Analysis
-
max time kernel
151s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-04-2022 01:06
Static task
static1
Behavioral task
behavioral1
Sample
000040021.exe
Resource
win7-20220414-en
General
-
Target
000040021.exe
-
Size
179KB
-
MD5
6f6f64b82c949798ec80ecddea570ba9
-
SHA1
9895fe43bf8b037ec9110294e681410f419cf64b
-
SHA256
5978ce4905969580753f948beb8265a13d133cf29f9ddb206475a7f06f8fc885
-
SHA512
263308644df6dfc89d2466646ec7fda1092150128af96b8c62050c1b30f8ee0f8b0fa4ed03a375f2c78e5f5926e7b043db65b9a8b484b1d5a88760bb628e6cc6
Malware Config
Extracted
formbook
4.1
oh75
denizgidam.com
6cc06.com
charlottewaldburgzeil.com
medijanus.com
qingdaoyiersan.com
datcabilgisayar.xyz
111439d.com
xn--1ruo40k.com
wu6enxwcx5h3.xyz
vnscloud.net
brtka.xyz
showztime.com
promocoesdedezenbro.com
wokpy.com
chnowuk.online
rockshotscafe.com
pelrjy.com
nato-riness.com
feixiang-chem.com
thcoinexchange.com
fuelrescuereponse.com
digitaltunic.com
cellefill.com
paulbau.com
camillebeckman.xyz
ilico-media.com
603sa.com
firstechfedcu.com
koreaglp.com
thebeardedbrocksblends.com
musumeya-kotora.com
tocoteacanada.com
travelwitharden.com
diversamenteclinica.com
bw613.com
qe46.com
spectrumelectrolysis.com
maloyenterprises.com
inovasyon.xyz
remijoe.com
petsgallie.com
metagiphydownload.online
tigerdieect.com
jamedomp.com
peninsularbottling.com
1383fx.com
pandeymasala.online
spoilnet.com
itweu.com
ankxbi.icu
lm-safe-keepingyuchand92.xyz
dreamdsjoceo.com
providentview.com
newchinafortpayne.com
wu6bvnrlz4ra.xyz
intrasvp.com
ghoul-ambrose.com
alltenexpress.com
oniray.com
sistemaparadrogaria.com
zeidrei514-nifty.xyz
excaliburteacher.com
jennyandsteven.com
zakcotransportationllc.com
wwwccsuresults.com
Extracted
netwire
127.0.0.1:3360
212.192.246.209:141
-
activex_autorun
false
- activex_key
-
copy_executable
false
-
delete_original
false
-
host_id
04-22
- install_path
- keylogger_dir
-
lock_executable
false
- mutex
-
offline_keylogger
false
-
password
123456
-
registry_autorun
false
-
startup_name
�k
-
use_mutex
false
Signatures
-
NetWire RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/1164-96-0x0000000000400000-0x0000000000444000-memory.dmp netwire behavioral1/memory/1164-97-0x0000000000400000-0x0000000000444000-memory.dmp netwire behavioral1/memory/1164-100-0x0000000000400000-0x0000000000444000-memory.dmp netwire behavioral1/memory/1164-99-0x0000000000400000-0x0000000000444000-memory.dmp netwire behavioral1/memory/1164-101-0x0000000000400000-0x0000000000444000-memory.dmp netwire behavioral1/memory/1164-102-0x00000000004014C0-mapping.dmp netwire behavioral1/memory/1164-106-0x0000000000400000-0x0000000000444000-memory.dmp netwire behavioral1/memory/1164-107-0x0000000000400000-0x0000000000444000-memory.dmp netwire -
Formbook Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/676-69-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/676-70-0x000000000041F0F0-mapping.dmp formbook behavioral1/memory/676-72-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1248-80-0x00000000000C0000-0x00000000000EF000-memory.dmp formbook -
Executes dropped EXE 2 IoCs
Processes:
Kyxlubuhi.exeKyxlubuhi.exepid process 1124 Kyxlubuhi.exe 1164 Kyxlubuhi.exe -
Loads dropped DLL 2 IoCs
Processes:
000040021.exeKyxlubuhi.exepid process 1276 000040021.exe 1124 Kyxlubuhi.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
000040021.exeKyxlubuhi.exeKyxlubuhi.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aoev = "\"C:\\Users\\Admin\\AppData\\Roaming\\Nakgjel\\Aoev.exe\"" 000040021.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\Aoev = "\"C:\\Users\\Admin\\AppData\\Roaming\\Nakgjel\\Aoev.exe\"" Kyxlubuhi.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Kyxlubuhi.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\‚k = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Kyxlubuhi.exe" Kyxlubuhi.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
000040021.exeInstallUtil.execolorcpl.exeKyxlubuhi.exedescription pid process target process PID 1276 set thread context of 676 1276 000040021.exe InstallUtil.exe PID 676 set thread context of 1352 676 InstallUtil.exe Explorer.EXE PID 1248 set thread context of 1352 1248 colorcpl.exe Explorer.EXE PID 1124 set thread context of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 2 IoCs
Processes:
