Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
15-05-2022 07:17
Static task
static1
General
-
Target
4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe
-
Size
1.0MB
-
MD5
9c57cf589c6ff051d2aec2bbaf515dfb
-
SHA1
846b8e1244b7a7e2cbddbd837c77708b6bb0bb32
-
SHA256
4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701
-
SHA512
2947df318501ce13e7b99cf65fc0f18db3086f6ac97727831ffdb253a28fdce3ce10d1d1998b80423d313ae5d375ad2f65ff9b3741774e2a3632de7862364a0e
Malware Config
Extracted
xloader
2.6
arh2
hstorc.com
blackountry.com
dhrbakery.com
dezhouofit.com
defipayout.xyz
ginas4t.com
byzbh63.xyz
qrcrashview.com
mialibaby.com
enhaut.net
samainnova.com
yashveerresort.com
delfos.online
dungcumay.com
lj-counseling.net
fliptheswitch.pro
padogbitelawyer.com
aticarev.com
sederino.site
bestplansforpets-japan3.life
radicallysimplesupps.com
sandbagmaker.com
misdcf.xyz
nbpz.xyz
floridasunbreaks.com
justfinishesofcolorado.com
homemethtestkit.com
chaquetashapticas.com
zodiactshirt.com
tees.email
zxzx999.com
tempepdf.com
watchusroll.com
parotacenter.com
assistcourse.online
paulstilingroup.com
cnbcfx.com
mooncore.xyz
laplugnation.com
gosti24.com
cthomassolutions.com
rkhubs.com
aboutpier.com
multimediaroomandboard.com
iamparrot.com
wifitest.info
nounworld.com
xpartner.biz
128grandviewdrivenewportnsw.com
bakiin.com
suitcell.com
onehitgamerstudios.com
bathingsuitsshoppingus.com
wingstarifa.com
ccasudqi.com
epiconscious.com
ponponshoes.com
cicom.tech
safetynetinc.net
recanto.xyz
sellsidelite.net
kevmoinesproperties.com
hdwallpaperpics.life
57gznfw.xyz
abtys6.online
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/5084-197-0x000000000041F270-mapping.dmp xloader behavioral1/memory/5084-206-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/344-209-0x000000000041F270-mapping.dmp xloader behavioral1/memory/3644-253-0x00000000028F0000-0x000000000291B000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exektmutil.exehelp.exedescription pid process target process PID 2668 set thread context of 5084 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe Windows.Media.BackgroundPlayback.exe PID 2668 set thread context of 344 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe ktmutil.exe PID 344 set thread context of 3048 344 ktmutil.exe Explorer.EXE PID 3644 set thread context of 3048 3644 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exeWindows.Media.BackgroundPlayback.exektmutil.exehelp.exepid process 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 5084 Windows.Media.BackgroundPlayback.exe 5084 Windows.Media.BackgroundPlayback.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 344 ktmutil.exe 344 ktmutil.exe 344 ktmutil.exe 344 ktmutil.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe 3644 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3048 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
ktmutil.exehelp.exepid process 344 ktmutil.exe 344 ktmutil.exe 344 ktmutil.exe 3644 help.exe 3644 help.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exektmutil.exeExplorer.EXEhelp.exedescription pid process Token: SeDebugPrivilege 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe Token: SeDebugPrivilege 344 ktmutil.exe Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeShutdownPrivilege 3048 Explorer.EXE Token: SeCreatePagefilePrivilege 3048 Explorer.EXE Token: SeDebugPrivilege 3644 help.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exeExplorer.EXEhelp.exedescription pid process target process PID 2668 wrote to memory of 5084 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe Windows.Media.BackgroundPlayback.exe PID 2668 wrote to memory of 5084 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe Windows.Media.BackgroundPlayback.exe PID 2668 wrote to memory of 5084 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe Windows.Media.BackgroundPlayback.exe PID 2668 wrote to memory of 5084 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe Windows.Media.BackgroundPlayback.exe PID 2668 wrote to memory of 5084 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe Windows.Media.BackgroundPlayback.exe PID 2668 wrote to memory of 5084 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe Windows.Media.BackgroundPlayback.exe PID 2668 wrote to memory of 5084 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe Windows.Media.BackgroundPlayback.exe PID 2668 wrote to memory of 344 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe ktmutil.exe PID 2668 wrote to memory of 344 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe ktmutil.exe PID 2668 wrote to memory of 344 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe ktmutil.exe PID 2668 wrote to memory of 344 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe ktmutil.exe PID 2668 wrote to memory of 344 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe ktmutil.exe PID 2668 wrote to memory of 344 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe ktmutil.exe PID 2668 wrote to memory of 344 2668 4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe ktmutil.exe PID 3048 wrote to memory of 3644 3048 Explorer.EXE help.exe PID 3048 wrote to memory of 3644 3048 Explorer.EXE help.exe PID 3048 wrote to memory of 3644 3048 Explorer.EXE help.exe PID 3644 wrote to memory of 3604 3644 help.exe cmd.exe PID 3644 wrote to memory of 3604 3644 help.exe cmd.exe PID 3644 wrote to memory of 3604 3644 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe"C:\Users\Admin\AppData\Local\Temp\4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe"C:\Windows\SysWOW64\Windows.Media.BackgroundPlayback.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\ktmutil.exe"C:\Windows\SysWOW64\ktmutil.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\ktmutil.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/344-209-0x000000000041F270-mapping.dmp
-
memory/344-234-0x0000000003450000-0x0000000003770000-memory.dmpFilesize
3.1MB
-
memory/344-235-0x0000000003770000-0x0000000003781000-memory.dmpFilesize
68KB
-
memory/2668-157-0x0000000005620000-0x00000000056B2000-memory.dmpFilesize
584KB
-
memory/2668-149-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-120-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-121-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-158-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-124-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-123-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-125-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-126-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-127-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-128-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-129-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-130-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-131-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-132-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-133-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-134-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-135-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-136-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-137-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-138-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-139-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-140-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-141-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-143-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-142-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-144-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-145-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-146-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-147-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-148-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-159-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-150-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-151-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-152-0x00000000012E0000-0x00000000013F0000-memory.dmpFilesize
1.1MB
-
memory/2668-153-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-154-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-155-0x0000000005B20000-0x000000000601E000-memory.dmpFilesize
5.0MB
-
memory/2668-156-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-118-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-122-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-119-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-160-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-161-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-162-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-163-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-164-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-165-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-166-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-167-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-168-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-169-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-170-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-171-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-172-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-173-0x0000000003280000-0x000000000328A000-memory.dmpFilesize
40KB
-
memory/2668-174-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-175-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-176-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-177-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-178-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-179-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-180-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-181-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-182-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-184-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-183-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-185-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/2668-187-0x00000000090C0000-0x0000000009136000-memory.dmpFilesize
472KB
-
memory/2668-193-0x0000000009040000-0x00000000090BC000-memory.dmpFilesize
496KB
-
memory/2668-194-0x0000000009170000-0x000000000918E000-memory.dmpFilesize
120KB
-
memory/3048-236-0x0000000006D80000-0x0000000006F23000-memory.dmpFilesize
1.6MB
-
memory/3048-269-0x0000000003160000-0x00000000031F6000-memory.dmpFilesize
600KB
-
memory/3604-250-0x0000000000000000-mapping.dmp
-
memory/3644-238-0x0000000000000000-mapping.dmp
-
memory/3644-252-0x0000000000020000-0x0000000000027000-memory.dmpFilesize
28KB
-
memory/3644-253-0x00000000028F0000-0x000000000291B000-memory.dmpFilesize
172KB
-
memory/3644-255-0x0000000002B40000-0x0000000002E60000-memory.dmpFilesize
3.1MB
-
memory/3644-260-0x0000000002E60000-0x0000000002EF0000-memory.dmpFilesize
576KB
-
memory/5084-197-0x000000000041F270-mapping.dmp
-
memory/5084-207-0x0000000003010000-0x0000000003330000-memory.dmpFilesize
3.1MB
-
memory/5084-206-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB