Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
29/04/2022, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
b1573666c4e30baa2fc068eeaafe3901.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target b1573666c4e30baa2fc068eeaafe3901.exe
- Size 659KB
- Sample220429-sa1fksbbd5
- SHA256 eb26b47f9aa3033edbc2d791075f85fcc7894cd7dc3bbaf31974024b9695a52f
- MD5 b1573666c4e30baa2fc068eeaafe3901
- SHA1 60fa41f07d88c6315bdb74cd15e35b85c2ab33d3
- SHA512 b8647a994c270f92cbb7966e9259365c8bfbbafd953213bbcb2da4343fb06c40077708769bbd2b6b23d1b9a67fff4626bbbdd0e4006bf2649acf8b20d963c3c3
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
ocgr
Decoy
-
shiftmedicalstaffing.agency
-
muktobangla.xyz
-
attmleather.com
-
modelahs.com
-
clime.email
-
yonatec.com
-
mftie.com
-
doxofcolor.com
-
american-atlantic.net
-
christineenergy.com
-
fjqsdz.com
-
nagpurmandarin.com
-
hofwimmer.com
-
gororidev.com
-
china-eros.com
-
xn--ekrt15fxyb2t2c.xn--czru2d
-
dabsavy.com
-
buggy4t.com
-
souplant.com
-
insurancewineappraisals.com
-
012skz.xyz
-
kincsemto.net
-
zyaxious.website
-
tellgalpy.com
-
demetbatmaz.com
-
wallacehills.com
-
chambaultfleurs.com
-
fairfieldgroupfw.com
-
lotsimprovements.com
-
dhslcy.com
-
anotherdegen.com
-
dearpennyyouradviceblogspot.com
-
seekbeforefind.com
-
societyalluredmcc.com
-
climatecheckin.com
-
candybox-eru.com
-
tentacionescharlie.com
-
exceedrigging.online
-
skb-cabinet.com
-
qhzhuhang.com
-
ccav11.xyz
-
sandstonehosting.com
-
14offresimportantes.com
-
xn--hj2bz6fwvan2be1g5tb.com
-
embedded-electronic.com
-
drsanaclinic.com
-
ageofcryptos.com
-
dreamonetnpasumo1.xyz
-
engroconnect.net
-
huvao.com
-
denalicanninglids.com
-
tootko.com
-
edisson-bd.com
-
myamazonloan.net
-
dbcyebnveoyu.cloud
-
floridacaterpillar.com
-
travisjbogard.com
-
dialoneconstruction.com
-
tubesing.com
-
gofilmwizards.com
-
tahnforest.com
-
salahov.info
-
bimcellerviss.com
-
garglimited.com
-
mentalnayaarifmetika.online
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/4876-133-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4424-141-0x0000000000450000-0x0000000000479000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3356 set thread context of 4876 3356 b1573666c4e30baa2fc068eeaafe3901.exe 82 PID 4876 set thread context of 3076 4876 aspnet_compiler.exe 39 PID 4424 set thread context of 3076 4424 cmstp.exe 39 - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4876 aspnet_compiler.exe 4876 aspnet_compiler.exe 4876 aspnet_compiler.exe 4876 aspnet_compiler.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe 4424 cmstp.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3076 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4876 aspnet_compiler.exe 4876 aspnet_compiler.exe 4876 aspnet_compiler.exe 4424 cmstp.exe 4424 cmstp.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 3356 b1573666c4e30baa2fc068eeaafe3901.exe Token: SeDebugPrivilege 4876 aspnet_compiler.exe Token: SeDebugPrivilege 4424 cmstp.exe Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE Token: SeShutdownPrivilege 3076 Explorer.EXE Token: SeCreatePagefilePrivilege 3076 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3356 wrote to memory of 4876 3356 b1573666c4e30baa2fc068eeaafe3901.exe 82 PID 3356 wrote to memory of 4876 3356 b1573666c4e30baa2fc068eeaafe3901.exe 82 PID 3356 wrote to memory of 4876 3356 b1573666c4e30baa2fc068eeaafe3901.exe 82 PID 3356 wrote to memory of 4876 3356 b1573666c4e30baa2fc068eeaafe3901.exe 82 PID 3356 wrote to memory of 4876 3356 b1573666c4e30baa2fc068eeaafe3901.exe 82 PID 3356 wrote to memory of 4876 3356 b1573666c4e30baa2fc068eeaafe3901.exe 82 PID 3076 wrote to memory of 4424 3076 Explorer.EXE 83 PID 3076 wrote to memory of 4424 3076 Explorer.EXE 83 PID 3076 wrote to memory of 4424 3076 Explorer.EXE 83 PID 4424 wrote to memory of 4268 4424 cmstp.exe 87 PID 4424 wrote to memory of 4268 4424 cmstp.exe 87 PID 4424 wrote to memory of 4268 4424 cmstp.exe 87
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\b1573666c4e30baa2fc068eeaafe3901.exe"C:\Users\Admin\AppData\Local\Temp\b1573666c4e30baa2fc068eeaafe3901.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵PID:4268
-
-