timeout.exetimeout.exepid process 2024 timeout.exe 1716 timeout.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
000040021.exeInstallUtil.execolorcpl.exeKyxlubuhi.exepid process 1276 000040021.exe 676 InstallUtil.exe 676 InstallUtil.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1124 Kyxlubuhi.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe 1248 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
InstallUtil.execolorcpl.exepid process 676 InstallUtil.exe 676 InstallUtil.exe 676 InstallUtil.exe 1248 colorcpl.exe 1248 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
000040021.exeInstallUtil.execolorcpl.exeKyxlubuhi.exedescription pid process Token: SeDebugPrivilege 1276 000040021.exe Token: SeDebugPrivilege 676 InstallUtil.exe Token: SeDebugPrivilege 1248 colorcpl.exe Token: SeDebugPrivilege 1124 Kyxlubuhi.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
000040021.execmd.exeExplorer.EXEcolorcpl.exeKyxlubuhi.execmd.exedescription pid process target process PID 1276 wrote to memory of 1756 1276 000040021.exe cmd.exe PID 1276 wrote to memory of 1756 1276 000040021.exe cmd.exe PID 1276 wrote to memory of 1756 1276 000040021.exe cmd.exe PID 1276 wrote to memory of 1756 1276 000040021.exe cmd.exe PID 1756 wrote to memory of 2024 1756 cmd.exe timeout.exe PID 1756 wrote to memory of 2024 1756 cmd.exe timeout.exe PID 1756 wrote to memory of 2024 1756 cmd.exe timeout.exe PID 1756 wrote to memory of 2024 1756 cmd.exe timeout.exe PID 1276 wrote to memory of 1124 1276 000040021.exe Kyxlubuhi.exe PID 1276 wrote to memory of 1124 1276 000040021.exe Kyxlubuhi.exe PID 1276 wrote to memory of 1124 1276 000040021.exe Kyxlubuhi.exe PID 1276 wrote to memory of 1124 1276 000040021.exe Kyxlubuhi.exe PID 1276 wrote to memory of 676 1276 000040021.exe InstallUtil.exe PID 1276 wrote to memory of 676 1276 000040021.exe InstallUtil.exe PID 1276 wrote to memory of 676 1276 000040021.exe InstallUtil.exe PID 1276 wrote to memory of 676 1276 000040021.exe InstallUtil.exe PID 1276 wrote to memory of 676 1276 000040021.exe InstallUtil.exe PID 1276 wrote to memory of 676 1276 000040021.exe InstallUtil.exe PID 1276 wrote to memory of 676 1276 000040021.exe InstallUtil.exe PID 1276 wrote to memory of 676 1276 000040021.exe InstallUtil.exe PID 1276 wrote to memory of 676 1276 000040021.exe InstallUtil.exe PID 1276 wrote to memory of 676 1276 000040021.exe InstallUtil.exe PID 1352 wrote to memory of 1248 1352 Explorer.EXE colorcpl.exe PID 1352 wrote to memory of 1248 1352 Explorer.EXE colorcpl.exe PID 1352 wrote to memory of 1248 1352 Explorer.EXE colorcpl.exe PID 1352 wrote to memory of 1248 1352 Explorer.EXE colorcpl.exe PID 1248 wrote to memory of 1344 1248 colorcpl.exe cmd.exe PID 1248 wrote to memory of 1344 1248 colorcpl.exe cmd.exe PID 1248 wrote to memory of 1344 1248 colorcpl.exe cmd.exe PID 1248 wrote to memory of 1344 1248 colorcpl.exe cmd.exe PID 1124 wrote to memory of 1884 1124 Kyxlubuhi.exe cmd.exe PID 1124 wrote to memory of 1884 1124 Kyxlubuhi.exe cmd.exe PID 1124 wrote to memory of 1884 1124 Kyxlubuhi.exe cmd.exe PID 1124 wrote to memory of 1884 1124 Kyxlubuhi.exe cmd.exe PID 1884 wrote to memory of 1716 1884 cmd.exe timeout.exe PID 1884 wrote to memory of 1716 1884 cmd.exe timeout.exe PID 1884 wrote to memory of 1716 1884 cmd.exe timeout.exe PID 1884 wrote to memory of 1716 1884 cmd.exe timeout.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe PID 1124 wrote to memory of 1164 1124 Kyxlubuhi.exe Kyxlubuhi.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\000040021.exe"C:\Users\Admin\AppData\Local\Temp\000040021.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 104⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exe"C:\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 104⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 105⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exeC:\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exeFilesize
179KB
MD512c5bc1a739dfd4e5a54c0a1b47daff6
SHA1e4d994d9a61824ada303d54448d2d384484a961c
SHA2563ccf4ad2172cb3a4e39fbdb1692673d3d4e06541dff20bc896e033f2caeac28a
SHA512e58795819fe73952529cee7f18a80bbfd0575d15b71b1a07e79e6832faf477653b718d70e881db43933876aaa58d723ad2f57479ce1dd327979a43185f9859dc
-
