Analysis
-
max time kernel
171s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
08-05-2022 10:57
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
925KB
-
MD5
4470f83cba058890c43ded4a3940c3dc
-
SHA1
f9c2953280646715ec9ad0d034a6eae43d1fc8c4
-
SHA256
0a779376d06a79b1b6c3ab2e2b241adf8b39db02e8180829a8f7071847f42b56
-
SHA512
8e3804af84b5f8d04630283dbc8764ea8d7395af635615013bf9bc25d3290c248a24e1b6f8486960aba5569c4cce105fb9f0ff82661d5f587ae56cab18b88981
Malware Config
Extracted
xloader
2.5
arh2
anniversaryalert.com
kinship.space
buabdullagroup.com
ghostprotectionagency.com
scion-go-getter.com
skindeepapp.com
kysp3.xyz
bonitaspringshomesearch.com
bestdeals2022.online
themarketingstinger.com
chengkayouxuan.com
fendoremi.com
j-stra.com
klingelecn.net
deluxecarepro.com
huanbaodg.com
mes-dents-blanches.com
solutionsemissionsimplifiee.com
abedbashir.tech
good-collection.store
zulijian1.com
deuxtonnes.com
va-products.com
limpiezaspricila.com
hollyweednc.com
liylaehamartoyof4.xyz
lauraloewendesign.com
gozabank.com
iconicbeauty.co
huashiren.xyz
bdsdaivietphat.com
josephgoddard.com
bburagotr.xyz
produkoriginal.store
6156yy.com
cellfacility.com
elictriczone.com
regaldock.com
yourvitalstatistics.com
nextgen-shareholder.com
charlie-dean.com
abodebuildinggroup.com
fortunabs.com
elizabethsilvasuarez.com
setsrl.net
neskasdreams.com
abubuntunginxsetup.xyz
ubspropertyservices.com
spiritpriest.com
altaingenieriainc.net
oldhamcars.com
daimaoart.com
5u8n.com
ppcpowered.com
pmariutto.com
opendialogmonaco.com
project66bug.com
goddesscodes.love
talkingwithmarcus.com
tranvantuan.xyz
priexalidomoi.store
un2030.com
loancreditscan.com
tg88.bet
rshedm.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/772-133-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral2/memory/3188-140-0x0000000001200000-0x0000000001229000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.execertreq.execmmon32.exedescription pid process target process PID 5012 set thread context of 772 5012 tmp.exe certreq.exe PID 772 set thread context of 2528 772 certreq.exe Explorer.EXE PID 3188 set thread context of 2528 3188 cmmon32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tmp.execertreq.execmmon32.exepid process 5012 tmp.exe 5012 tmp.exe 5012 tmp.exe 5012 tmp.exe 5012 tmp.exe 5012 tmp.exe 5012 tmp.exe 5012 tmp.exe 772 certreq.exe 772 certreq.exe 772 certreq.exe 772 certreq.exe 5012 tmp.exe 5012 tmp.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe 3188 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2528 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
certreq.execmmon32.exepid process 772 certreq.exe 772 certreq.exe 772 certreq.exe 3188 cmmon32.exe 3188 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.execertreq.execmmon32.exedescription pid process Token: SeDebugPrivilege 5012 tmp.exe Token: SeDebugPrivilege 772 certreq.exe Token: SeDebugPrivilege 3188 cmmon32.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
tmp.exeExplorer.EXEcmmon32.exedescription pid process target process PID 5012 wrote to memory of 772 5012 tmp.exe certreq.exe PID 5012 wrote to memory of 772 5012 tmp.exe certreq.exe PID 5012 wrote to memory of 772 5012 tmp.exe certreq.exe PID 5012 wrote to memory of 772 5012 tmp.exe certreq.exe PID 5012 wrote to memory of 772 5012 tmp.exe certreq.exe PID 5012 wrote to memory of 772 5012 tmp.exe certreq.exe PID 5012 wrote to memory of 772 5012 tmp.exe certreq.exe PID 2528 wrote to memory of 3188 2528 Explorer.EXE cmmon32.exe PID 2528 wrote to memory of 3188 2528 Explorer.EXE cmmon32.exe PID 2528 wrote to memory of 3188 2528 Explorer.EXE cmmon32.exe PID 3188 wrote to memory of 4824 3188 cmmon32.exe cmd.exe PID 3188 wrote to memory of 4824 3188 cmmon32.exe cmd.exe PID 3188 wrote to memory of 4824 3188 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\certreq.exe"C:\Windows\SysWOW64\certreq.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:772 -
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\certreq.exe"3⤵PID:4824
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/772-134-0x0000000001310000-0x000000000165A000-memory.dmpFilesize
3.3MB
-
memory/772-136-0x0000000001730000-0x0000000001741000-memory.dmpFilesize
68KB
-
memory/772-132-0x0000000000000000-mapping.dmp
-
memory/772-133-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2528-137-0x0000000002590000-0x0000000002659000-memory.dmpFilesize
804KB
-
memory/2528-144-0x0000000007660000-0x00000000077DB000-memory.dmpFilesize
1.5MB
-
memory/3188-138-0x0000000000000000-mapping.dmp
-
memory/3188-139-0x0000000000E60000-0x0000000000E6C000-memory.dmpFilesize
48KB
-
memory/3188-140-0x0000000001200000-0x0000000001229000-memory.dmpFilesize
164KB
-
memory/3188-142-0x00000000031D0000-0x000000000351A000-memory.dmpFilesize
3.3MB
-
memory/3188-143-0x0000000002F00000-0x0000000002F90000-memory.dmpFilesize
576KB
-
memory/4824-141-0x0000000000000000-mapping.dmp
-
memory/5012-131-0x0000000005850000-0x00000000058EC000-memory.dmpFilesize
624KB
-
memory/5012-130-0x0000000000DD0000-0x0000000000EBE000-memory.dmpFilesize
952KB