 1932 wrote to memory of 2332 1932 5b9d23eb5a8f6d5578897abbecfe3d37.exe 79 PID 1932 wrote to memory of 2332 1932 5b9d23eb5a8f6d5578897abbecfe3d37.exe 79 PID 3024 wrote to memory of 2712 3024 Explorer.EXE 80 PID 3024 wrote to memory of 2712 3024 Explorer.EXE 80 PID 3024 wrote to memory of 2712 3024 Explorer.EXE 80 PID 2712 wrote to memory of 1300 2712 control.exe 85 PID 2712 wrote to memory of 1300 2712 control.exe 85 PID 2712 wrote to memory of 1300 2712 control.exe 85
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\5b9d23eb5a8f6d5578897abbecfe3d37.exe"C:\Users\Admin\AppData\Local\Temp\5b9d23eb5a8f6d5578897abbecfe3d37.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵PID:1300
-
-