Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 18:34
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
331KB
-
MD5
4a80cec907b418a133ad5d3eea96923f
-
SHA1
b7772efaa512ed3465b17e07af829fedd9a885df
-
SHA256
54dd1a6be86907485cb1f716306eb8918116f873a9382e10d92f6632491c1074
-
SHA512
e8af59e857347c22a0cea3981122018b472482382fe11c642c4a67d182fc6aa78ea257f63630b36358b95304cbd07bc1048b35163af72fbb87329f3f1897bb2c
Malware Config
Extracted
xloader
2.5
sk8m
cruisinforabluesin.net
elkntordo.quest
mtmoriginal.com
arespermire.quest
maisoulcolor.com
thegreekfarmerstaverna.com
midlife-fitness.com
uniquelyjessica.com
everybunnyeverybirdy.net
tryafaq.com
aandreashopp.com
selfyou.store
healthtradeusa.com
visiency.com
rainbowshopscom.com
raj-spostitve.com
jupiterflightband.com
haigui.ltd
theparentharbour.com
themutualfriend.com
nobodybutgod.com
seabreezewindowsanddoors.com
steam-whistle.xyz
xlg777.top
glazeind.com
onlinefreetestseries.com
aideritehealth.com
jan-lead.com
farmlimit.com
todofracciones.com
deluxeagent.club
greaterhartfordeats.com
sedyxim.xyz
loontproject.com
drsharonslanguageclasses.mobi
orkadoodle.com
raqsglobal.com
uniquepdglobal.com
niagarachair.com
hostageujkptp.xyz
tastemon.com
ywankm.com
rip-online.com
bousui.club
binges66v.com
superspeedshops.com
b148twpnmu5uvtvnvfk5916.com
myq816oyoukrf9winwyqsw.xyz
shoppernft.com
alexandra-coachingmarketing.com
goohosted.online
shalomroofing.net
y-s-charm.com
lagovistaestates.com
luxuryshopi.com
bekoopverzak.quest
sh10000.store
bama-blues.com
clearviewdirect.net
lotsofcoingifts.com
kcdaikuan.com
cryptopsales.com
meducators.net
oneworldeg.net
snowwisdom.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/832-58-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/832-59-0x000000000041D4A0-mapping.dmp xloader behavioral1/memory/832-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1108-68-0x0000000000070000-0x0000000000099000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
cscript.exeflow pid process 29 1108 cscript.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.execvtres.execscript.exedescription pid process target process PID 240 set thread context of 832 240 tmp.exe cvtres.exe PID 832 set thread context of 1200 832 cvtres.exe Explorer.EXE PID 1108 set thread context of 1200 1108 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
cvtres.execscript.exepid process 832 cvtres.exe 832 cvtres.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe 1108 cscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cvtres.execscript.exepid process 832 cvtres.exe 832 cvtres.exe 832 cvtres.exe 1108 cscript.exe 1108 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cvtres.execscript.exedescription pid process Token: SeDebugPrivilege 832 cvtres.exe Token: SeDebugPrivilege 1108 cscript.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
tmp.exeExplorer.EXEcscript.exedescription pid process target process PID 240 wrote to memory of 832 240 tmp.exe cvtres.exe PID 240 wrote to memory of 832 240 tmp.exe cvtres.exe PID 240 wrote to memory of 832 240 tmp.exe cvtres.exe PID 240 wrote to memory of 832 240 tmp.exe cvtres.exe PID 240 wrote to memory of 832 240 tmp.exe cvtres.exe PID 240 wrote to memory of 832 240 tmp.exe cvtres.exe PID 240 wrote to memory of 832 240 tmp.exe cvtres.exe PID 1200 wrote to memory of 1108 1200 Explorer.EXE cscript.exe PID 1200 wrote to memory of 1108 1200 Explorer.EXE cscript.exe PID 1200 wrote to memory of 1108 1200 Explorer.EXE cscript.exe PID 1200 wrote to memory of 1108 1200 Explorer.EXE cscript.exe PID 1108 wrote to memory of 1488 1108 cscript.exe cmd.exe PID 1108 wrote to memory of 1488 1108 cscript.exe cmd.exe PID 1108 wrote to memory of 1488 1108 cscript.exe cmd.exe PID 1108 wrote to memory of 1488 1108 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/240-54-0x0000000000D40000-0x0000000000D96000-memory.dmpFilesize
344KB
-
memory/832-55-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/832-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/832-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/832-59-0x000000000041D4A0-mapping.dmp
-
memory/832-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/832-62-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/832-63-0x0000000000280000-0x0000000000291000-memory.dmpFilesize
68KB
-
memory/1108-69-0x0000000001FA0000-0x00000000022A3000-memory.dmpFilesize
3.0MB
-
memory/1108-65-0x0000000000000000-mapping.dmp
-
memory/1108-67-0x00000000006C0000-0x00000000006E2000-memory.dmpFilesize
136KB
-
memory/1108-68-0x0000000000070000-0x0000000000099000-memory.dmpFilesize
164KB
-
memory/1108-70-0x0000000000580000-0x0000000000610000-memory.dmpFilesize
576KB
-
memory/1108-73-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1200-64-0x0000000006690000-0x0000000006836000-memory.dmpFilesize
1.6MB
-
memory/1200-71-0x0000000007050000-0x00000000071B9000-memory.dmpFilesize
1.4MB
-
memory/1200-72-0x0000000007050000-0x00000000071B9000-memory.dmpFilesize
1.4MB
-
memory/1488-66-0x0000000000000000-mapping.dmp