Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:45
Static task
static1
Behavioral task
behavioral1
Sample
Scan_order9215060196.exe
Resource
win7-20220414-en
General
-
Target
Scan_order9215060196.exe
-
Size
327KB
-
MD5
3902d05dd23263e123e94136dbde2f38
-
SHA1
a106c76ed170064b60a541a4533b2610e7e652df
-
SHA256
896745863d78a02b1cf02565dbeb3bca4bfd156a1079d28c07ddfb2d8b9fc665
-
SHA512
1900a2b722bc099bf4733c412db310916a4258b6482d6676a47332983c299d03a89e04f8614f49be3bd43ee464aef7d3ac66f6c5bf378601b7f77e06c969c881
Malware Config
Extracted
xloader
2.0
war0
siompany.net
55667879.com
smallmouth.net
fordforlano.net
placadesilicon.com
btw-butler.com
almbeauty.com
jbthomson.com
presidentialtennessee.com
chiropractorinnorthport.com
yourber.com
get-luxurycruise.rocks
strakellc.com
eukncg.info
pablovergara.info
sologoods.com
toledovista.com
weightlosscoffees.com
echoawyer.com
csproductionsmedia.com
dwspd.info
thetruketo.com
babiescamerino.com
buyamzproduct.com
qhccwcyy.com
beyondt2p.biz
hesvjgg.com
4twentyicecream.com
collagenwaveofficial.com
bestsellingnovelty.com
butterflywarriorshop.com
r-city.info
on444.com
univers-travel.com
mandarinasinpepitas.com
hakupu.com
lokmitrabloodbank.com
autotrasporticanale.com
espiarwhatsappenminutos.com
satnanews.com
xhtd645.com
lucidabright.com
qushipower.com
del-cafes.com
kanatrevor.com
lauras-augenblick.com
maydaytravelsandhospitality.com
weatherclan.com
kikmessengerforpcs.com
albergue-pintueles.com
koshermykonos.com
grupoeysh.com
enchantedpincushion.com
northwindcharter.com
coretrainerpro.com
bestfamilyfinance.com
www334678.com
justinmo.com
mienert.net
radgirlonline.com
sports-picture.com
jiankanggansu.com
cnoemsoft.com
fitlifereport.com
magentos.info
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3824-136-0x0000000000400000-0x0000000000427000-memory.dmp xloader behavioral2/memory/4400-143-0x0000000000FB0000-0x0000000000FD7000-memory.dmp xloader -
Executes dropped EXE 1 IoCs
Processes:
xzjts2ylt.exepid process 1760 xzjts2ylt.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cmd.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cmd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4HM8BXBPTHI = "C:\\Program Files (x86)\\To2ktgh\\xzjts2ylt.exe" cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Scan_order9215060196.exeScan_order9215060196.execmd.exedescription pid process target process PID 2340 set thread context of 3824 2340 Scan_order9215060196.exe Scan_order9215060196.exe PID 3824 set thread context of 8 3824 Scan_order9215060196.exe Explorer.EXE PID 4400 set thread context of 8 4400 cmd.exe Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
Explorer.EXEcmd.exedescription ioc process File opened for modification C:\Program Files (x86)\To2ktgh\xzjts2ylt.exe Explorer.EXE File opened for modification C:\Program Files (x86)\To2ktgh\xzjts2ylt.exe cmd.exe File opened for modification C:\Program Files (x86)\To2ktgh Explorer.EXE File created C:\Program Files (x86)\To2ktgh\xzjts2ylt.exe Explorer.EXE -
Processes:
cmd.exedescription ioc process Key created \Registry\User\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmd.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
Scan_order9215060196.execmd.exepid process 3824 Scan_order9215060196.exe 3824 Scan_order9215060196.exe 3824 Scan_order9215060196.exe 3824 Scan_order9215060196.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 8 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Scan_order9215060196.execmd.exepid process 3824 Scan_order9215060196.exe 3824 Scan_order9215060196.exe 3824 Scan_order9215060196.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe 4400 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Scan_order9215060196.execmd.exedescription pid process Token: SeDebugPrivilege 3824 Scan_order9215060196.exe Token: SeDebugPrivilege 4400 cmd.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Scan_order9215060196.exeExplorer.EXEcmd.exedescription pid process target process PID 2340 wrote to memory of 3824 2340 Scan_order9215060196.exe Scan_order9215060196.exe PID 2340 wrote to memory of 3824 2340 Scan_order9215060196.exe Scan_order9215060196.exe PID 2340 wrote to memory of 3824 2340 Scan_order9215060196.exe Scan_order9215060196.exe PID 2340 wrote to memory of 3824 2340 Scan_order9215060196.exe Scan_order9215060196.exe PID 2340 wrote to memory of 3824 2340 Scan_order9215060196.exe Scan_order9215060196.exe PID 2340 wrote to memory of 3824 2340 Scan_order9215060196.exe Scan_order9215060196.exe PID 8 wrote to memory of 4400 8 Explorer.EXE cmd.exe PID 8 wrote to memory of 4400 8 Explorer.EXE cmd.exe PID 8 wrote to memory of 4400 8 Explorer.EXE cmd.exe PID 4400 wrote to memory of 3992 4400 cmd.exe cmd.exe PID 4400 wrote to memory of 3992 4400 cmd.exe cmd.exe PID 4400 wrote to memory of 3992 4400 cmd.exe cmd.exe PID 4400 wrote to memory of 1156 4400 cmd.exe cmd.exe PID 4400 wrote to memory of 1156 4400 cmd.exe cmd.exe PID 4400 wrote to memory of 1156 4400 cmd.exe cmd.exe PID 4400 wrote to memory of 4516 4400 cmd.exe Firefox.exe PID 4400 wrote to memory of 4516 4400 cmd.exe Firefox.exe PID 4400 wrote to memory of 4516 4400 cmd.exe Firefox.exe PID 8 wrote to memory of 1760 8 Explorer.EXE xzjts2ylt.exe PID 8 wrote to memory of 1760 8 Explorer.EXE xzjts2ylt.exe PID 8 wrote to memory of 1760 8 Explorer.EXE xzjts2ylt.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan_order9215060196.exe"C:\Users\Admin\AppData\Local\Temp\Scan_order9215060196.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan_order9215060196.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Scan_order9215060196.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\To2ktgh\xzjts2ylt.exe"C:\Program Files (x86)\To2ktgh\xzjts2ylt.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\To2ktgh\xzjts2ylt.exeFilesize
327KB
MD53902d05dd23263e123e94136dbde2f38
SHA1a106c76ed170064b60a541a4533b2610e7e652df
SHA256896745863d78a02b1cf02565dbeb3bca4bfd156a1079d28c07ddfb2d8b9fc665
SHA5121900a2b722bc099bf4733c412db310916a4258b6482d6676a47332983c299d03a89e04f8614f49be3bd43ee464aef7d3ac66f6c5bf378601b7f77e06c969c881
-
C:\Program Files (x86)\To2ktgh\xzjts2ylt.exeFilesize
327KB
MD53902d05dd23263e123e94136dbde2f38
SHA1a106c76ed170064b60a541a4533b2610e7e652df
SHA256896745863d78a02b1cf02565dbeb3bca4bfd156a1079d28c07ddfb2d8b9fc665
SHA5121900a2b722bc099bf4733c412db310916a4258b6482d6676a47332983c299d03a89e04f8614f49be3bd43ee464aef7d3ac66f6c5bf378601b7f77e06c969c881
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
memory/8-140-0x00000000087B0000-0x0000000008903000-memory.dmpFilesize
1.3MB
-
memory/8-147-0x0000000003250000-0x00000000032F4000-memory.dmpFilesize
656KB
-
memory/1156-148-0x0000000000000000-mapping.dmp
-
memory/1760-150-0x0000000000000000-mapping.dmp
-
memory/2340-134-0x0000000007E90000-0x0000000007F2C000-memory.dmpFilesize
624KB
-
memory/2340-130-0x0000000000B20000-0x0000000000B78000-memory.dmpFilesize
352KB
-
memory/2340-133-0x00000000056C0000-0x00000000056CA000-memory.dmpFilesize
40KB
-
memory/2340-132-0x0000000005520000-0x00000000055B2000-memory.dmpFilesize
584KB
-
memory/2340-131-0x00000000059F0000-0x0000000005F94000-memory.dmpFilesize
5.6MB
-
memory/3824-139-0x0000000000FF0000-0x0000000001000000-memory.dmpFilesize
64KB
-
memory/3824-138-0x0000000001940000-0x0000000001C8A000-memory.dmpFilesize
3.3MB
-
memory/3824-136-0x0000000000400000-0x0000000000427000-memory.dmpFilesize
156KB
-
memory/3824-135-0x0000000000000000-mapping.dmp
-
memory/3992-144-0x0000000000000000-mapping.dmp
-
memory/4400-141-0x0000000000000000-mapping.dmp
-
memory/4400-146-0x0000000001A00000-0x0000000001A8F000-memory.dmpFilesize
572KB
-
memory/4400-145-0x0000000001C60000-0x0000000001FAA000-memory.dmpFilesize
3.3MB
-
memory/4400-143-0x0000000000FB0000-0x0000000000FD7000-memory.dmpFilesize
156KB
-
memory/4400-142-0x00000000001F0000-0x000000000024A000-memory.dmpFilesize
360KB