Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 18:34
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
General
-
Target
tmp.exe
-
Size
331KB
-
MD5
4a80cec907b418a133ad5d3eea96923f
-
SHA1
b7772efaa512ed3465b17e07af829fedd9a885df
-
SHA256
54dd1a6be86907485cb1f716306eb8918116f873a9382e10d92f6632491c1074
-
SHA512
e8af59e857347c22a0cea3981122018b472482382fe11c642c4a67d182fc6aa78ea257f63630b36358b95304cbd07bc1048b35163af72fbb87329f3f1897bb2c
Malware Config
Extracted
xloader
2.5
sk8m
cruisinforabluesin.net
elkntordo.quest
mtmoriginal.com
arespermire.quest
maisoulcolor.com
thegreekfarmerstaverna.com
midlife-fitness.com
uniquelyjessica.com
everybunnyeverybirdy.net
tryafaq.com
aandreashopp.com
selfyou.store
healthtradeusa.com
visiency.com
rainbowshopscom.com
raj-spostitve.com
jupiterflightband.com
haigui.ltd
theparentharbour.com
themutualfriend.com
nobodybutgod.com
seabreezewindowsanddoors.com
steam-whistle.xyz
xlg777.top
glazeind.com
onlinefreetestseries.com
aideritehealth.com
jan-lead.com
farmlimit.com
todofracciones.com
deluxeagent.club
greaterhartfordeats.com
sedyxim.xyz
loontproject.com
drsharonslanguageclasses.mobi
orkadoodle.com
raqsglobal.com
uniquepdglobal.com
niagarachair.com
hostageujkptp.xyz
tastemon.com
ywankm.com
rip-online.com
bousui.club
binges66v.com
superspeedshops.com
b148twpnmu5uvtvnvfk5916.com
myq816oyoukrf9winwyqsw.xyz
shoppernft.com
alexandra-coachingmarketing.com
goohosted.online
shalomroofing.net
y-s-charm.com
lagovistaestates.com
luxuryshopi.com
bekoopverzak.quest
sh10000.store
bama-blues.com
clearviewdirect.net
lotsofcoingifts.com
kcdaikuan.com
cryptopsales.com
meducators.net
oneworldeg.net
snowwisdom.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/816-135-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/816-141-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1460-143-0x0000000000B10000-0x0000000000B39000-memory.dmp xloader behavioral2/memory/1460-147-0x0000000000B10000-0x0000000000B39000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
tmp.execvtres.exeraserver.exedescription pid process target process PID 384 set thread context of 816 384 tmp.exe cvtres.exe PID 816 set thread context of 3004 816 cvtres.exe Explorer.EXE PID 1460 set thread context of 3004 1460 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
tmp.execvtres.exeraserver.exepid process 384 tmp.exe 384 tmp.exe 384 tmp.exe 384 tmp.exe 384 tmp.exe 384 tmp.exe 816 cvtres.exe 816 cvtres.exe 816 cvtres.exe 816 cvtres.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe 1460 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3004 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cvtres.exeraserver.exepid process 816 cvtres.exe 816 cvtres.exe 816 cvtres.exe 1460 raserver.exe 1460 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
tmp.execvtres.exeraserver.exedescription pid process Token: SeDebugPrivilege 384 tmp.exe Token: SeDebugPrivilege 816 cvtres.exe Token: SeDebugPrivilege 1460 raserver.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
tmp.exeExplorer.EXEraserver.exedescription pid process target process PID 384 wrote to memory of 5068 384 tmp.exe cvtres.exe PID 384 wrote to memory of 5068 384 tmp.exe cvtres.exe PID 384 wrote to memory of 5068 384 tmp.exe cvtres.exe PID 384 wrote to memory of 2532 384 tmp.exe cvtres.exe PID 384 wrote to memory of 2532 384 tmp.exe cvtres.exe PID 384 wrote to memory of 2532 384 tmp.exe cvtres.exe PID 384 wrote to memory of 3104 384 tmp.exe cvtres.exe PID 384 wrote to memory of 3104 384 tmp.exe cvtres.exe PID 384 wrote to memory of 3104 384 tmp.exe cvtres.exe PID 384 wrote to memory of 816 384 tmp.exe cvtres.exe PID 384 wrote to memory of 816 384 tmp.exe cvtres.exe PID 384 wrote to memory of 816 384 tmp.exe cvtres.exe PID 384 wrote to memory of 816 384 tmp.exe cvtres.exe PID 384 wrote to memory of 816 384 tmp.exe cvtres.exe PID 384 wrote to memory of 816 384 tmp.exe cvtres.exe PID 3004 wrote to memory of 1460 3004 Explorer.EXE raserver.exe PID 3004 wrote to memory of 1460 3004 Explorer.EXE raserver.exe PID 3004 wrote to memory of 1460 3004 Explorer.EXE raserver.exe PID 1460 wrote to memory of 4316 1460 raserver.exe cmd.exe PID 1460 wrote to memory of 4316 1460 raserver.exe cmd.exe PID 1460 wrote to memory of 4316 1460 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/384-130-0x0000000000B70000-0x0000000000BC6000-memory.dmpFilesize
344KB
-
memory/816-137-0x0000000001940000-0x0000000001C8A000-memory.dmpFilesize
3.3MB
-
memory/816-141-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/816-138-0x00000000018F0000-0x0000000001901000-memory.dmpFilesize
68KB
-
memory/816-134-0x0000000000000000-mapping.dmp
-
memory/816-135-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1460-143-0x0000000000B10000-0x0000000000B39000-memory.dmpFilesize
164KB
-
memory/1460-140-0x0000000000000000-mapping.dmp
-
memory/1460-142-0x0000000000D90000-0x0000000000DAF000-memory.dmpFilesize
124KB
-
memory/1460-144-0x0000000002DF0000-0x000000000313A000-memory.dmpFilesize
3.3MB
-
memory/1460-146-0x0000000002B20000-0x0000000002BB0000-memory.dmpFilesize
576KB
-
memory/1460-147-0x0000000000B10000-0x0000000000B39000-memory.dmpFilesize
164KB
-
memory/2532-132-0x0000000000000000-mapping.dmp
-
memory/3004-139-0x0000000008670000-0x0000000008758000-memory.dmpFilesize
928KB
-
memory/3004-148-0x0000000008760000-0x0000000008836000-memory.dmpFilesize
856KB
-
memory/3004-149-0x0000000008760000-0x0000000008836000-memory.dmpFilesize
856KB
-
memory/3104-133-0x0000000000000000-mapping.dmp
-
memory/4316-145-0x0000000000000000-mapping.dmp
-
memory/5068-131-0x0000000000000000-mapping.dmp