Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
11/05/2022, 09:03
Static task
static1
Behavioral task
behavioral1
Sample
berthing.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target berthing.exe
- Size 245KB
- Sample220511-kz15eagca3
- SHA256 40fbb07da69abd2e9af76579e314905103c73059c02b77c74adf81ab97eaa099
- MD5 af8e2192f8e67182761b3e533d017af7
- SHA1 e9a55a5e8cc2cdc571b965f0719a9e92bd749f21
- SHA512 fca4e22f5969a725edaa378ff2d2bc3f83da73fc6c79259f5de15f39bb111f45440e54b352a3a6d2cd69f3a3d04b504c0ca9651108af3c2e9a83e83b60317aba
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
bs8f
Decoy
-
atmospheraglobal.com
-
dontshootima.com
-
bestofferusde.club
-
yourdigitalboss.com
-
breskizci.com
-
myarrovacoastwebsite.com
-
reasclerk.com
-
efrovida.com
-
wsmz.net
-
upneett.com
-
loefflerforgov.com
-
noida.info
-
trndystore.com
-
arhaldar.online
-
vivibanca.tech
-
mykrema.com
-
vseserialy.online
-
ridgewayinsua.com
-
heauxland.com
-
bestcollegecourses.com
-
scent-kart.xyz
-
handyman-prime.com
-
wrightpurpose.com
-
hellounio.com
-
wealthy-link-erp.com
-
josegal.com
-
texasdominionrealty.com
-
hespresso.net
-
dreamonetnpasumo5.xyz
-
videosmind.com
-
abbawaalema.quest
-
esmtoluca.com
-
2382108759.com
-
akbastionoffilamentousfungi.com
-
electramanpower.com
-
siguealpanda.com
-
alquilerfurgon.com
-
3-little-pigs.com
-
esolutions4u.com
-
thatgolfer.com
-
biom4rk.com
-
paramusapartments.com
-
mothergadgets.com
-
ktnreport.xyz
-
amxdrivers.com
-
buymyhomeallcash.com
-
lifeisthere.com
-
nous-citoyens.com
-
destimarketing.com
-
lawinepro.com
-
littlenorwayfarmhouse.com
-
realworldgb488.rest
-
qualinorm.com
-
capitaltechcorp.com
-
familybeautifull.com
-
continentaldeal.com
-
scratchforce.com
-
veganbreathing.com
-
hickoryfalls-pm.com
-
pascal-rocha.com
-
20kretirementplan.biz
-
lehome.store
-
hellanatural.com
-
hnythao.com
-
gnizdo.online
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/852-136-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4248-145-0x0000000001280000-0x00000000012A9000-memory.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 5056 tvvmynz.exe 852 tvvmynz.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 5056 set thread context of 852 5056 tvvmynz.exe 82 PID 852 set thread context of 2148 852 tvvmynz.exe 29 PID 4248 set thread context of 2148 4248 svchost.exe 29 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 852 tvvmynz.exe 852 tvvmynz.exe 852 tvvmynz.exe 852 tvvmynz.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe 4248 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2148 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 852 tvvmynz.exe 852 tvvmynz.exe 852 tvvmynz.exe 4248 svchost.exe 4248 svchost.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 852 tvvmynz.exe Token: SeDebugPrivilege 4248 svchost.exe Token: SeShutdownPrivilege 2148 Explorer.EXE Token: SeCreatePagefilePrivilege 2148 Explorer.EXE Token: SeShutdownPrivilege 2148 Explorer.EXE Token: SeCreatePagefilePrivilege 2148 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2200 wrote to memory of 5056 2200 berthing.exe 81 PID 2200 wrote to memory of 5056 2200 berthing.exe 81 PID 2200 wrote to memory of 5056 2200 berthing.exe 81 PID 5056 wrote to memory of 852 5056 tvvmynz.exe 82 PID 5056 wrote to memory of 852 5056 tvvmynz.exe 82 PID 5056 wrote to memory of 852 5056 tvvmynz.exe 82 PID 5056 wrote to memory of 852 5056 tvvmynz.exe 82 PID 5056 wrote to memory of 852 5056 tvvmynz.exe 82 PID 5056 wrote to memory of 852 5056 tvvmynz.exe 82 PID 2148 wrote to memory of 4248 2148 Explorer.EXE 83 PID 2148 wrote to memory of 4248 2148 Explorer.EXE 83 PID 2148 wrote to memory of 4248 2148 Explorer.EXE 83 PID 4248 wrote to memory of 368 4248 svchost.exe 87 PID 4248 wrote to memory of 368 4248 svchost.exe 87 PID 4248 wrote to memory of 368 4248 svchost.exe 87
