Malware Analysis Report

2025-08-10 19:20

Sample ID 220616-ltyb1agch7
Target 9bc5c6036ca20d7e42e756b6220094eb
SHA256 23b7b5e8cce52ca62e02db1f7f46ac92a0194ab2450253287a37c8dc42b7c92a
Tags
xloader a2es loader persistence rat suricata
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

23b7b5e8cce52ca62e02db1f7f46ac92a0194ab2450253287a37c8dc42b7c92a

Threat Level: Known bad

The file 9bc5c6036ca20d7e42e756b6220094eb was found to be: Known bad.

Malicious Activity Summary

xloader a2es loader persistence rat suricata

suricata: ET MALWARE FormBook CnC Checkin (GET)

Xloader

Xloader Payload

Deletes itself

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Checks processor information in registry

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of WriteProcessMemory

Modifies Internet Explorer settings

Suspicious behavior: MapViewOfSection

Suspicious use of FindShellTrayWindow

Gathers network information

Suspicious use of SendNotifyMessage

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-06-16 09:50

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-06-16 09:50

Reported

2022-06-16 09:54

Platform

win7-20220414-en

Max time kernel

147s

Max time network

152s

Command Line

C:\Windows\Explorer.EXE

Signatures

Xloader

loader xloader

suricata: ET MALWARE FormBook CnC Checkin (GET)

suricata

Xloader Payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\TRZX0NNHW8 = "C:\\Program Files (x86)\\Al4nhgbh\\ThumbCachebbc.exe" C:\Windows\SysWOW64\svchost.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Al4nhgbh\ThumbCachebbc.exe C:\Windows\SysWOW64\svchost.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \Registry\User\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\svchost.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 780 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 780 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 780 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 780 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 780 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 780 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 780 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 1528 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Windows\SysWOW64\svchost.exe
PID 1528 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Windows\SysWOW64\svchost.exe
PID 1528 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Windows\SysWOW64\svchost.exe
PID 1528 wrote to memory of 476 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Windows\SysWOW64\svchost.exe
PID 476 wrote to memory of 516 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 476 wrote to memory of 516 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 476 wrote to memory of 516 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 476 wrote to memory of 516 N/A C:\Windows\SysWOW64\svchost.exe C:\Windows\SysWOW64\cmd.exe
PID 476 wrote to memory of 1156 N/A C:\Windows\SysWOW64\svchost.exe C:\Program Files\Mozilla Firefox\Firefox.exe
PID 476 wrote to memory of 1156 N/A C:\Windows\SysWOW64\svchost.exe C:\Program Files\Mozilla Firefox\Firefox.exe
PID 476 wrote to memory of 1156 N/A C:\Windows\SysWOW64\svchost.exe C:\Program Files\Mozilla Firefox\Firefox.exe
PID 476 wrote to memory of 1156 N/A C:\Windows\SysWOW64\svchost.exe C:\Program Files\Mozilla Firefox\Firefox.exe
PID 476 wrote to memory of 1156 N/A C:\Windows\SysWOW64\svchost.exe C:\Program Files\Mozilla Firefox\Firefox.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe

"C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"

C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe

"C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Windows\SysWOW64\svchost.exe"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"

C:\Program Files\Mozilla Firefox\Firefox.exe

"C:\Program Files\Mozilla Firefox\Firefox.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.angolettomc.com udp
GB 85.202.160.143:80 www.angolettomc.com tcp
US 8.8.8.8:53 www.berendsit.com udp
US 69.57.161.110:80 www.berendsit.com tcp
US 8.8.8.8:53 www.datisbrick.com udp
FR 178.32.107.120:80 www.datisbrick.com tcp
FR 178.32.107.120:80 www.datisbrick.com tcp
US 8.8.8.8:53 www.diamont-services.com udp
DE 46.4.250.97:80 www.diamont-services.com tcp
DE 46.4.250.97:80 www.diamont-services.com tcp
US 8.8.8.8:53 www.tvmountinstallguy.com udp
US 74.208.236.209:80 www.tvmountinstallguy.com tcp
US 74.208.236.209:80 www.tvmountinstallguy.com tcp
US 8.8.8.8:53 www.tebrunk.com udp
US 104.18.129.14:80 www.tebrunk.com tcp
US 104.18.129.14:80 www.tebrunk.com tcp
US 8.8.8.8:53 www.0xauetw0ye50f.xyz udp
US 8.8.8.8:53 www.albertoalaniz.space udp
US 162.210.102.230:80 www.albertoalaniz.space tcp
US 162.210.102.230:80 www.albertoalaniz.space tcp
US 8.8.8.8:53 www.chounvwd.com udp
US 108.62.20.246:80 www.chounvwd.com tcp
US 108.62.20.246:80 www.chounvwd.com tcp
US 8.8.8.8:53 www.klapia.online udp
ES 31.214.178.54:80 www.klapia.online tcp
ES 31.214.178.54:80 www.klapia.online tcp

Files

memory/780-54-0x0000000000FE0000-0x000000000108A000-memory.dmp

memory/780-55-0x0000000074E91000-0x0000000074E93000-memory.dmp

memory/780-56-0x00000000004D0000-0x00000000004E2000-memory.dmp

memory/780-57-0x00000000074A0000-0x000000000752E000-memory.dmp

memory/780-58-0x00000000006F0000-0x00000000006F6000-memory.dmp

memory/780-59-0x0000000000700000-0x0000000000732000-memory.dmp

memory/1528-60-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1528-61-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1528-63-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1528-64-0x000000000041F2B0-mapping.dmp

memory/1528-66-0x0000000000400000-0x000000000042B000-memory.dmp

memory/1528-67-0x00000000008E0000-0x0000000000BE3000-memory.dmp

memory/1288-69-0x0000000004830000-0x00000000048F3000-memory.dmp

memory/1528-68-0x0000000000290000-0x00000000002A1000-memory.dmp

memory/1528-71-0x0000000000320000-0x0000000000331000-memory.dmp

memory/1288-72-0x00000000068F0000-0x0000000006A20000-memory.dmp

memory/476-73-0x0000000000000000-mapping.dmp

memory/1528-74-0x0000000000400000-0x000000000042B000-memory.dmp

memory/516-75-0x0000000000000000-mapping.dmp

memory/476-76-0x00000000008E0000-0x00000000008E8000-memory.dmp

memory/476-77-0x00000000008F0000-0x0000000000BF3000-memory.dmp

memory/476-78-0x0000000000080000-0x00000000000AB000-memory.dmp

memory/476-79-0x00000000005C0000-0x0000000000650000-memory.dmp

memory/1288-80-0x0000000006D00000-0x0000000006E71000-memory.dmp

memory/476-81-0x0000000000080000-0x00000000000AB000-memory.dmp

memory/1288-83-0x0000000006D00000-0x0000000006E71000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-06-16 09:50

Reported

2022-06-16 09:56

Platform

win10v2004-20220414-en

Max time kernel

166s

Max time network

222s

Command Line

C:\Windows\Explorer.EXE

Signatures

Xloader

loader xloader

suricata: ET MALWARE FormBook CnC Checkin (GET)

suricata

Xloader Payload

rat
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\ipconfig.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\N0XTI4Q8V = "C:\\Program Files (x86)\\Vjlkd\\xxll2v90gzg4yfnh.exe" C:\Windows\SysWOW64\ipconfig.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1000 set thread context of 2388 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 2388 set thread context of 3152 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Windows\Explorer.EXE
PID 3864 set thread context of 3152 N/A C:\Windows\SysWOW64\ipconfig.exe C:\Windows\Explorer.EXE

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Vjlkd\xxll2v90gzg4yfnh.exe C:\Windows\SysWOW64\ipconfig.exe N/A

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \Registry\User\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 C:\Windows\SysWOW64\ipconfig.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A
N/A N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Windows\Explorer.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\ipconfig.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 1000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 1000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 1000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 1000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 1000 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
PID 3152 wrote to memory of 3864 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\ipconfig.exe
PID 3152 wrote to memory of 3864 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\ipconfig.exe
PID 3152 wrote to memory of 3864 N/A C:\Windows\Explorer.EXE C:\Windows\SysWOW64\ipconfig.exe
PID 3864 wrote to memory of 4124 N/A C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\cmd.exe
PID 3864 wrote to memory of 4124 N/A C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\cmd.exe
PID 3864 wrote to memory of 4124 N/A C:\Windows\SysWOW64\ipconfig.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\Explorer.EXE

C:\Windows\Explorer.EXE

C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe

"C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"

C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe

"C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"

C:\Windows\SysWOW64\ipconfig.exe

"C:\Windows\SysWOW64\ipconfig.exe"

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"

Network

Country Destination Domain Proto
US 20.189.173.14:443 tcp
IE 20.54.89.15:443 tcp
US 8.8.8.8:53 97.97.242.52.in-addr.arpa udp
US 8.8.8.8:53 9.9.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.3.0.4.0.0.3.0.1.3.0.6.2.ip6.arpa udp
US 8.8.8.8:53 www.ifeelsilky.com udp
CA 23.227.38.74:80 www.ifeelsilky.com tcp
US 8.8.8.8:53 www.ifeelsilky.com udp
US 8.8.8.8:53 www.ckhla.com udp
DE 3.64.163.50:80 www.ckhla.com tcp
CA 23.227.38.74:80 www.ifeelsilky.com tcp
US 8.8.8.8:53 www.jmigy.com udp
US 8.8.8.8:53 ifeelsilky.com udp
CA 23.227.38.65:443 ifeelsilky.com tcp
US 8.8.8.8:53 www.precisionspinecolorado.com udp
US 165.214.40.39:80 www.precisionspinecolorado.com tcp
US 8.8.8.8:53 www.katescakesandcreations.com udp
US 103.224.212.221:80 www.katescakesandcreations.com tcp
US 8.8.8.8:53 www.criatorioimperial.online udp
US 8.8.8.8:53 www.tvmountinstallguy.com udp
US 74.208.236.209:80 www.tvmountinstallguy.com tcp
US 8.8.8.8:53 www.berendsit.com udp
US 69.57.161.110:80 www.berendsit.com tcp

Files

memory/1000-130-0x00000000004F0000-0x000000000059A000-memory.dmp

memory/1000-131-0x00000000079B0000-0x0000000007F54000-memory.dmp

memory/1000-132-0x00000000074A0000-0x0000000007532000-memory.dmp

memory/1000-133-0x0000000007400000-0x000000000740A000-memory.dmp

memory/1000-134-0x000000000AD40000-0x000000000ADDC000-memory.dmp

memory/1000-135-0x000000000B170000-0x000000000B1D6000-memory.dmp

memory/2388-136-0x0000000000000000-mapping.dmp

memory/2388-137-0x0000000000400000-0x000000000042B000-memory.dmp

memory/2388-140-0x00000000015B0000-0x00000000015C1000-memory.dmp

memory/2388-139-0x00000000016F0000-0x0000000001A3A000-memory.dmp

memory/3152-141-0x00000000086A0000-0x0000000008832000-memory.dmp

memory/3864-142-0x0000000000000000-mapping.dmp

memory/2388-143-0x0000000000400000-0x000000000042B000-memory.dmp

memory/3864-144-0x0000000000620000-0x000000000062B000-memory.dmp

memory/3864-147-0x0000000001930000-0x0000000001C7A000-memory.dmp

memory/4124-146-0x0000000000000000-mapping.dmp

memory/3864-145-0x0000000001240000-0x000000000126B000-memory.dmp

memory/3152-148-0x00000000086A0000-0x0000000008832000-memory.dmp

memory/3864-149-0x0000000001830000-0x00000000018C0000-memory.dmp

memory/3152-150-0x0000000008940000-0x0000000008A47000-memory.dmp

memory/3864-151-0x0000000001240000-0x000000000126B000-memory.dmp

memory/3152-152-0x0000000008940000-0x0000000008A47000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2022-06-16 09:50

Reported

2022-06-16 09:56

Platform

win7-20220414-en

Max time kernel

153s

Max time network

45s

Command Line

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060126_SUR.pdf"

Signatures

Processes

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060126_SUR.pdf"

Network

N/A

Files

memory/1104-54-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2022-06-16 09:50

Reported

2022-06-16 09:54

Platform

win10v2004-20220414-en

Max time kernel

158s

Max time network

172s

Command Line

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060126_SUR.pdf"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 432 wrote to memory of 4740 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 4740 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 4740 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 3672 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 3672 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 3672 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 4804 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 4804 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 4804 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 4508 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 4508 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 4508 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 4516 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 4516 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 4516 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 928 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 928 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 928 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
PID 432 wrote to memory of 3980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
PID 432 wrote to memory of 3980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
PID 432 wrote to memory of 3980 N/A C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
PID 3980 wrote to memory of 2260 N/A C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
PID 3980 wrote to memory of 2260 N/A C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
PID 3980 wrote to memory of 2260 N/A C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe

Processes

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060126_SUR.pdf"

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:3

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe

"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"

Network

Country Destination Domain Proto
US 13.89.178.26:443 tcp
US 8.253.208.112:80 tcp
US 8.253.208.112:80 tcp
US 8.253.208.112:80 tcp

Files

memory/4740-130-0x0000000000000000-mapping.dmp

memory/3672-131-0x0000000000000000-mapping.dmp

memory/4804-132-0x0000000000000000-mapping.dmp

memory/4508-133-0x0000000000000000-mapping.dmp

memory/4516-134-0x0000000000000000-mapping.dmp

memory/928-135-0x0000000000000000-mapping.dmp

memory/3980-136-0x0000000000000000-mapping.dmp

memory/2260-137-0x0000000000000000-mapping.dmp