Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 13:00
Static task
static1
Behavioral task
behavioral1
Sample
cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe
Resource
win7-20220414-en
General
-
Target
cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe
-
Size
234KB
-
MD5
1fc1fea1f0894c6e97a0b3a4a1b07566
-
SHA1
240f0ae84d5a5befe322317f8471d3e127a89d93
-
SHA256
cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b
-
SHA512
c9865285bc1b5db73915159eb87c00a8ece16934722429e54477f4e30282f33af0cb1986bccb53f393132ec1ad743b1b2761ee7a3652c312f1849c200b83eb88
Malware Config
Extracted
xloader
2.6
vweq
malang-media.com
mrsfence.com
lubetops.com
aitimedia.net
montecryptocapital.com
ahwmedia.com
bvmnc.site
bggearstore.com
bcsantacoloma.online
alltimephotography.com
santacruz-roofings.com
leaplifestyleenterprises.com
censovet.com
similkameenfarms.com
undisclosed.email
thetrinityco.com
rapiturs.com
jedlersdorf.info
mh7jk12e.xyz
flygurlblogwordpress.com
goodbaddesign.com
equipmentrentalpartyplus.com
ohyoutube.com
projetoarvore.com
2379.flights
implemedescribed.com
kreasinesia.com
ownitoffice.com
fortekofteacizyemeknerde.store
my-wh-webproject.com
518499.com
naples-us.com
tlrohio.com
kanchava.com
lcloudfindin.com
cybermatrix.tech
i6lqi.xyz
ebay-online-selling-24.com
afrisectelecoms.com
tiantian997.xyz
strategyvenues.com
marketnear.watch
thebrooklynyogi.com
sonikbuilder.online
voyagesconsulting.com
ledgel0ungers.com
youhadtobethere.biz
disabled-long.com
dental-implants-encounter.life
zydssq.com
livingwell.green
doumao334.xyz
moodysoot.online
licos.xyz
maqitashop.com
doroos.online
laikemiao.com
petrolverse.xyz
apostolicpraise.net
todaychance.com
helightville.com
st-john-fisher-school.com
agwly.com
dashop.pro
zxc3426.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/876-59-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/876-60-0x000000000041F280-mapping.dmp xloader behavioral1/memory/876-62-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1072-68-0x0000000000080000-0x00000000000AB000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.execvtres.exechkdsk.exedescription pid process target process PID 1788 set thread context of 876 1788 cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe cvtres.exe PID 876 set thread context of 1268 876 cvtres.exe Explorer.EXE PID 1072 set thread context of 1268 1072 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-1819626980-2277161760-1023733287-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
cvtres.exechkdsk.exepid process 876 cvtres.exe 876 cvtres.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
cvtres.exechkdsk.exepid process 876 cvtres.exe 876 cvtres.exe 876 cvtres.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe 1072 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cvtres.exechkdsk.exedescription pid process Token: SeDebugPrivilege 876 cvtres.exe Token: SeDebugPrivilege 1072 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1788 wrote to memory of 876 1788 cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe cvtres.exe PID 1788 wrote to memory of 876 1788 cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe cvtres.exe PID 1788 wrote to memory of 876 1788 cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe cvtres.exe PID 1788 wrote to memory of 876 1788 cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe cvtres.exe PID 1788 wrote to memory of 876 1788 cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe cvtres.exe PID 1788 wrote to memory of 876 1788 cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe cvtres.exe PID 1788 wrote to memory of 876 1788 cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe cvtres.exe PID 1268 wrote to memory of 1072 1268 Explorer.EXE chkdsk.exe PID 1268 wrote to memory of 1072 1268 Explorer.EXE chkdsk.exe PID 1268 wrote to memory of 1072 1268 Explorer.EXE chkdsk.exe PID 1268 wrote to memory of 1072 1268 Explorer.EXE chkdsk.exe PID 1072 wrote to memory of 1760 1072 chkdsk.exe Firefox.exe PID 1072 wrote to memory of 1760 1072 chkdsk.exe Firefox.exe PID 1072 wrote to memory of 1760 1072 chkdsk.exe Firefox.exe PID 1072 wrote to memory of 1760 1072 chkdsk.exe Firefox.exe PID 1072 wrote to memory of 1760 1072 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe"C:\Users\Admin\AppData\Local\Temp\cae9a0644fd5cc322d7507cb395211a8af890df841bcd028f56e77399ada378b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/876-64-0x0000000000140000-0x0000000000151000-memory.dmpFilesize
68KB
-
memory/876-56-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/876-57-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/876-63-0x0000000000C00000-0x0000000000F03000-memory.dmpFilesize
3.0MB
-
memory/876-59-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/876-60-0x000000000041F280-mapping.dmp
-
memory/876-62-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1072-66-0x0000000000000000-mapping.dmp
-
memory/1072-73-0x0000000075701000-0x0000000075703000-memory.dmpFilesize
8KB
-
memory/1072-67-0x00000000006B0000-0x00000000006B7000-memory.dmpFilesize
28KB
-
memory/1072-68-0x0000000000080000-0x00000000000AB000-memory.dmpFilesize
172KB
-
memory/1072-69-0x0000000002020000-0x0000000002323000-memory.dmpFilesize
3.0MB
-
memory/1072-70-0x0000000001E90000-0x0000000001F20000-memory.dmpFilesize
576KB
-
memory/1268-65-0x0000000004A50000-0x0000000004B2D000-memory.dmpFilesize
884KB
-
memory/1268-71-0x0000000004B30000-0x0000000004C2B000-memory.dmpFilesize
1004KB
-
memory/1268-72-0x0000000004B30000-0x0000000004C2B000-memory.dmpFilesize
1004KB
-
memory/1788-55-0x0000000000360000-0x0000000000394000-memory.dmpFilesize
208KB
-
memory/1788-54-0x0000000000840000-0x000000000087A000-memory.dmpFilesize
232KB