Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/06/2022, 07:02
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
- Target tmp.exe
- Size 561KB
- Sample220621-httf9sedb6
- SHA256 38134fe55100f4b90d1522f444547f670c8e197754d84ec0c83fe22bc352c22e
- MD5 ca6d72983949be70d6aa4517a6b68860
- SHA1 8758f924b08fae4c5d7025724f96034bb188b4bf
- SHA512 8d5e7957e5c55c6debf612ed0d04681a681f21d5a5cd77d3fc314ff790e5c2e8aaae24d16524e89014b0ef97c6464b84018c3e88bb6bd541511728b691729f1d
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.6
Campaign
-
nq06
Decoy
-
theoshoverseer.com
-
p62q55a6.xyz
-
patriottease.top
-
lipintong.xyz
-
acinstallationamc.services
-
colinoccam.com
-
54stanleyaveunit1.com
-
penggacoranbluebird.com
-
999888000.com
-
mykidschoice.net
-
tjxjlk.online
-
lhab.xyz
-
businesscoach.info
-
halsupduck.website
-
sibutra.club
-
deepinthebayou.com
-
bigiiz.com
-
passthrubrokerage.com
-
metaprideland.xyz
-
yopalab.com
-
aidacoachingservices.com
-
findingfreedomonline.com
-
produckpink.com
-
sivlebot.com
-
gruppoagritalia.com
-
8t3w6g.xyz
-
7thcd.com
-
8400segolily.com
-
usppackage.com
-
varted.life
-
madesimple.website
-
maternity-facts.com
-
lazuardi-travel.com
-
axinfnitybot.club
-
sunage.info
-
upstairsdaddy.com
-
hoo-doo-bangin.com
-
concreteninjas.biz
-
yichyun.com
-
viewlyrics.xyz
-
riversideinnclassic.com
-
villapelagiaseaview.com
-
geoff17.com
-
dqopu.com
-
kisipoltvideok.com
-
rapiturs.com
-
frauenlounge.com
-
91fuhe.com
-
izmirbioklimatikpergola.com
-
deearna.com
-
dulcetextil.com
-
datoulucai.com
-
well2cook.com
-
banknotesubscription.top
-
hs6ly.fyi
-
resuurect.com
-
xn--crtirazonandodeisy-iyb.com
-
carinsurancebuddy.info
-
lidergaraj.online
-
mulletdaddy.com
-
9k8y.com
-
advertising-datadelicacies.com
-
401kdox.com
-
ayerstitleservice.com
-
polis.cloud
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 4 IoCs
resource yara_rule behavioral2/memory/4200-133-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/4200-139-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/5104-142-0x0000000000690000-0x00000000006BB000-memory.dmp xloader behavioral2/memory/5104-144-0x0000000000690000-0x00000000006BB000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2576 set thread context of 4200 2576 tmp.exe 85 PID 4200 set thread context of 3168 4200 ktmutil.exe 44 PID 5104 set thread context of 3168 5104 msdt.exe 44 - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2576 tmp.exe 2576 tmp.exe 2576 tmp.exe 2576 tmp.exe 2576 tmp.exe 2576 tmp.exe 2576 tmp.exe 2576 tmp.exe 4200 ktmutil.exe 4200 ktmutil.exe 4200 ktmutil.exe 4200 ktmutil.exe 2576 tmp.exe 2576 tmp.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe 5104 msdt.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3168 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4200 ktmutil.exe 4200 ktmutil.exe 4200 ktmutil.exe 5104 msdt.exe 5104 msdt.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 2576 tmp.exe Token: SeDebugPrivilege 4200 ktmutil.exe Token: SeShutdownPrivilege 3168 Explorer.EXE Token: SeCreatePagefilePrivilege 3168 Explorer.EXE Token: SeShutdownPrivilege 3168 Explorer.EXE Token: SeCreatePagefilePrivilege 3168 Explorer.EXE Token: SeDebugPrivilege 5104 msdt.exe Token: SeShutdownPrivilege 3168 Explorer.EXE Token: SeCreatePagefilePrivilege 3168 Explorer.EXE - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3168 Explorer.EXE 3168 Explorer.EXE - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2576 wrote to memory of 4200 2576 tmp.exe 85 PID 2576 wrote to memory of 4200 2576 tmp.exe 85 PID 2576 wrote to memory of 4200 2576 tmp.exe 85 PID 2576 wrote to memory of 4200 2576 tmp.exe 85 PID 2576 wrote to memory of 4200 2576 tmp.exe 85 PID 2576 wrote to memory of 4200 2576 tmp.exe 85 PID 2576 wrote to memory of 4200 2576 tmp.exe 85 PID 3168 wrote to memory of 5104 3168 Explorer.EXE 86 PID 3168 wrote to memory of 5104 3168 Explorer.EXE 86 PID 3168 wrote to memory of 5104 3168 Explorer.EXE 86 PID 5104 wrote to memory of 4104 5104 msdt.exe 88 PID 5104 wrote to memory of 4104 5104 msdt.exe 88 PID 5104 wrote to memory of 4104 5104 msdt.exe 88
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\ktmutil.exe"C:\Windows\SysWOW64\ktmutil.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4200
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\ktmutil.exe"3⤵PID:4104
-
-