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\berthing.exe"C:\Users\Admin\AppData\Local\Temp\berthing.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\tvvmynz.exeC:\Users\Admin\AppData\Local\Temp\tvvmynz.exe C:\Users\Admin\AppData\Local\Temp\ckxzkd3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\tvvmynz.exeC:\Users\Admin\AppData\Local\Temp\tvvmynz.exe C:\Users\Admin\AppData\Local\Temp\ckxzkd4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:852
-
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tvvmynz.exe"3⤵PID:368
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\ckxzkd
- Size 5KB
- SHA256 897ee822be5e7b5275567f42eee4c12f27435506459624534366c6fdf2057f4d
- MD5 3bbf7ce478d3fea692aa6297cb2e4dc2
- SHA1 c275088b575650db8dab910a6a74250af7281d92
- SHA512 3d5c4b91afcb5cba9533c539d90db29a33bd6d36eab526f1ed39b53af1a3498d5485bd8902229505640466d5747ff5ea5b55cc03c32b8238e042635fd4939373
- SSDEEP 96:A6kxU8iVcGcHsxsF34IoG4ka67BCjmB8RsFXC4m+F4xUoduh0Wx2SXb:A6kxUtCGcMCd4vkv7kqasQ+Wa+s5x2kb
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\o1bnmup7v5rcbjh1kp
- Size 163KB
- SHA256 c5db70e6f1cee701b3abf0454fc4a5b2ca17b01cba754df424e358e82e1c556e
- MD5 6c9d820dbd568110130eae24b6d15162
- SHA1 ef796a5ce97a6cb202d670d643a5434a2f954711
- SHA512 44a1eaf1d7a3dc32604e8d4ae91f961f97969ce290628d4731e1cf06ab08d189dcd9c24e1fd0991eb79cb22dc7a48673c51f6a882ebf445201adff7adbf08ed7
- SSDEEP 3072:naoZZ/q1s4L/BkcqMggINM5NEzgwVzAXTAy272AyfmFAXXn:njCR/bfggI5VyQ2xYAH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tvvmynz.exe
- Size 74KB
- SHA256 41c7b15b38adfcf3d004c2cc3bb57abafa2ce3b9fbcf8eaa0691887494e1ec8c
- MD5 e0e6d4282fbe8ee2df6df6fadc97cc21
- SHA1 e77ba45ce19ffaf6b240cd3468cafdc9ec41c290
- SHA512 766bbe241849234c42eab68c6f5f2dd131a9adb351924cd879de412f9c6b2ef01672508221b71f3d3a41a1a9a4b816db2f4947af38ed4523fa634967d6d82520
- SSDEEP 1536:WverKSp+1bq0RYJ9bWFXiEcc1y/sWjcdWEm:BrlYbjkbG1XWEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tvvmynz.exe
- Size 74KB
- SHA256 41c7b15b38adfcf3d004c2cc3bb57abafa2ce3b9fbcf8eaa0691887494e1ec8c
- MD5 e0e6d4282fbe8ee2df6df6fadc97cc21
- SHA1 e77ba45ce19ffaf6b240cd3468cafdc9ec41c290
- SHA512 766bbe241849234c42eab68c6f5f2dd131a9adb351924cd879de412f9c6b2ef01672508221b71f3d3a41a1a9a4b816db2f4947af38ed4523fa634967d6d82520
- SSDEEP 1536:WverKSp+1bq0RYJ9bWFXiEcc1y/sWjcdWEm:BrlYbjkbG1XWEm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tvvmynz.exe
- Size 74KB
- SHA256 41c7b15b38adfcf3d004c2cc3bb57abafa2ce3b9fbcf8eaa0691887494e1ec8c
- MD5 e0e6d4282fbe8ee2df6df6fadc97cc21
- SHA1 e77ba45ce19ffaf6b240cd3468cafdc9ec41c290
- SHA512 766bbe241849234c42eab68c6f5f2dd131a9adb351924cd879de412f9c6b2ef01672508221b71f3d3a41a1a9a4b816db2f4947af38ed4523fa634967d6d82520
- SSDEEP 1536:WverKSp+1bq0RYJ9bWFXiEcc1y/sWjcdWEm:BrlYbjkbG1XWEm
- MD5 SHA1 SHA512 SSDEEP