Analysis
-
max time kernel
168s -
max time network
224s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
16-05-2022 12:08
Static task
static1
Behavioral task
behavioral1
Sample
catzx.exe
Resource
win7-20220414-en
General
-
Target
catzx.exe
-
Size
556KB
-
MD5
a505757fb36d0c2945985135b1de90cb
-
SHA1
0f90b28aa225725493ef72a9915bf0c5082ff992
-
SHA256
13bd267ca3d7af495f8cd8f72daf3ea997312671eafe9992a88768e4f3ecc601
-
SHA512
37d993fcb3774673a840d4e13e768c7160120c04746972f8efed6c4687e9872fcc175849193510190fbc5047ce89abcce5c3457955b85e7912c09c12b1f0f011
Malware Config
Extracted
xloader
2.5
r007
trashpandaservice.com
mobileads.network
ascolstore.com
gelsinextra.com
bonestell.net
heitoll.xyz
ceapgis.com
mon-lapin.biz
miq-eva.com
rematedesillas.com
playingonline.xyz
hausense.quest
tnyzw.com
appsdial.com
addcolor.city
hagenoblog.com
michaelwesleyj.com
she-zain.com
lorhsems.com
karmaserena.com
avatarrooms.com
friendsofrythmia.com
hdnhwy.com
firstnightfanfiction.net
vixflow.com
b8ceex.com
generatespeed.com
vaps02.com
climate-crisis.team
saturdaynightl.com
baro-drom.com
talleyresort.com
doctruyenovergeared.com
mogli-designz.info
politiciantunnel.com
housesyrron.com
troibrown.com
go-svetovanje.com
littlebittech.com
totallyglamplans.com
primeusatv.com
leifengping.com
halalfreshdelivery.com
gumbosgeorgetown.com
alittleraeoflight.com
xn--tckybzdtby655a5tj.xyz
wgassllc.xyz
craftandcloud.com
attorneyyochum.com
cryptocourse.one
bloomintegratedwellness.com
partypirateboatrentals.com
chainmio-top.xyz
mrjsloan.com
merryutilityservices.net
zglingbishi.com
wytchbytch.com
michigansharkettes.com
gerizon.net
texcelmed.com
cafe21-3.com
freemovies123.online
ungalfresh.com
sendungs.com
iot-vn.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/948-64-0x000000000041D9B0-mapping.dmp xloader behavioral1/memory/948-63-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral1/memory/948-69-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral1/memory/688-74-0x00000000000D0000-0x00000000000FA000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1608 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
catzx.execatzx.exechkdsk.exedescription pid process target process PID 860 set thread context of 948 860 catzx.exe catzx.exe PID 948 set thread context of 1196 948 catzx.exe Explorer.EXE PID 948 set thread context of 1196 948 catzx.exe Explorer.EXE PID 688 set thread context of 1196 688 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
catzx.execatzx.exechkdsk.exepid process 860 catzx.exe 860 catzx.exe 860 catzx.exe 860 catzx.exe 948 catzx.exe 948 catzx.exe 948 catzx.exe 688 chkdsk.exe 688 chkdsk.exe 688 chkdsk.exe 688 chkdsk.exe 688 chkdsk.exe 688 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
catzx.exechkdsk.exepid process 948 catzx.exe 948 catzx.exe 948 catzx.exe 948 catzx.exe 688 chkdsk.exe 688 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
catzx.execatzx.exeExplorer.EXEchkdsk.exedescription pid process Token: SeDebugPrivilege 860 catzx.exe Token: SeDebugPrivilege 948 catzx.exe Token: SeShutdownPrivilege 1196 Explorer.EXE Token: SeDebugPrivilege 688 chkdsk.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
