Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-05-2022 01:45
Static task
static1
Behavioral task
behavioral1
Sample
catzx.exe
Resource
win7-20220414-en
General
-
Target
catzx.exe
-
Size
637KB
-
MD5
8d6a4404edc6cceb62c96399991b35fc
-
SHA1
ddca329231e31acd27a46b6579937a23a4d6678e
-
SHA256
37dc7edf8d328692e168888bd219de366cd7114965184ec2fe716046652b81c3
-
SHA512
4d8e2e6ba6fe095512954d5d5de954c161c0dee5d9cb715fa118de6357d6ae18a9c685c9139c98335672b6cb76b2de897de1a61338649801b3a396ec05c67005
Malware Config
Extracted
xloader
2.5
r007
trashpandaservice.com
mobileads.network
ascolstore.com
gelsinextra.com
bonestell.net
heitoll.xyz
ceapgis.com
mon-lapin.biz
miq-eva.com
rematedesillas.com
playingonline.xyz
hausense.quest
tnyzw.com
appsdial.com
addcolor.city
hagenoblog.com
michaelwesleyj.com
she-zain.com
lorhsems.com
karmaserena.com
avatarrooms.com
friendsofrythmia.com
hdnhwy.com
firstnightfanfiction.net
vixflow.com
b8ceex.com
generatespeed.com
vaps02.com
climate-crisis.team
saturdaynightl.com
baro-drom.com
talleyresort.com
doctruyenovergeared.com
mogli-designz.info
politiciantunnel.com
housesyrron.com
troibrown.com
go-svetovanje.com
littlebittech.com
totallyglamplans.com
primeusatv.com
leifengping.com
halalfreshdelivery.com
gumbosgeorgetown.com
alittleraeoflight.com
xn--tckybzdtby655a5tj.xyz
wgassllc.xyz
craftandcloud.com
attorneyyochum.com
cryptocourse.one
bloomintegratedwellness.com
partypirateboatrentals.com
chainmio-top.xyz
mrjsloan.com
merryutilityservices.net
zglingbishi.com
wytchbytch.com
michigansharkettes.com
gerizon.net
texcelmed.com
cafe21-3.com
freemovies123.online
ungalfresh.com
sendungs.com
iot-vn.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4400-138-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral2/memory/3732-145-0x00000000001A0000-0x00000000001CA000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
catzx.execatzx.exesvchost.exedescription pid process target process PID 2340 set thread context of 4400 2340 catzx.exe catzx.exe PID 4400 set thread context of 8 4400 catzx.exe Explorer.EXE PID 3732 set thread context of 8 3732 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
catzx.execatzx.exesvchost.exepid process 2340 catzx.exe 2340 catzx.exe 4400 catzx.exe 4400 catzx.exe 4400 catzx.exe 4400 catzx.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe 3732 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 8 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
catzx.exesvchost.exepid process 4400 catzx.exe 4400 catzx.exe 4400 catzx.exe 3732 svchost.exe 3732 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
catzx.execatzx.exesvchost.exedescription pid process Token: SeDebugPrivilege 2340 catzx.exe Token: SeDebugPrivilege 4400 catzx.exe Token: SeDebugPrivilege 3732 svchost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
catzx.exeExplorer.EXEsvchost.exedescription pid process target process PID 2340 wrote to memory of 1104 2340 catzx.exe catzx.exe PID 2340 wrote to memory of 1104 2340 catzx.exe catzx.exe PID 2340 wrote to memory of 1104 2340 catzx.exe catzx.exe PID 2340 wrote to memory of 4400 2340 catzx.exe catzx.exe PID 2340 wrote to memory of 4400 2340 catzx.exe catzx.exe PID 2340 wrote to memory of 4400 2340 catzx.exe catzx.exe PID 2340 wrote to memory of 4400 2340 catzx.exe catzx.exe PID 2340 wrote to memory of 4400 2340 catzx.exe catzx.exe PID 2340 wrote to memory of 4400 2340 catzx.exe catzx.exe PID 8 wrote to memory of 3732 8 Explorer.EXE svchost.exe PID 8 wrote to memory of 3732 8 Explorer.EXE svchost.exe PID 8 wrote to memory of 3732 8 Explorer.EXE svchost.exe PID 3732 wrote to memory of 3708 3732 svchost.exe cmd.exe PID 3732 wrote to memory of 3708 3732 svchost.exe cmd.exe PID 3732 wrote to memory of 3708 3732 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\catzx.exe"C:\Users\Admin\AppData\Local\Temp\catzx.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\catzx.exe"C:\Users\Admin\AppData\Local\Temp\catzx.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\catzx.exe"C:\Users\Admin\AppData\Local\Temp\catzx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\catzx.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/8-142-0x00000000087B0000-0x0000000008916000-memory.dmpFilesize
1.4MB
-
memory/8-149-0x0000000003250000-0x0000000003336000-memory.dmpFilesize
920KB
-
memory/1104-136-0x0000000000000000-mapping.dmp
-
memory/2340-131-0x0000000005F00000-0x00000000064A4000-memory.dmpFilesize
5.6MB
-
memory/2340-132-0x0000000005950000-0x00000000059E2000-memory.dmpFilesize
584KB
-
memory/2340-133-0x0000000005A90000-0x0000000005B2C000-memory.dmpFilesize
624KB
-
memory/2340-134-0x0000000005900000-0x000000000590A000-memory.dmpFilesize
40KB
-
memory/2340-135-0x0000000009B30000-0x0000000009B96000-memory.dmpFilesize
408KB
-
memory/2340-130-0x0000000000E60000-0x0000000000F04000-memory.dmpFilesize
656KB
-
memory/3708-146-0x0000000000000000-mapping.dmp
-
memory/3732-143-0x0000000000000000-mapping.dmp
-
memory/3732-145-0x00000000001A0000-0x00000000001CA000-memory.dmpFilesize
168KB
-
memory/3732-144-0x0000000000430000-0x000000000043E000-memory.dmpFilesize
56KB
-
memory/3732-147-0x0000000000F00000-0x000000000124A000-memory.dmpFilesize
3.3MB
-
memory/3732-148-0x0000000000AD0000-0x0000000000B60000-memory.dmpFilesize
576KB
-
memory/4400-141-0x0000000000E70000-0x0000000000E81000-memory.dmpFilesize
68KB
-
memory/4400-140-0x0000000001300000-0x000000000164A000-memory.dmpFilesize
3.3MB
-
memory/4400-138-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4400-137-0x0000000000000000-mapping.dmp