Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
28-04-2022 03:31
Static task
static1
General
-
Target
0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe
-
Size
925KB
-
MD5
4470f83cba058890c43ded4a3940c3dc
-
SHA1
f9c2953280646715ec9ad0d034a6eae43d1fc8c4
-
SHA256
0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56
-
SHA512
8e3804af84b5f8d04630283dbc8764ea8d7395af635615013bf9bc25d3290c248a24e1b6f8486960aba5569c4cce105fb9f0ff82661d5f587ae56cab18b88981
Malware Config
Extracted
xloader
2.5
arh2
anniversaryalert.com
kinship.space
buabdullagroup.com
ghostprotectionagency.com
scion-go-getter.com
skindeepapp.com
kysp3.xyz
bonitaspringshomesearch.com
bestdeals2022.online
themarketingstinger.com
chengkayouxuan.com
fendoremi.com
j-stra.com
klingelecn.net
deluxecarepro.com
huanbaodg.com
mes-dents-blanches.com
solutionsemissionsimplifiee.com
abedbashir.tech
good-collection.store
zulijian1.com
deuxtonnes.com
va-products.com
limpiezaspricila.com
hollyweednc.com
liylaehamartoyof4.xyz
lauraloewendesign.com
gozabank.com
iconicbeauty.co
huashiren.xyz
bdsdaivietphat.com
josephgoddard.com
bburagotr.xyz
produkoriginal.store
6156yy.com
cellfacility.com
elictriczone.com
regaldock.com
yourvitalstatistics.com
nextgen-shareholder.com
charlie-dean.com
abodebuildinggroup.com
fortunabs.com
elizabethsilvasuarez.com
setsrl.net
neskasdreams.com
abubuntunginxsetup.xyz
ubspropertyservices.com
spiritpriest.com
altaingenieriainc.net
oldhamcars.com
daimaoart.com
5u8n.com
ppcpowered.com
pmariutto.com
opendialogmonaco.com
project66bug.com
goddesscodes.love
talkingwithmarcus.com
tranvantuan.xyz
priexalidomoi.store
un2030.com
loancreditscan.com
tg88.bet
rshedm.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2076-133-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral1/memory/4364-141-0x0000000001050000-0x0000000001079000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exediskpart.exesystray.exedescription pid process target process PID 4196 set thread context of 2076 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe diskpart.exe PID 2076 set thread context of 2032 2076 diskpart.exe Explorer.EXE PID 4364 set thread context of 2032 4364 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exediskpart.exesystray.exepid process 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe 2076 diskpart.exe 2076 diskpart.exe 2076 diskpart.exe 2076 diskpart.exe 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe 4364 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2032 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
diskpart.exesystray.exepid process 2076 diskpart.exe 2076 diskpart.exe 2076 diskpart.exe 4364 systray.exe 4364 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exediskpart.exesystray.exedescription pid process Token: SeDebugPrivilege 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe Token: SeDebugPrivilege 2076 diskpart.exe Token: SeDebugPrivilege 4364 systray.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exeExplorer.EXEsystray.exedescription pid process target process PID 4196 wrote to memory of 2076 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe diskpart.exe PID 4196 wrote to memory of 2076 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe diskpart.exe PID 4196 wrote to memory of 2076 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe diskpart.exe PID 4196 wrote to memory of 2076 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe diskpart.exe PID 4196 wrote to memory of 2076 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe diskpart.exe PID 4196 wrote to memory of 2076 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe diskpart.exe PID 4196 wrote to memory of 2076 4196 0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe diskpart.exe PID 2032 wrote to memory of 4364 2032 Explorer.EXE systray.exe PID 2032 wrote to memory of 4364 2032 Explorer.EXE systray.exe PID 2032 wrote to memory of 4364 2032 Explorer.EXE systray.exe PID 4364 wrote to memory of 3372 4364 systray.exe cmd.exe PID 4364 wrote to memory of 3372 4364 systray.exe cmd.exe PID 4364 wrote to memory of 3372 4364 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe"C:\Users\Admin\AppData\Local\Temp\0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\diskpart.exe"C:\Windows\SysWOW64\diskpart.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\diskpart.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2032-137-0x00000000087F0000-0x00000000088AB000-memory.dmpFilesize
748KB
-
memory/2032-144-0x00000000032D0000-0x00000000033E7000-memory.dmpFilesize
1.1MB
-
memory/2076-133-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2076-134-0x0000000001110000-0x000000000145A000-memory.dmpFilesize
3.3MB
-
memory/2076-136-0x0000000000FA0000-0x0000000000FB1000-memory.dmpFilesize
68KB
-
memory/2076-132-0x0000000000000000-mapping.dmp
-
memory/3372-139-0x0000000000000000-mapping.dmp
-
memory/4196-130-0x0000000000E40000-0x0000000000F2E000-memory.dmpFilesize
952KB
-
memory/4196-131-0x0000000005880000-0x000000000591C000-memory.dmpFilesize
624KB
-
memory/4364-138-0x0000000000000000-mapping.dmp
-
memory/4364-140-0x0000000000D90000-0x0000000000D96000-memory.dmpFilesize
24KB
-
memory/4364-142-0x0000000002F80000-0x00000000032CA000-memory.dmpFilesize
3.3MB
-
memory/4364-141-0x0000000001050000-0x0000000001079000-memory.dmpFilesize
164KB
-
memory/4364-143-0x0000000002DB0000-0x0000000002E40000-memory.dmpFilesize
576KB