Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 12:18
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
270KB
-
MD5
40292541a586f5c7e2af4f0b5efde77c
-
SHA1
4fc8c817e38575a5427fdd2741abf20fc9fb3365
-
SHA256
0dbc37565a20d8e5d40c4c554a194719291bc91ab86db587337b580106f41cb8
-
SHA512
ceb7888d6a1a94f898f9fb3e44db01574256e59e7690238384fcc853b55553089d2fbf221b179b5cf4baaa54bc6f58ad3db3b36dc747170d10209f4fa4339091
Malware Config
Extracted
xloader
2.6
uajq
pixeldoughnut.com
amadeushosting.com
sitecindustrial.com
orsaigroup.com
jmuse-dev.com
angelobreviario.com
storesafe.xyz
40veryoung.com
65228267.com
xmpanshi.com
luxorscbd.com
saoirsia.com
akwadcom.com
spreast.com
net-empresa12pcs.com
avlaoge1.com
projectmuellerllc.com
hvelv.com
a2bproject.com
myhome-huahin.com
beautzenvibes.com
tzssdaayaqa.top
corporatexxx.com
sc-server-meshing.info
breadandsaltmarket.com
dac-nh.com
middleeastsecuritywatch.com
fox-influ.com
mndhestro.biz
voipverse.xyz
enrollee-healthbenconstest.com
peteinson.com
genevapunkska.com
tjysdxx.com
7t4zllco.com
healthypostureclub.fitness
npto3jzh.com
hd0b3oke2q90gz.xyz
thepeachcommission.com
duniabidan.com
ffmembership-garera.com
landllumber.site
bangimpromptu.com
visionboysnft.com
smonique.com
woomart.store
bathholidayhome.com
oci.fyi
lfla.agency
buymms1.com
uurdrzk.xyz
taliamagee.com
melishe.com
worthmoth.com
hotelnamastenepal.com
talmagart.com
ruomot.com
bitcoinodyssey.com
ezzahfatima.com
massthetics.net
yearningearningwithyoussef.com
winhcatraining.com
baunfn.online
estress.online
researchwhiz.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1768-58-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1768-59-0x000000000041F2A0-mapping.dmp xloader behavioral1/memory/1768-61-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1768-69-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/964-73-0x0000000000080000-0x00000000000AB000-memory.dmp xloader behavioral1/memory/964-76-0x0000000000080000-0x00000000000AB000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wininit.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HRTXNPYPTL = "C:\\Program Files (x86)\\Inz7dbbv\\vga1bgd.exe" wininit.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
tmp.execvtres.exewininit.exedescription pid process target process PID 2044 set thread context of 1768 2044 tmp.exe cvtres.exe PID 1768 set thread context of 1256 1768 cvtres.exe Explorer.EXE PID 1768 set thread context of 1256 1768 cvtres.exe Explorer.EXE PID 964 set thread context of 1256 964 wininit.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
wininit.exedescription ioc process File opened for modification C:\Program Files (x86)\Inz7dbbv\vga1bgd.exe wininit.exe -
Processes:
wininit.exedescription ioc process Key created \Registry\User\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wininit.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
cvtres.exewininit.exepid process 1768 cvtres.exe 1768 cvtres.exe 1768 cvtres.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
cvtres.exewininit.exepid process 1768 cvtres.exe 1768 cvtres.exe 1768 cvtres.exe 1768 cvtres.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe 964 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.execvtres.exewininit.exedescription pid process Token: SeDebugPrivilege 2044 tmp.exe Token: SeDebugPrivilege 1768 cvtres.exe Token: SeDebugPrivilege 964 wininit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
tmp.execvtres.exewininit.exedescription pid process target process PID 2044 wrote to memory of 1768 2044 tmp.exe cvtres.exe PID 2044 wrote to memory of 1768 2044 tmp.exe cvtres.exe PID 2044 wrote to memory of 1768 2044 tmp.exe cvtres.exe PID 2044 wrote to memory of 1768 2044 tmp.exe cvtres.exe PID 2044 wrote to memory of 1768 2044 tmp.exe cvtres.exe PID 2044 wrote to memory of 1768 2044 tmp.exe cvtres.exe PID 2044 wrote to memory of 1768 2044 tmp.exe cvtres.exe PID 1768 wrote to memory of 964 1768 cvtres.exe wininit.exe PID 1768 wrote to memory of 964 1768 cvtres.exe wininit.exe PID 1768 wrote to memory of 964 1768 cvtres.exe wininit.exe PID 1768 wrote to memory of 964 1768 cvtres.exe wininit.exe PID 964 wrote to memory of 1812 964 wininit.exe cmd.exe PID 964 wrote to memory of 1812 964 wininit.exe cmd.exe PID 964 wrote to memory of 1812 964 wininit.exe cmd.exe PID 964 wrote to memory of 1812 964 wininit.exe cmd.exe PID 964 wrote to memory of 688 964 wininit.exe Firefox.exe PID 964 wrote to memory of 688 964 wininit.exe Firefox.exe PID 964 wrote to memory of 688 964 wininit.exe Firefox.exe PID 964 wrote to memory of 688 964 wininit.exe Firefox.exe PID 964 wrote to memory of 688 964 wininit.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"4⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"5⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/964-68-0x0000000000000000-mapping.dmp
-
memory/964-78-0x0000000075841000-0x0000000075843000-memory.dmpFilesize
8KB
-
memory/964-76-0x0000000000080000-0x00000000000AB000-memory.dmpFilesize
172KB
-
memory/964-74-0x0000000000800000-0x0000000000890000-memory.dmpFilesize
576KB
-
memory/964-73-0x0000000000080000-0x00000000000AB000-memory.dmpFilesize
172KB
-
memory/964-72-0x0000000001E90000-0x0000000002193000-memory.dmpFilesize
3.0MB
-
memory/964-71-0x0000000000A70000-0x0000000000A8A000-memory.dmpFilesize
104KB
-
memory/1256-67-0x00000000060D0000-0x0000000006211000-memory.dmpFilesize
1.3MB
-
memory/1256-64-0x0000000005F80000-0x00000000060C6000-memory.dmpFilesize
1.3MB
-
memory/1256-77-0x0000000006220000-0x000000000636C000-memory.dmpFilesize
1.3MB
-
memory/1256-75-0x0000000006220000-0x000000000636C000-memory.dmpFilesize
1.3MB
-
memory/1768-62-0x0000000000820000-0x0000000000B23000-memory.dmpFilesize
3.0MB
-
memory/1768-69-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1768-63-0x0000000000200000-0x0000000000211000-memory.dmpFilesize
68KB
-
memory/1768-61-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1768-59-0x000000000041F2A0-mapping.dmp
-
memory/1768-58-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1768-56-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1768-66-0x0000000000360000-0x0000000000371000-memory.dmpFilesize
68KB
-
memory/1768-55-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1812-70-0x0000000000000000-mapping.dmp
-
memory/2044-54-0x0000000000330000-0x0000000000378000-memory.dmpFilesize
288KB