C:\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exeFilesize
179KB
MD512c5bc1a739dfd4e5a54c0a1b47daff6
SHA1e4d994d9a61824ada303d54448d2d384484a961c
SHA2563ccf4ad2172cb3a4e39fbdb1692673d3d4e06541dff20bc896e033f2caeac28a
SHA512e58795819fe73952529cee7f18a80bbfd0575d15b71b1a07e79e6832faf477653b718d70e881db43933876aaa58d723ad2f57479ce1dd327979a43185f9859dc
-
C:\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exeFilesize
179KB
MD512c5bc1a739dfd4e5a54c0a1b47daff6
SHA1e4d994d9a61824ada303d54448d2d384484a961c
SHA2563ccf4ad2172cb3a4e39fbdb1692673d3d4e06541dff20bc896e033f2caeac28a
SHA512e58795819fe73952529cee7f18a80bbfd0575d15b71b1a07e79e6832faf477653b718d70e881db43933876aaa58d723ad2f57479ce1dd327979a43185f9859dc
-
C:\Users\Admin\AppData\Roaming\Nakgjel\Aoev.exeFilesize
179KB
MD512c5bc1a739dfd4e5a54c0a1b47daff6
SHA1e4d994d9a61824ada303d54448d2d384484a961c
SHA2563ccf4ad2172cb3a4e39fbdb1692673d3d4e06541dff20bc896e033f2caeac28a
SHA512e58795819fe73952529cee7f18a80bbfd0575d15b71b1a07e79e6832faf477653b718d70e881db43933876aaa58d723ad2f57479ce1dd327979a43185f9859dc
-
\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exeFilesize
179KB
MD512c5bc1a739dfd4e5a54c0a1b47daff6
SHA1e4d994d9a61824ada303d54448d2d384484a961c
SHA2563ccf4ad2172cb3a4e39fbdb1692673d3d4e06541dff20bc896e033f2caeac28a
SHA512e58795819fe73952529cee7f18a80bbfd0575d15b71b1a07e79e6832faf477653b718d70e881db43933876aaa58d723ad2f57479ce1dd327979a43185f9859dc
-
\Users\Admin\AppData\Local\Temp\Kyxlubuhi.exeFilesize
179KB
MD512c5bc1a739dfd4e5a54c0a1b47daff6
SHA1e4d994d9a61824ada303d54448d2d384484a961c
SHA2563ccf4ad2172cb3a4e39fbdb1692673d3d4e06541dff20bc896e033f2caeac28a
SHA512e58795819fe73952529cee7f18a80bbfd0575d15b71b1a07e79e6832faf477653b718d70e881db43933876aaa58d723ad2f57479ce1dd327979a43185f9859dc
-
memory/676-69-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/676-73-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/676-74-0x00000000001E0000-0x00000000001F4000-memory.dmpFilesize
80KB
-
memory/676-72-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/676-70-0x000000000041F0F0-mapping.dmp
-
memory/676-66-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/676-67-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1124-88-0x0000000004620000-0x0000000004668000-memory.dmpFilesize
288KB
-
memory/1124-84-0x0000000006330000-0x0000000006474000-memory.dmpFilesize
1.3MB
-
memory/1124-63-0x0000000000350000-0x0000000000382000-memory.dmpFilesize
200KB
-
memory/1124-60-0x0000000000000000-mapping.dmp
-
memory/1164-91-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1164-90-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1164-107-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1164-106-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1164-102-0x00000000004014C0-mapping.dmp
-
memory/1164-101-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1164-99-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1164-100-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1164-97-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1164-96-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1164-94-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1164-93-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/1248-82-0x0000000001DA0000-0x0000000001E33000-memory.dmpFilesize
588KB
-
memory/1248-81-0x0000000001E80000-0x0000000002183000-memory.dmpFilesize
3.0MB
-
memory/1248-76-0x0000000000000000-mapping.dmp
-
memory/1248-79-0x00000000008D0000-0x00000000008E8000-memory.dmpFilesize
96KB
-
memory/1248-80-0x00000000000C0000-0x00000000000EF000-memory.dmpFilesize
188KB
-
memory/1276-54-0x0000000000DD0000-0x0000000000E02000-memory.dmpFilesize
200KB
-
memory/1276-65-0x0000000004EB0000-0x0000000004EFC000-memory.dmpFilesize
304KB
-
memory/1276-55-0x0000000076C01000-0x0000000076C03000-memory.dmpFilesize
8KB
-
memory/1276-56-0x0000000007F60000-0x00000000080F8000-memory.dmpFilesize
1.6MB
-
memory/1344-78-0x0000000000000000-mapping.dmp
-
memory/1352-83-0x00000000049F0000-0x0000000004A97000-memory.dmpFilesize
668KB
-
memory/1352-75-0x0000000004F40000-0x0000000005014000-memory.dmpFilesize
848KB
-
memory/1716-86-0x0000000000000000-mapping.dmp
-
memory/1756-57-0x0000000000000000-mapping.dmp
-
memory/1884-85-0x0000000000000000-mapping.dmp
-
memory/2024-58-0x0000000000000000-mapping.dmp