Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 12:18
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
270KB
-
MD5
40292541a586f5c7e2af4f0b5efde77c
-
SHA1
4fc8c817e38575a5427fdd2741abf20fc9fb3365
-
SHA256
0dbc37565a20d8e5d40c4c554a194719291bc91ab86db587337b580106f41cb8
-
SHA512
ceb7888d6a1a94f898f9fb3e44db01574256e59e7690238384fcc853b55553089d2fbf221b179b5cf4baaa54bc6f58ad3db3b36dc747170d10209f4fa4339091
Malware Config
Extracted
xloader
2.6
uajq
pixeldoughnut.com
amadeushosting.com
sitecindustrial.com
orsaigroup.com
jmuse-dev.com
angelobreviario.com
storesafe.xyz
40veryoung.com
65228267.com
xmpanshi.com
luxorscbd.com
saoirsia.com
akwadcom.com
spreast.com
net-empresa12pcs.com
avlaoge1.com
projectmuellerllc.com
hvelv.com
a2bproject.com
myhome-huahin.com
beautzenvibes.com
tzssdaayaqa.top
corporatexxx.com
sc-server-meshing.info
breadandsaltmarket.com
dac-nh.com
middleeastsecuritywatch.com
fox-influ.com
mndhestro.biz
voipverse.xyz
enrollee-healthbenconstest.com
peteinson.com
genevapunkska.com
tjysdxx.com
7t4zllco.com
healthypostureclub.fitness
npto3jzh.com
hd0b3oke2q90gz.xyz
thepeachcommission.com
duniabidan.com
ffmembership-garera.com
landllumber.site
bangimpromptu.com
visionboysnft.com
smonique.com
woomart.store
bathholidayhome.com
oci.fyi
lfla.agency
buymms1.com
uurdrzk.xyz
taliamagee.com
melishe.com
worthmoth.com
hotelnamastenepal.com
talmagart.com
ruomot.com
bitcoinodyssey.com
ezzahfatima.com
massthetics.net
yearningearningwithyoussef.com
winhcatraining.com
baunfn.online
estress.online
researchwhiz.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1376-132-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral2/memory/1376-134-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral2/memory/2160-140-0x0000000000C10000-0x0000000000C3B000-memory.dmp xloader behavioral2/memory/2160-145-0x0000000000C10000-0x0000000000C3B000-memory.dmp xloader -
Blocklisted process makes network request 2 IoCs
Processes:
cscript.exeflow pid process 39 2160 cscript.exe 49 2160 cscript.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.execvtres.execscript.exedescription pid process target process PID 4240 set thread context of 1376 4240 tmp.exe cvtres.exe PID 1376 set thread context of 2608 1376 cvtres.exe Explorer.EXE PID 2160 set thread context of 2608 2160 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
cvtres.execscript.exepid process 1376 cvtres.exe 1376 cvtres.exe 1376 cvtres.exe 1376 cvtres.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe 2160 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2608 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cvtres.execscript.exepid process 1376 cvtres.exe 1376 cvtres.exe 1376 cvtres.exe 2160 cscript.exe 2160 cscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.execvtres.execscript.exedescription pid process Token: SeDebugPrivilege 4240 tmp.exe Token: SeDebugPrivilege 1376 cvtres.exe Token: SeDebugPrivilege 2160 cscript.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
tmp.exeExplorer.EXEcscript.exedescription pid process target process PID 4240 wrote to memory of 1376 4240 tmp.exe cvtres.exe PID 4240 wrote to memory of 1376 4240 tmp.exe cvtres.exe PID 4240 wrote to memory of 1376 4240 tmp.exe cvtres.exe PID 4240 wrote to memory of 1376 4240 tmp.exe cvtres.exe PID 4240 wrote to memory of 1376 4240 tmp.exe cvtres.exe PID 4240 wrote to memory of 1376 4240 tmp.exe cvtres.exe PID 2608 wrote to memory of 2160 2608 Explorer.EXE cscript.exe PID 2608 wrote to memory of 2160 2608 Explorer.EXE cscript.exe PID 2608 wrote to memory of 2160 2608 Explorer.EXE cscript.exe PID 2160 wrote to memory of 2476 2160 cscript.exe cmd.exe PID 2160 wrote to memory of 2476 2160 cscript.exe cmd.exe PID 2160 wrote to memory of 2476 2160 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1376-136-0x0000000000C80000-0x0000000000C91000-memory.dmpFilesize
68KB
-
memory/1376-131-0x0000000000000000-mapping.dmp
-
memory/1376-132-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1376-134-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1376-135-0x00000000012C0000-0x000000000160A000-memory.dmpFilesize
3.3MB
-
memory/2160-139-0x0000000000C50000-0x0000000000C77000-memory.dmpFilesize
156KB
-
memory/2160-138-0x0000000000000000-mapping.dmp
-
memory/2160-140-0x0000000000C10000-0x0000000000C3B000-memory.dmpFilesize
172KB
-
memory/2160-141-0x0000000002D00000-0x000000000304A000-memory.dmpFilesize
3.3MB
-
memory/2160-143-0x0000000002B30000-0x0000000002BC0000-memory.dmpFilesize
576KB
-
memory/2160-145-0x0000000000C10000-0x0000000000C3B000-memory.dmpFilesize
172KB
-
memory/2476-142-0x0000000000000000-mapping.dmp
-
memory/2608-137-0x00000000084A0000-0x000000000856E000-memory.dmpFilesize
824KB
-
memory/2608-144-0x0000000008690000-0x00000000087FD000-memory.dmpFilesize
1.4MB
-
memory/2608-146-0x0000000008690000-0x00000000087FD000-memory.dmpFilesize
1.4MB
-
memory/4240-130-0x00000000006A0000-0x00000000006E8000-memory.dmpFilesize
288KB