Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
02-06-2022 03:03
Static task
static1
Behavioral task
behavioral1
Sample
AQ002631-SKY-TH-T512 RS485 10PCS.exe
Resource
win7-20220414-en
General
-
Target
AQ002631-SKY-TH-T512 RS485 10PCS.exe
-
Size
1.3MB
-
MD5
c7da9990b784a040d1f79389073e225f
-
SHA1
d0860b0ce64637b4fe324d4d6f7e2ad385c62fcc
-
SHA256
e9c4d23961ba5085288212f493fd784d10234d72e706a0488bf7c7294ba0de20
-
SHA512
99a6362a0abbcd5463eb4369fd4355bdc1dfc82c5397969e2a71dc1b37f56b40126d3d3d4fdc65c8e5212ad0106f1574761ff8efc70b30c8369f8b98cec8b2f1
Malware Config
Extracted
xloader
2.6
be3s
aoxaswa.info
souplab-graphic.com
churchontheisland.com
spclassic-cars.com
stanford-edu.club
heydowm.online
chattanooga-electricians.com
sectsk.com
cxg98.com
buildafricaonline.net
buydogcoin.com
vsst247.com
lodgelastrancas.com
ainonaho.com
griousndwarehsftyfs.xyz
voltagestabilizersupply.com
xn--79q565dzfex9hg81b.com
isrvr-ccrforum.info
chitiandi.com
criticaldisco.com
fxivcama.com
martinsalas12.com
stellar3.xyz
positivistapproach.com
drivecheckeredflagcdjr.com
ejxsj.com
vegastrader.net
srivedafireandsafetysystems.com
ssmrmt.com
alexander-stuart.com
bill-tj.com
ctgteams.com
gossipnode.com
c431s.com
kelleysheartinart.com
rusucatalin.com
beautifulcreativeconcepts.info
hongyanwulei.com
lhab.xyz
gpzdd.com
dailyprizes-2022.site
hollafashions.com
gecharity.com
villagegram.com
davisesinthesmokies.xyz
webandsundry.com
setthetonenyc.com
bayu122.com
lajollabella.com
ghazalceramic.com
soft-iwacu.online
haksography.com
karise.life
promobilelist.com
respecttheroyalty.com
17500teraholland.com
giraffeemarketing.com
canyouseelouise.net
watchur6.com
eqaq-tvzurp.xyz
onlinecumpar.com
watchdiving.com
austriatourguide.com
kavun2.xyz
mpmidea.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1588-75-0x000000000041F320-mapping.dmp xloader behavioral1/memory/1588-74-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1588-85-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1588-90-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/832-94-0x0000000000080000-0x00000000000AB000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GBCPJFBP = "C:\\Program Files (x86)\\O3fz\\Cookiesmtqpdx6h.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1828 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
AQ002631-SKY-TH-T512 RS485 10PCS.exeAQ002631-SKY-TH-T512 RS485 10PCS.exesvchost.exedescription pid process target process PID 1644 set thread context of 1588 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1588 set thread context of 1268 1588 AQ002631-SKY-TH-T512 RS485 10PCS.exe Explorer.EXE PID 1588 set thread context of 1268 1588 AQ002631-SKY-TH-T512 RS485 10PCS.exe Explorer.EXE PID 832 set thread context of 1268 832 svchost.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files (x86)\O3fz\Cookiesmtqpdx6h.exe svchost.exe -
Processes:
svchost.exedescription ioc process Key created \Registry\User\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 svchost.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
AQ002631-SKY-TH-T512 RS485 10PCS.exeAQ002631-SKY-TH-T512 RS485 10PCS.exesvchost.exepid process 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe 1588 AQ002631-SKY-TH-T512 RS485 10PCS.exe 1588 AQ002631-SKY-TH-T512 RS485 10PCS.exe 1588 AQ002631-SKY-TH-T512 RS485 10PCS.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
AQ002631-SKY-TH-T512 RS485 10PCS.exesvchost.exepid process 1588 AQ002631-SKY-TH-T512 RS485 10PCS.exe 1588 AQ002631-SKY-TH-T512 RS485 10PCS.exe 1588 AQ002631-SKY-TH-T512 RS485 10PCS.exe 1588 AQ002631-SKY-TH-T512 RS485 10PCS.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe 832 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
AQ002631-SKY-TH-T512 RS485 10PCS.exeAQ002631-SKY-TH-T512 RS485 10PCS.exesvchost.exedescription pid process Token: SeDebugPrivilege 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe Token: SeDebugPrivilege 1588 AQ002631-SKY-TH-T512 RS485 10PCS.exe Token: SeDebugPrivilege 832 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
AQ002631-SKY-TH-T512 RS485 10PCS.exeExplorer.EXEsvchost.exedescription pid process target process PID 1644 wrote to memory of 1076 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1076 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1076 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1076 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 612 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 612 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 612 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 612 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1208 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1208 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1208 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1208 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1348 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1348 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1348 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1348 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1588 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1588 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1588 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1588 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1588 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1588 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1644 wrote to memory of 1588 1644 AQ002631-SKY-TH-T512 RS485 10PCS.exe AQ002631-SKY-TH-T512 RS485 10PCS.exe PID 1268 wrote to memory of 832 1268 Explorer.EXE svchost.exe PID 1268 wrote to memory of 832 1268 Explorer.EXE svchost.exe PID 1268 wrote to memory of 832 1268 Explorer.EXE svchost.exe PID 1268 wrote to memory of 832 1268 Explorer.EXE svchost.exe PID 832 wrote to memory of 1828 832 svchost.exe cmd.exe PID 832 wrote to memory of 1828 832 svchost.exe cmd.exe PID 832 wrote to memory of 1828 832 svchost.exe cmd.exe PID 832 wrote to memory of 1828 832 svchost.exe cmd.exe PID 832 wrote to memory of 1264 832 svchost.exe Firefox.exe PID 832 wrote to memory of 1264 832 svchost.exe Firefox.exe PID 832 wrote to memory of 1264 832 svchost.exe Firefox.exe PID 832 wrote to memory of 1264 832 svchost.exe Firefox.exe PID 832 wrote to memory of 1264 832 svchost.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"3⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AQ002631-SKY-TH-T512 RS485 10PCS.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-96-0x0000000000B50000-0x0000000000BE0000-memory.dmpFilesize
576KB
-
memory/832-94-0x0000000000080000-0x00000000000AB000-memory.dmpFilesize
172KB
-
memory/832-93-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/832-92-0x0000000000DC0000-0x0000000000DC8000-memory.dmpFilesize
32KB
-
memory/832-89-0x0000000000000000-mapping.dmp
-
memory/1268-84-0x0000000005F90000-0x00000000060CB000-memory.dmpFilesize
1.2MB
-
memory/1268-98-0x00000000060D0000-0x0000000006191000-memory.dmpFilesize
772KB
-
memory/1268-97-0x00000000060D0000-0x0000000006191000-memory.dmpFilesize
772KB
-
memory/1268-88-0x0000000004130000-0x00000000041FC000-memory.dmpFilesize
816KB
-
memory/1588-87-0x00000000002E0000-0x00000000002F1000-memory.dmpFilesize
68KB
-
memory/1588-75-0x000000000041F320-mapping.dmp
-
memory/1588-90-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1588-85-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1588-82-0x0000000000C20000-0x0000000000F23000-memory.dmpFilesize
3.0MB
-
memory/1588-83-0x00000000002A0000-0x00000000002B1000-memory.dmpFilesize
68KB
-
memory/1588-72-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1588-74-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1588-71-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1644-80-0x00000000715E0000-0x00000000722FD000-memory.dmpFilesize
13.1MB
-
memory/1644-63-0x00000000706C0000-0x0000000070DFE000-memory.dmpFilesize
7.2MB
-
memory/1644-69-0x00000000704E0000-0x00000000706B1000-memory.dmpFilesize
1.8MB
-
memory/1644-76-0x0000000072D10000-0x000000007409F000-memory.dmpFilesize
19.6MB
-
memory/1644-77-0x0000000072300000-0x0000000072D10000-memory.dmpFilesize
10.1MB
-
memory/1644-78-0x0000000074970000-0x0000000074B04000-memory.dmpFilesize
1.6MB
-
memory/1644-64-0x0000000072D10000-0x000000007409F000-memory.dmpFilesize
19.6MB
-
memory/1644-81-0x0000000070280000-0x00000000703A3000-memory.dmpFilesize
1.1MB
-
memory/1644-68-0x0000000005160000-0x00000000051EE000-memory.dmpFilesize
568KB
-
memory/1644-67-0x00000000715E0000-0x00000000722FD000-memory.dmpFilesize
13.1MB
-
memory/1644-66-0x0000000074970000-0x0000000074B04000-memory.dmpFilesize
1.6MB
-
memory/1644-70-0x0000000004630000-0x0000000004662000-memory.dmpFilesize
200KB
-
memory/1644-54-0x00000000000F0000-0x0000000000248000-memory.dmpFilesize
1.3MB
-
memory/1644-62-0x0000000074870000-0x000000007496C000-memory.dmpFilesize
1008KB
-
memory/1644-61-0x0000000070E00000-0x00000000715E0000-memory.dmpFilesize
7.9MB
-
memory/1644-65-0x0000000072300000-0x0000000072D10000-memory.dmpFilesize
10.1MB
-
memory/1644-55-0x00000000769D1000-0x00000000769D3000-memory.dmpFilesize
8KB
-
memory/1644-60-0x0000000000680000-0x0000000000696000-memory.dmpFilesize
88KB
-
memory/1644-59-0x00000000715E0000-0x00000000722FD000-memory.dmpFilesize
13.1MB
-
memory/1644-58-0x0000000074970000-0x0000000074B04000-memory.dmpFilesize
1.6MB
-
memory/1644-57-0x0000000072300000-0x0000000072D10000-memory.dmpFilesize
10.1MB
-
memory/1644-56-0x0000000072D10000-0x000000007409F000-memory.dmpFilesize
19.6MB
-
memory/1828-91-0x0000000000000000-mapping.dmp