Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 16:02
Static task
static1
Behavioral task
behavioral1
Sample
b594d28ecd8be49f2ec9512008cfcbba.exe
Resource
win7-20220414-en
General
-
Target
b594d28ecd8be49f2ec9512008cfcbba.exe
-
Size
366KB
-
MD5
b594d28ecd8be49f2ec9512008cfcbba
-
SHA1
e6a3254ad46bd308832c2e4642c82151b61fe247
-
SHA256
038022c6f5c04dba6aa5b9289461209678a511329ad714ac45b132ad64ab8d60
-
SHA512
dfa5ae2e8d75ca8cb97ce4e5b21ecce36f5ed9267d40d886f9c810539871404276ea346f0d0b36a9dccf61bb1e292212325fc7625a583be212fc62058be849cf
Malware Config
Extracted
xloader
2.5
sk8m
cruisinforabluesin.net
elkntordo.quest
mtmoriginal.com
arespermire.quest
maisoulcolor.com
thegreekfarmerstaverna.com
midlife-fitness.com
uniquelyjessica.com
everybunnyeverybirdy.net
tryafaq.com
aandreashopp.com
selfyou.store
healthtradeusa.com
visiency.com
rainbowshopscom.com
raj-spostitve.com
jupiterflightband.com
haigui.ltd
theparentharbour.com
themutualfriend.com
nobodybutgod.com
seabreezewindowsanddoors.com
steam-whistle.xyz
xlg777.top
glazeind.com
onlinefreetestseries.com
aideritehealth.com
jan-lead.com
farmlimit.com
todofracciones.com
deluxeagent.club
greaterhartfordeats.com
sedyxim.xyz
loontproject.com
drsharonslanguageclasses.mobi
orkadoodle.com
raqsglobal.com
uniquepdglobal.com
niagarachair.com
hostageujkptp.xyz
tastemon.com
ywankm.com
rip-online.com
bousui.club
binges66v.com
superspeedshops.com
b148twpnmu5uvtvnvfk5916.com
myq816oyoukrf9winwyqsw.xyz
shoppernft.com
alexandra-coachingmarketing.com
goohosted.online
shalomroofing.net
y-s-charm.com
lagovistaestates.com
luxuryshopi.com
bekoopverzak.quest
sh10000.store
bama-blues.com
clearviewdirect.net
lotsofcoingifts.com
kcdaikuan.com
cryptopsales.com
meducators.net
oneworldeg.net
snowwisdom.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/1988-58-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1988-59-0x000000000041D4A0-mapping.dmp xloader behavioral1/memory/1988-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1988-69-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1136-73-0x0000000000080000-0x00000000000A9000-memory.dmp xloader behavioral1/memory/1136-77-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
b594d28ecd8be49f2ec9512008cfcbba.execvtres.exewininit.exedescription pid process target process PID 1732 set thread context of 1988 1732 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1988 set thread context of 1256 1988 cvtres.exe Explorer.EXE PID 1988 set thread context of 1256 1988 cvtres.exe Explorer.EXE PID 1136 set thread context of 1256 1136 wininit.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
cvtres.exewininit.exepid process 1988 cvtres.exe 1988 cvtres.exe 1988 cvtres.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe 1136 wininit.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
cvtres.exewininit.exepid process 1988 cvtres.exe 1988 cvtres.exe 1988 cvtres.exe 1988 cvtres.exe 1136 wininit.exe 1136 wininit.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cvtres.exewininit.exedescription pid process Token: SeDebugPrivilege 1988 cvtres.exe Token: SeDebugPrivilege 1136 wininit.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
b594d28ecd8be49f2ec9512008cfcbba.exeExplorer.EXEwininit.exedescription pid process target process PID 1732 wrote to memory of 1988 1732 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1732 wrote to memory of 1988 1732 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1732 wrote to memory of 1988 1732 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1732 wrote to memory of 1988 1732 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1732 wrote to memory of 1988 1732 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1732 wrote to memory of 1988 1732 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1732 wrote to memory of 1988 1732 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1256 wrote to memory of 1136 1256 Explorer.EXE wininit.exe PID 1256 wrote to memory of 1136 1256 Explorer.EXE wininit.exe PID 1256 wrote to memory of 1136 1256 Explorer.EXE wininit.exe PID 1256 wrote to memory of 1136 1256 Explorer.EXE wininit.exe PID 1136 wrote to memory of 948 1136 wininit.exe cmd.exe PID 1136 wrote to memory of 948 1136 wininit.exe cmd.exe PID 1136 wrote to memory of 948 1136 wininit.exe cmd.exe PID 1136 wrote to memory of 948 1136 wininit.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b594d28ecd8be49f2ec9512008cfcbba.exe"C:\Users\Admin\AppData\Local\Temp\b594d28ecd8be49f2ec9512008cfcbba.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-70-0x0000000000000000-mapping.dmp
-
memory/1136-68-0x0000000000000000-mapping.dmp
-
memory/1136-79-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB
-
memory/1136-77-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1136-75-0x00000000008F0000-0x0000000000980000-memory.dmpFilesize
576KB
-
memory/1136-73-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1136-72-0x0000000001F40000-0x0000000002243000-memory.dmpFilesize
3.0MB
-
memory/1136-71-0x0000000000180000-0x000000000019A000-memory.dmpFilesize
104KB
-
memory/1256-67-0x0000000006D00000-0x0000000006E1B000-memory.dmpFilesize
1.1MB
-
memory/1256-74-0x00000000068F0000-0x0000000006A0D000-memory.dmpFilesize
1.1MB
-
memory/1256-64-0x00000000068F0000-0x0000000006A0D000-memory.dmpFilesize
1.1MB
-
memory/1256-78-0x0000000004050000-0x0000000004109000-memory.dmpFilesize
740KB
-
memory/1256-76-0x0000000004050000-0x0000000004109000-memory.dmpFilesize
740KB
-
memory/1732-54-0x0000000000080000-0x00000000000DE000-memory.dmpFilesize
376KB
-
memory/1988-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1988-66-0x0000000000320000-0x0000000000331000-memory.dmpFilesize
68KB
-
memory/1988-59-0x000000000041D4A0-mapping.dmp
-
memory/1988-62-0x0000000000A60000-0x0000000000D63000-memory.dmpFilesize
3.0MB
-
memory/1988-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1988-63-0x0000000000140000-0x0000000000151000-memory.dmpFilesize
68KB
-
memory/1988-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1988-69-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1988-55-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB