Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-06-2022 19:49
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
302KB
-
MD5
0236dcc27cfb3d09325c976002567985
-
SHA1
e1605510f182a0c6f8d3297355d9ceb00489df7c
-
SHA256
e640ade723ba4aa48f63db4293d15b61c07c05bfdd93a3a0f83f4a177306b87d
-
SHA512
512d6736ced5df8022ff26e1581f2ee7dfcef0f10c3b2e5324ac7ba16cee52f1db687a5921e8c72edc7d32a9467b161dc966c4f34f16d4ea13003e1f1f899081
Malware Config
Extracted
xloader
2.6
vweq
malang-media.com
mrsfence.com
lubetops.com
aitimedia.net
montecryptocapital.com
ahwmedia.com
bvmnc.site
bggearstore.com
bcsantacoloma.online
alltimephotography.com
santacruz-roofings.com
leaplifestyleenterprises.com
censovet.com
similkameenfarms.com
undisclosed.email
thetrinityco.com
rapiturs.com
jedlersdorf.info
mh7jk12e.xyz
flygurlblogwordpress.com
goodbaddesign.com
equipmentrentalpartyplus.com
ohyoutube.com
projetoarvore.com
2379.flights
implemedescribed.com
kreasinesia.com
ownitoffice.com
fortekofteacizyemeknerde.store
my-wh-webproject.com
518499.com
naples-us.com
tlrohio.com
kanchava.com
lcloudfindin.com
cybermatrix.tech
i6lqi.xyz
ebay-online-selling-24.com
afrisectelecoms.com
tiantian997.xyz
strategyvenues.com
marketnear.watch
thebrooklynyogi.com
sonikbuilder.online
voyagesconsulting.com
ledgel0ungers.com
youhadtobethere.biz
disabled-long.com
dental-implants-encounter.life
zydssq.com
livingwell.green
doumao334.xyz
moodysoot.online
licos.xyz
maqitashop.com
doroos.online
laikemiao.com
petrolverse.xyz
apostolicpraise.net
todaychance.com
helightville.com
st-john-fisher-school.com
agwly.com
dashop.pro
zxc3426.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/272-59-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/272-60-0x000000000041F280-mapping.dmp xloader behavioral1/memory/272-62-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1564-68-0x00000000000C0000-0x00000000000EB000-memory.dmp xloader behavioral1/memory/1564-72-0x00000000000C0000-0x00000000000EB000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.execvtres.exesystray.exedescription pid process target process PID 976 set thread context of 272 976 tmp.exe cvtres.exe PID 272 set thread context of 1292 272 cvtres.exe Explorer.EXE PID 1564 set thread context of 1292 1564 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
cvtres.exesystray.exepid process 272 cvtres.exe 272 cvtres.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe 1564 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cvtres.exesystray.exepid process 272 cvtres.exe 272 cvtres.exe 272 cvtres.exe 1564 systray.exe 1564 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.execvtres.exesystray.exedescription pid process Token: SeDebugPrivilege 976 tmp.exe Token: SeDebugPrivilege 272 cvtres.exe Token: SeDebugPrivilege 1564 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
tmp.exeExplorer.EXEdescription pid process target process PID 976 wrote to memory of 272 976 tmp.exe cvtres.exe PID 976 wrote to memory of 272 976 tmp.exe cvtres.exe PID 976 wrote to memory of 272 976 tmp.exe cvtres.exe PID 976 wrote to memory of 272 976 tmp.exe cvtres.exe PID 976 wrote to memory of 272 976 tmp.exe cvtres.exe PID 976 wrote to memory of 272 976 tmp.exe cvtres.exe PID 976 wrote to memory of 272 976 tmp.exe cvtres.exe PID 1292 wrote to memory of 1564 1292 Explorer.EXE systray.exe PID 1292 wrote to memory of 1564 1292 Explorer.EXE systray.exe PID 1292 wrote to memory of 1564 1292 Explorer.EXE systray.exe PID 1292 wrote to memory of 1564 1292 Explorer.EXE systray.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/272-64-0x0000000000230000-0x0000000000241000-memory.dmpFilesize
68KB
-
memory/272-57-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/272-59-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/272-56-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/272-60-0x000000000041F280-mapping.dmp
-
memory/272-62-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/272-63-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/976-55-0x0000000000270000-0x00000000002A4000-memory.dmpFilesize
208KB
-
memory/976-54-0x00000000008F0000-0x0000000000942000-memory.dmpFilesize
328KB
-
memory/1292-65-0x0000000006C00000-0x0000000006DA4000-memory.dmpFilesize
1.6MB
-
memory/1292-71-0x0000000003C20000-0x0000000003CBF000-memory.dmpFilesize
636KB
-
memory/1292-73-0x0000000003C20000-0x0000000003CBF000-memory.dmpFilesize
636KB
-
memory/1564-66-0x0000000000000000-mapping.dmp
-
memory/1564-67-0x0000000000280000-0x0000000000285000-memory.dmpFilesize
20KB
-
memory/1564-68-0x00000000000C0000-0x00000000000EB000-memory.dmpFilesize
172KB
-
memory/1564-69-0x0000000001F70000-0x0000000002273000-memory.dmpFilesize
3.0MB
-
memory/1564-70-0x0000000001D30000-0x0000000001DC0000-memory.dmpFilesize
576KB
-
memory/1564-72-0x00000000000C0000-0x00000000000EB000-memory.dmpFilesize
172KB
-
memory/1564-74-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB