Analysis
-
max time kernel
157s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-06-2022 05:26
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
728KB
-
MD5
7bf97c78987dee44d858343ed72da24b
-
SHA1
e2a445bc4e5923b355aa977cfc73a94e08706c36
-
SHA256
a01581f76331c0d9ac33410544e67422ad99c553d6c15a5d3d526c304c908554
-
SHA512
d86e85ea50a4e8fc766c48b509d7bcabf43167ce58f731b6273c5b8c385f15b03e4c914bde8c569f508ecd6e9a7ccf5ee21d8558ef60097d7d8581c0318ee27f
Malware Config
Extracted
xloader
2.5
r007
trashpandaservice.com
mobileads.network
ascolstore.com
gelsinextra.com
bonestell.net
heitoll.xyz
ceapgis.com
mon-lapin.biz
miq-eva.com
rematedesillas.com
playingonline.xyz
hausense.quest
tnyzw.com
appsdial.com
addcolor.city
hagenoblog.com
michaelwesleyj.com
she-zain.com
lorhsems.com
karmaserena.com
avatarrooms.com
friendsofrythmia.com
hdnhwy.com
firstnightfanfiction.net
vixflow.com
b8ceex.com
generatespeed.com
vaps02.com
climate-crisis.team
saturdaynightl.com
baro-drom.com
talleyresort.com
doctruyenovergeared.com
mogli-designz.info
politiciantunnel.com
housesyrron.com
troibrown.com
go-svetovanje.com
littlebittech.com
totallyglamplans.com
primeusatv.com
leifengping.com
halalfreshdelivery.com
gumbosgeorgetown.com
alittleraeoflight.com
xn--tckybzdtby655a5tj.xyz
wgassllc.xyz
craftandcloud.com
attorneyyochum.com
cryptocourse.one
bloomintegratedwellness.com
partypirateboatrentals.com
chainmio-top.xyz
mrjsloan.com
merryutilityservices.net
zglingbishi.com
wytchbytch.com
michigansharkettes.com
gerizon.net
texcelmed.com
cafe21-3.com
freemovies123.online
ungalfresh.com
sendungs.com
iot-vn.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3472-138-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral2/memory/3472-140-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral2/memory/5052-147-0x0000000000330000-0x000000000035A000-memory.dmp xloader behavioral2/memory/5052-151-0x0000000000330000-0x000000000035A000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.exetmp.execontrol.exedescription pid process target process PID 3280 set thread context of 3472 3280 tmp.exe tmp.exe PID 3472 set thread context of 672 3472 tmp.exe Explorer.EXE PID 5052 set thread context of 672 5052 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
tmp.exetmp.execontrol.exepid process 3280 tmp.exe 3280 tmp.exe 3472 tmp.exe 3472 tmp.exe 3472 tmp.exe 3472 tmp.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe 5052 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 672 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
tmp.execontrol.exepid process 3472 tmp.exe 3472 tmp.exe 3472 tmp.exe 5052 control.exe 5052 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.exetmp.execontrol.exedescription pid process Token: SeDebugPrivilege 3280 tmp.exe Token: SeDebugPrivilege 3472 tmp.exe Token: SeDebugPrivilege 5052 control.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.exeExplorer.EXEcontrol.exedescription pid process target process PID 3280 wrote to memory of 3568 3280 tmp.exe tmp.exe PID 3280 wrote to memory of 3568 3280 tmp.exe tmp.exe PID 3280 wrote to memory of 3568 3280 tmp.exe tmp.exe PID 3280 wrote to memory of 3472 3280 tmp.exe tmp.exe PID 3280 wrote to memory of 3472 3280 tmp.exe tmp.exe PID 3280 wrote to memory of 3472 3280 tmp.exe tmp.exe PID 3280 wrote to memory of 3472 3280 tmp.exe tmp.exe PID 3280 wrote to memory of 3472 3280 tmp.exe tmp.exe PID 3280 wrote to memory of 3472 3280 tmp.exe tmp.exe PID 672 wrote to memory of 5052 672 Explorer.EXE control.exe PID 672 wrote to memory of 5052 672 Explorer.EXE control.exe PID 672 wrote to memory of 5052 672 Explorer.EXE control.exe PID 5052 wrote to memory of 2008 5052 control.exe cmd.exe PID 5052 wrote to memory of 2008 5052 control.exe cmd.exe PID 5052 wrote to memory of 2008 5052 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\tmp.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-152-0x0000000007670000-0x00000000077AD000-memory.dmpFilesize
1.2MB
-
memory/672-150-0x0000000007670000-0x00000000077AD000-memory.dmpFilesize
1.2MB
-
memory/672-143-0x00000000032E0000-0x0000000003415000-memory.dmpFilesize
1.2MB
-
memory/2008-145-0x0000000000000000-mapping.dmp
-
memory/3280-130-0x0000000000310000-0x00000000003CC000-memory.dmpFilesize
752KB
-
memory/3280-131-0x00000000052B0000-0x0000000005854000-memory.dmpFilesize
5.6MB
-
memory/3280-132-0x0000000004D00000-0x0000000004D92000-memory.dmpFilesize
584KB
-
memory/3280-133-0x0000000004DA0000-0x0000000004E3C000-memory.dmpFilesize
624KB
-
memory/3280-134-0x0000000004C40000-0x0000000004C4A000-memory.dmpFilesize
40KB
-
memory/3280-135-0x00000000088F0000-0x0000000008956000-memory.dmpFilesize
408KB
-
memory/3472-140-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3472-142-0x0000000001290000-0x00000000012A1000-memory.dmpFilesize
68KB
-
memory/3472-141-0x00000000015D0000-0x000000000191A000-memory.dmpFilesize
3.3MB
-
memory/3472-138-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3472-137-0x0000000000000000-mapping.dmp
-
memory/3568-136-0x0000000000000000-mapping.dmp
-
memory/5052-144-0x0000000000000000-mapping.dmp
-
memory/5052-147-0x0000000000330000-0x000000000035A000-memory.dmpFilesize
168KB
-
memory/5052-146-0x0000000000110000-0x0000000000137000-memory.dmpFilesize
156KB
-
memory/5052-148-0x0000000002550000-0x000000000289A000-memory.dmpFilesize
3.3MB
-
memory/5052-149-0x0000000002330000-0x00000000023C0000-memory.dmpFilesize
576KB
-
memory/5052-151-0x0000000000330000-0x000000000035A000-memory.dmpFilesize
168KB