Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 09:08
Static task
static1
Behavioral task
behavioral1
Sample
kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe
Resource
win10v2004-20220414-en
General
-
Target
kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe
-
Size
382KB
-
MD5
69c60f14117c4a3440b945c28dcff034
-
SHA1
1891b961eb682ba5fbe8e2be9bb0a5c748c73cfc
-
SHA256
89ce5deea4986b1d484b34bee77c58899dab5ce01c8f62b9ac2ca8e9bbed79bd
-
SHA512
0b8f798757f1ab70430db150d6c2251484f25c7bed52bab32ddcc12adb2a41930c420e4eda194dd980af99012c9315b085eb5eb24d04f3059f2259241eaa9ee0
Malware Config
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4420-132-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/4420-138-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/2368-141-0x0000000000810000-0x000000000083C000-memory.dmp xloader behavioral2/memory/2368-145-0x0000000000810000-0x000000000083C000-memory.dmp xloader -
Executes dropped EXE 1 IoCs
Processes:
s0sdana8apxxm.exepid process 1004 s0sdana8apxxm.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HHLXV4Q810 = "C:\\Program Files (x86)\\D5ji4w\\s0sdana8apxxm.exe" msiexec.exe Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
kargonuzu doğrulayın_07052022-Ref_#1326425139484.execvtres.exemsiexec.exedescription pid process target process PID 1524 set thread context of 4420 1524 kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe cvtres.exe PID 4420 set thread context of 3136 4420 cvtres.exe Explorer.EXE PID 2368 set thread context of 3136 2368 msiexec.exe Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
msiexec.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\D5ji4w\s0sdana8apxxm.exe msiexec.exe File opened for modification C:\Program Files (x86)\D5ji4w Explorer.EXE File created C:\Program Files (x86)\D5ji4w\s0sdana8apxxm.exe Explorer.EXE File opened for modification C:\Program Files (x86)\D5ji4w\s0sdana8apxxm.exe Explorer.EXE -
Processes:
msiexec.exedescription ioc process Key created \Registry\User\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Modifies registry class 3 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
cvtres.exemsiexec.exepid process 4420 cvtres.exe 4420 cvtres.exe 4420 cvtres.exe 4420 cvtres.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3136 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
cvtres.exemsiexec.exepid process 4420 cvtres.exe 4420 cvtres.exe 4420 cvtres.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe 2368 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
cvtres.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4420 cvtres.exe Token: SeDebugPrivilege 2368 msiexec.exe Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE Token: SeShutdownPrivilege 3136 Explorer.EXE Token: SeCreatePagefilePrivilege 3136 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 3136 Explorer.EXE 3136 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
kargonuzu doğrulayın_07052022-Ref_#1326425139484.exeExplorer.EXEmsiexec.exedescription pid process target process PID 1524 wrote to memory of 4420 1524 kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe cvtres.exe PID 1524 wrote to memory of 4420 1524 kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe cvtres.exe PID 1524 wrote to memory of 4420 1524 kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe cvtres.exe PID 1524 wrote to memory of 4420 1524 kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe cvtres.exe PID 1524 wrote to memory of 4420 1524 kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe cvtres.exe PID 1524 wrote to memory of 4420 1524 kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe cvtres.exe PID 3136 wrote to memory of 2368 3136 Explorer.EXE msiexec.exe PID 3136 wrote to memory of 2368 3136 Explorer.EXE msiexec.exe PID 3136 wrote to memory of 2368 3136 Explorer.EXE msiexec.exe PID 2368 wrote to memory of 4872 2368 msiexec.exe cmd.exe PID 2368 wrote to memory of 4872 2368 msiexec.exe cmd.exe PID 2368 wrote to memory of 4872 2368 msiexec.exe cmd.exe PID 2368 wrote to memory of 4832 2368 msiexec.exe Firefox.exe PID 2368 wrote to memory of 4832 2368 msiexec.exe Firefox.exe PID 2368 wrote to memory of 4832 2368 msiexec.exe Firefox.exe PID 3136 wrote to memory of 1004 3136 Explorer.EXE s0sdana8apxxm.exe PID 3136 wrote to memory of 1004 3136 Explorer.EXE s0sdana8apxxm.exe PID 3136 wrote to memory of 1004 3136 Explorer.EXE s0sdana8apxxm.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe"C:\Users\Admin\AppData\Local\Temp\kargonuzu doğrulayın_07052022-Ref_#1326425139484.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\D5ji4w\s0sdana8apxxm.exe"C:\Program Files (x86)\D5ji4w\s0sdana8apxxm.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\D5ji4w\s0sdana8apxxm.exeFilesize
45KB
MD570d838a7dc5b359c3f938a71fad77db0
SHA166b83eb16481c334719eed406bc58a3c2b910923
SHA256e4dbdbf7888ea96f3f8aa5c4c7f2bcf6e57d724dd8194fe5f35b673c6ef724ea
SHA5129c9a945db5b5e7ff8105bfe74578e6f00b5f707f7c3d8f1f1fb41553a6d0eab29cef026e77877a1ad6435fa7bc369141921442e1485f2b0894c6bbcbd7791034
-
C:\Program Files (x86)\D5ji4w\s0sdana8apxxm.exeFilesize
45KB
MD570d838a7dc5b359c3f938a71fad77db0
SHA166b83eb16481c334719eed406bc58a3c2b910923
SHA256e4dbdbf7888ea96f3f8aa5c4c7f2bcf6e57d724dd8194fe5f35b673c6ef724ea
SHA5129c9a945db5b5e7ff8105bfe74578e6f00b5f707f7c3d8f1f1fb41553a6d0eab29cef026e77877a1ad6435fa7bc369141921442e1485f2b0894c6bbcbd7791034
-
memory/1004-147-0x0000000000000000-mapping.dmp
-
memory/1524-130-0x0000000000800000-0x0000000000862000-memory.dmpFilesize
392KB
-
memory/2368-137-0x0000000000000000-mapping.dmp
-
memory/2368-145-0x0000000000810000-0x000000000083C000-memory.dmpFilesize
176KB
-
memory/2368-141-0x0000000000810000-0x000000000083C000-memory.dmpFilesize
176KB
-
memory/2368-140-0x0000000000490000-0x00000000004A2000-memory.dmpFilesize
72KB
-
memory/2368-142-0x0000000002710000-0x0000000002A5A000-memory.dmpFilesize
3.3MB
-
memory/2368-143-0x0000000002540000-0x00000000025D0000-memory.dmpFilesize
576KB
-
memory/3136-136-0x0000000008660000-0x0000000008768000-memory.dmpFilesize
1.0MB
-
memory/3136-144-0x0000000008A40000-0x0000000008B7D000-memory.dmpFilesize
1.2MB
-
memory/3136-146-0x0000000008A40000-0x0000000008B7D000-memory.dmpFilesize
1.2MB
-
memory/4420-135-0x0000000001520000-0x0000000001531000-memory.dmpFilesize
68KB
-
memory/4420-138-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4420-134-0x00000000019E0000-0x0000000001D2A000-memory.dmpFilesize
3.3MB
-
memory/4420-132-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/4420-131-0x0000000000000000-mapping.dmp
-
memory/4872-139-0x0000000000000000-mapping.dmp