Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 16:02
Static task
static1
Behavioral task
behavioral1
Sample
b594d28ecd8be49f2ec9512008cfcbba.exe
Resource
win7-20220414-en
General
-
Target
b594d28ecd8be49f2ec9512008cfcbba.exe
-
Size
366KB
-
MD5
b594d28ecd8be49f2ec9512008cfcbba
-
SHA1
e6a3254ad46bd308832c2e4642c82151b61fe247
-
SHA256
038022c6f5c04dba6aa5b9289461209678a511329ad714ac45b132ad64ab8d60
-
SHA512
dfa5ae2e8d75ca8cb97ce4e5b21ecce36f5ed9267d40d886f9c810539871404276ea346f0d0b36a9dccf61bb1e292212325fc7625a583be212fc62058be849cf
Malware Config
Extracted
xloader
2.5
sk8m
cruisinforabluesin.net
elkntordo.quest
mtmoriginal.com
arespermire.quest
maisoulcolor.com
thegreekfarmerstaverna.com
midlife-fitness.com
uniquelyjessica.com
everybunnyeverybirdy.net
tryafaq.com
aandreashopp.com
selfyou.store
healthtradeusa.com
visiency.com
rainbowshopscom.com
raj-spostitve.com
jupiterflightband.com
haigui.ltd
theparentharbour.com
themutualfriend.com
nobodybutgod.com
seabreezewindowsanddoors.com
steam-whistle.xyz
xlg777.top
glazeind.com
onlinefreetestseries.com
aideritehealth.com
jan-lead.com
farmlimit.com
todofracciones.com
deluxeagent.club
greaterhartfordeats.com
sedyxim.xyz
loontproject.com
drsharonslanguageclasses.mobi
orkadoodle.com
raqsglobal.com
uniquepdglobal.com
niagarachair.com
hostageujkptp.xyz
tastemon.com
ywankm.com
rip-online.com
bousui.club
binges66v.com
superspeedshops.com
b148twpnmu5uvtvnvfk5916.com
myq816oyoukrf9winwyqsw.xyz
shoppernft.com
alexandra-coachingmarketing.com
goohosted.online
shalomroofing.net
y-s-charm.com
lagovistaestates.com
luxuryshopi.com
bekoopverzak.quest
sh10000.store
bama-blues.com
clearviewdirect.net
lotsofcoingifts.com
kcdaikuan.com
cryptopsales.com
meducators.net
oneworldeg.net
snowwisdom.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1956-132-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1956-138-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4376-140-0x0000000000B70000-0x0000000000B99000-memory.dmp xloader behavioral2/memory/4376-144-0x0000000000B70000-0x0000000000B99000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
b594d28ecd8be49f2ec9512008cfcbba.execvtres.exeexplorer.exedescription pid process target process PID 1028 set thread context of 1956 1028 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1956 set thread context of 3148 1956 cvtres.exe Explorer.EXE PID 4376 set thread context of 3148 4376 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
cvtres.exeexplorer.exepid process 1956 cvtres.exe 1956 cvtres.exe 1956 cvtres.exe 1956 cvtres.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe 4376 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3148 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cvtres.exeexplorer.exepid process 1956 cvtres.exe 1956 cvtres.exe 1956 cvtres.exe 4376 explorer.exe 4376 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cvtres.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1956 cvtres.exe Token: SeDebugPrivilege 4376 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
b594d28ecd8be49f2ec9512008cfcbba.exeExplorer.EXEexplorer.exedescription pid process target process PID 1028 wrote to memory of 1956 1028 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1028 wrote to memory of 1956 1028 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1028 wrote to memory of 1956 1028 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1028 wrote to memory of 1956 1028 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1028 wrote to memory of 1956 1028 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 1028 wrote to memory of 1956 1028 b594d28ecd8be49f2ec9512008cfcbba.exe cvtres.exe PID 3148 wrote to memory of 4376 3148 Explorer.EXE explorer.exe PID 3148 wrote to memory of 4376 3148 Explorer.EXE explorer.exe PID 3148 wrote to memory of 4376 3148 Explorer.EXE explorer.exe PID 4376 wrote to memory of 2248 4376 explorer.exe cmd.exe PID 4376 wrote to memory of 2248 4376 explorer.exe cmd.exe PID 4376 wrote to memory of 2248 4376 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b594d28ecd8be49f2ec9512008cfcbba.exe"C:\Users\Admin\AppData\Local\Temp\b594d28ecd8be49f2ec9512008cfcbba.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1028-130-0x0000000000CC0000-0x0000000000D1E000-memory.dmpFilesize
376KB
-
memory/1956-131-0x0000000000000000-mapping.dmp
-
memory/1956-132-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1956-134-0x00000000015E0000-0x000000000192A000-memory.dmpFilesize
3.3MB
-
memory/1956-135-0x0000000001960000-0x0000000001971000-memory.dmpFilesize
68KB
-
memory/1956-138-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2248-141-0x0000000000000000-mapping.dmp
-
memory/3148-136-0x00000000086F0000-0x0000000008874000-memory.dmpFilesize
1.5MB
-
memory/3148-146-0x0000000002F80000-0x0000000003071000-memory.dmpFilesize
964KB
-
memory/3148-145-0x0000000002F80000-0x0000000003071000-memory.dmpFilesize
964KB
-
memory/4376-139-0x0000000000C10000-0x0000000001043000-memory.dmpFilesize
4.2MB
-
memory/4376-142-0x0000000003360000-0x00000000036AA000-memory.dmpFilesize
3.3MB
-
memory/4376-143-0x0000000002F50000-0x0000000002FE0000-memory.dmpFilesize
576KB
-
memory/4376-144-0x0000000000B70000-0x0000000000B99000-memory.dmpFilesize
164KB
-
memory/4376-140-0x0000000000B70000-0x0000000000B99000-memory.dmpFilesize
164KB
-
memory/4376-137-0x0000000000000000-mapping.dmp