catzx.exeExplorer.EXEchkdsk.exedescription pid process target process PID 860 wrote to memory of 1264 860 catzx.exe catzx.exe PID 860 wrote to memory of 1264 860 catzx.exe catzx.exe PID 860 wrote to memory of 1264 860 catzx.exe catzx.exe PID 860 wrote to memory of 1264 860 catzx.exe catzx.exe PID 860 wrote to memory of 1236 860 catzx.exe catzx.exe PID 860 wrote to memory of 1236 860 catzx.exe catzx.exe PID 860 wrote to memory of 1236 860 catzx.exe catzx.exe PID 860 wrote to memory of 1236 860 catzx.exe catzx.exe PID 860 wrote to memory of 1776 860 catzx.exe catzx.exe PID 860 wrote to memory of 1776 860 catzx.exe catzx.exe PID 860 wrote to memory of 1776 860 catzx.exe catzx.exe PID 860 wrote to memory of 1776 860 catzx.exe catzx.exe PID 860 wrote to memory of 1700 860 catzx.exe catzx.exe PID 860 wrote to memory of 1700 860 catzx.exe catzx.exe PID 860 wrote to memory of 1700 860 catzx.exe catzx.exe PID 860 wrote to memory of 1700 860 catzx.exe catzx.exe PID 860 wrote to memory of 948 860 catzx.exe catzx.exe PID 860 wrote to memory of 948 860 catzx.exe catzx.exe PID 860 wrote to memory of 948 860 catzx.exe catzx.exe PID 860 wrote to memory of 948 860 catzx.exe catzx.exe PID 860 wrote to memory of 948 860 catzx.exe catzx.exe PID 860 wrote to memory of 948 860 catzx.exe catzx.exe PID 860 wrote to memory of 948 860 catzx.exe catzx.exe PID 1196 wrote to memory of 688 1196 Explorer.EXE chkdsk.exe PID 1196 wrote to memory of 688 1196 Explorer.EXE chkdsk.exe PID 1196 wrote to memory of 688 1196 Explorer.EXE chkdsk.exe PID 1196 wrote to memory of 688 1196 Explorer.EXE chkdsk.exe PID 688 wrote to memory of 1608 688 chkdsk.exe cmd.exe PID 688 wrote to memory of 1608 688 chkdsk.exe cmd.exe PID 688 wrote to memory of 1608 688 chkdsk.exe cmd.exe PID 688 wrote to memory of 1608 688 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\catzx.exe"C:\Users\Admin\AppData\Local\Temp\catzx.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\catzx.exe"C:\Users\Admin\AppData\Local\Temp\catzx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\catzx.exe"C:\Users\Admin\AppData\Local\Temp\catzx.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\catzx.exe"C:\Users\Admin\AppData\Local\Temp\catzx.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\catzx.exe"C:\Users\Admin\AppData\Local\Temp\catzx.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\catzx.exe"C:\Users\Admin\AppData\Local\Temp\catzx.exe"3⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\catzx.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/688-77-0x0000000001EB0000-0x0000000001F40000-memory.dmpFilesize
576KB
-
memory/688-74-0x00000000000D0000-0x00000000000FA000-memory.dmpFilesize
168KB
-
memory/688-75-0x0000000002010000-0x0000000002313000-memory.dmpFilesize
3.0MB
-
memory/688-73-0x00000000007A0000-0x00000000007A7000-memory.dmpFilesize
28KB
-
memory/688-72-0x0000000000000000-mapping.dmp
-
memory/860-55-0x0000000075541000-0x0000000075543000-memory.dmpFilesize
8KB
-
memory/860-57-0x0000000000320000-0x000000000032A000-memory.dmpFilesize
40KB
-
memory/860-56-0x0000000004BD0000-0x0000000004C48000-memory.dmpFilesize
480KB
-
memory/860-58-0x0000000005280000-0x0000000005302000-memory.dmpFilesize
520KB
-
memory/860-59-0x0000000000980000-0x00000000009B0000-memory.dmpFilesize
192KB
-
memory/860-54-0x0000000000DF0000-0x0000000000E80000-memory.dmpFilesize
576KB
-
memory/948-61-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/948-66-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/948-69-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/948-70-0x00000000001D0000-0x00000000001E1000-memory.dmpFilesize
68KB
-
memory/948-67-0x0000000000190000-0x00000000001A1000-memory.dmpFilesize
68KB
-
memory/948-60-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/948-63-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/948-64-0x000000000041D9B0-mapping.dmp
-
memory/1196-68-0x0000000004B40000-0x0000000004CBC000-memory.dmpFilesize
1.5MB
-
memory/1196-71-0x0000000004050000-0x0000000004150000-memory.dmpFilesize
1024KB
-
memory/1196-78-0x0000000004360000-0x00000000043FF000-memory.dmpFilesize
636KB
-
memory/1608-76-0x0000000000000000-mapping.dmp