Resubmissions
07-07-2022 06:21
220707-g4dccseddn 10Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
07-07-2022 06:21
Behavioral task
behavioral1
Sample
r.exe
Resource
win10-20220414-en
Behavioral task
behavioral2
Sample
r.exe
Resource
macos-20220504-en
Behavioral task
behavioral3
Sample
r.exe
Resource
ubuntu1804-amd64-en-20211208
General
-
Target
r.exe
-
Size
176KB
-
MD5
a750e7ca3c96e229159290610f050f44
-
SHA1
c826d272c2d37bbed58f565d26e23aedbc8e77bd
-
SHA256
7b943e48f8b28d881955fb753c00bcdf83150950dee3de8be4f60809e51772c0
-
SHA512
c850c6e8fbfbcf48aa6ef415e3dd3754570e3b8af84c59456f6da265680cc7f50bf674a598d9ac00ff91cf9e02644f6d635cd3e4a14faeabdefc89cf7557224e
Malware Config
Extracted
xloader
2.8
m02u
ydiKt35xO4uyQFO0NRJJlna9sfNouA==
GjkDEaamJbEEvq8=
FDr3ENQpG/4mLGX6GJQ=
d5q027I2g9f7FGX6GJQ=
q7BGV+E+rkR4orc=
3HqIhCqKvyGAVqSE
NNQTbYBtzLdbeqoWXWaY1g==
5wOrGx0GnkTm9zSJ3A==
POFlw72pMYIowsY9wojDD+V1sfNouA==
rkCg8evPDStR9AGhzVLf
3OLDCO9RWLFeXJIbXWaY1g==
H0EbZUmmk62btLg=
XfrsK8smEDXDdw==
EIqEbCQVnIgqPIJHgkuJ1A==
r16zzKQ6z5+2SIXjNv2CDOB06w==
LDi4upLfsXeqqt1xnu77UiPK
gRxETepbVnFagqE=
6xCyu4F3M5xLJbZI1A==
iYBBZDGayR9Fnes6ww==
eCVOagMOybk=
G6b6Ny4dPFp6BBCM
O2RRrb4lClgDKGX6GJQ=
yXX35pqJ0aG7JbZI1A==
lChCN+JaoP0lMUojNpsmJ4F91nnc
z1hmahZ9tQo3C1gptps=
VXAEYV1JyR+xJbZI1A==
C56noDu7wqTP/0N5kkDI
i6JBYVSyCWrIl9Kd
ErUTcnh69cf0lKZ5kkDI
Rk4yh4340Z6QrRkKww==
75LmNkc9ouycSGP4RuNKTWyxzvI=
ZfhmUv7rMv4ps/wNGrEpNILC
3G6w06iC3am8JbZI1A==
yu5/19rFnfMjtcJNh/xpbr7QsfNouA==
Ea5AR+PTN3UlpNu26Wid3rPSsfNouA==
mMNr3djMQxdH6fqDxUaJypfHsfNouA==
qUKNnzW1tkOz1yh80YCq9ctb4A==
VFzw+157InwmA0w4v5w=
fQYZGbs5J/vgS5KH
T9ETQArrjeiJKX6Ro1bR
Kjz4OUu7ma2btLg=
xezH/udNSDBcctYnVwv4SKs=
Lr2wBRVwpegaKWX6GJQ=
kzOX7vvjh62btLg=
QGhrhEi76j7shtWyArX7UiPK
BIvrNCcN3UfeDmX6GJQ=
2mpuefwmp3alKU2hzVLf
9af5eeDfRRRC4kwdZBdYmU5WN2VDA0Q2Ww==
GRKhq1lB/F31HmX6GJQ=
2mTJuGtgK4KnOoIaXWaY1g==
iSZOlKCSC1KTrOsNGrEpNILC
7vXHE/NHLQoyXKOEyD+AgY3C6g==
1nypyI7+KB746d6T
tS5helE5t5CAVqSE
u93uXGf0zibM
gw0VIeXUZTlY5/SK7ZshLIB91nnc
kKp0nGTG2bzvBwsCegpXpndv5u5pug==
v+Z30NvLmf+ww/pIXWaY1g==
Ue6AiSf/uB5R9H6ztPf7UiPK
2Y9HbjCKXYitvuoNGrEpNILC
MUf1ENQ6W6zmdHTD0jt6gY3C6g==
Xub0CtZID94NKGX6GJQ=
HxrE6801NoQxLGTJDJ8eqEgimOU=
wGTsAJg5OYnAJbZI1A==
live24-news.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4064-187-0x0000000000EB0000-0x0000000000EDC000-memory.dmp xloader behavioral1/memory/4064-193-0x0000000000EB0000-0x0000000000EDC000-memory.dmp xloader C:\Program Files (x86)\X8p8t0x\tx4txth05jlhpxxp.exe xloader C:\Program Files (x86)\X8p8t0x\tx4txth05jlhpxxp.exe xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
colorcpl.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run colorcpl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\-DFDQB = "C:\\Program Files (x86)\\X8p8t0x\\tx4txth05jlhpxxp.exe" colorcpl.exe -
Executes dropped EXE 1 IoCs
Processes:
tx4txth05jlhpxxp.exepid process 4008 tx4txth05jlhpxxp.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
r.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Control Panel\International\Geo\Nation r.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
r.execolorcpl.exedescription pid process target process PID 2692 set thread context of 1760 2692 r.exe Explorer.EXE PID 4064 set thread context of 1760 4064 colorcpl.exe Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
colorcpl.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\X8p8t0x\tx4txth05jlhpxxp.exe colorcpl.exe File opened for modification C:\Program Files (x86)\X8p8t0x Explorer.EXE File created C:\Program Files (x86)\X8p8t0x\tx4txth05jlhpxxp.exe Explorer.EXE File opened for modification C:\Program Files (x86)\X8p8t0x\tx4txth05jlhpxxp.exe Explorer.EXE -
Processes:
colorcpl.exedescription ioc process Key created \Registry\User\S-1-5-21-1804997378-2045782378-3882459628-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 colorcpl.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
r.execolorcpl.exetx4txth05jlhpxxp.exepid process 2692 r.exe 2692 r.exe 2692 r.exe 2692 r.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4008 tx4txth05jlhpxxp.exe 4008 tx4txth05jlhpxxp.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
r.execolorcpl.exepid process 2692 r.exe 2692 r.exe 2692 r.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe 4064 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
r.execolorcpl.exetx4txth05jlhpxxp.exedescription pid process Token: SeDebugPrivilege 2692 r.exe Token: SeDebugPrivilege 4064 colorcpl.exe Token: SeDebugPrivilege 4008 tx4txth05jlhpxxp.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Explorer.EXEcolorcpl.exedescription pid process target process PID 1760 wrote to memory of 4064 1760 Explorer.EXE colorcpl.exe PID 1760 wrote to memory of 4064 1760 Explorer.EXE colorcpl.exe PID 1760 wrote to memory of 4064 1760 Explorer.EXE colorcpl.exe PID 4064 wrote to memory of 1908 4064 colorcpl.exe cmd.exe PID 4064 wrote to memory of 1908 4064 colorcpl.exe cmd.exe PID 4064 wrote to memory of 1908 4064 colorcpl.exe cmd.exe PID 4064 wrote to memory of 324 4064 colorcpl.exe cmd.exe PID 4064 wrote to memory of 324 4064 colorcpl.exe cmd.exe PID 4064 wrote to memory of 324 4064 colorcpl.exe cmd.exe PID 4064 wrote to memory of 1076 4064 colorcpl.exe Firefox.exe PID 4064 wrote to memory of 1076 4064 colorcpl.exe Firefox.exe PID 4064 wrote to memory of 1076 4064 colorcpl.exe Firefox.exe PID 1760 wrote to memory of 4008 1760 Explorer.EXE tx4txth05jlhpxxp.exe PID 1760 wrote to memory of 4008 1760 Explorer.EXE tx4txth05jlhpxxp.exe PID 1760 wrote to memory of 4008 1760 Explorer.EXE tx4txth05jlhpxxp.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\r.exe"C:\Users\Admin\AppData\Local\Temp\r.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\r.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\X8p8t0x\tx4txth05jlhpxxp.exe"C:\Program Files (x86)\X8p8t0x\tx4txth05jlhpxxp.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\X8p8t0x\tx4txth05jlhpxxp.exeFilesize
176KB
MD5a750e7ca3c96e229159290610f050f44
SHA1c826d272c2d37bbed58f565d26e23aedbc8e77bd
SHA2567b943e48f8b28d881955fb753c00bcdf83150950dee3de8be4f60809e51772c0
SHA512c850c6e8fbfbcf48aa6ef415e3dd3754570e3b8af84c59456f6da265680cc7f50bf674a598d9ac00ff91cf9e02644f6d635cd3e4a14faeabdefc89cf7557224e
-
C:\Program Files (x86)\X8p8t0x\tx4txth05jlhpxxp.exeFilesize
176KB
MD5a750e7ca3c96e229159290610f050f44
SHA1c826d272c2d37bbed58f565d26e23aedbc8e77bd
SHA2567b943e48f8b28d881955fb753c00bcdf83150950dee3de8be4f60809e51772c0
SHA512c850c6e8fbfbcf48aa6ef415e3dd3754570e3b8af84c59456f6da265680cc7f50bf674a598d9ac00ff91cf9e02644f6d635cd3e4a14faeabdefc89cf7557224e
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
memory/324-216-0x0000000000000000-mapping.dmp
-
memory/1760-194-0x00000000029F0000-0x0000000002A89000-memory.dmpFilesize
612KB
-
memory/1760-196-0x00000000029F0000-0x0000000002A89000-memory.dmpFilesize
612KB
-
memory/1760-142-0x0000000000B50000-0x0000000000C4C000-memory.dmpFilesize
1008KB
-
memory/1760-190-0x0000000000B50000-0x0000000000C4C000-memory.dmpFilesize
1008KB
-
memory/1908-189-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/1908-184-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/1908-185-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/1908-183-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/1908-182-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/1908-181-0x0000000000000000-mapping.dmp
-
memory/2692-139-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-120-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-134-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-135-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-136-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-137-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-138-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-118-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-140-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-141-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-132-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-130-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-119-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-131-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-128-0x0000000000D50000-0x0000000001070000-memory.dmpFilesize
3.1MB
-
memory/2692-121-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-122-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-123-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-133-0x0000000000CF0000-0x0000000000D01000-memory.dmpFilesize
68KB
-
memory/2692-124-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-125-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-126-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-127-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/2692-129-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4008-234-0x0000000000000000-mapping.dmp
-
memory/4008-251-0x0000000000C90000-0x0000000000FB0000-memory.dmpFilesize
3.1MB
-
memory/4064-150-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-179-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-160-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-161-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-162-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-163-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-164-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-165-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-166-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-167-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-168-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-169-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-170-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-171-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-172-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-173-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-175-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-174-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-176-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-177-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-178-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-159-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-180-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-158-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-157-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-156-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-155-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-154-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-186-0x0000000001170000-0x0000000001189000-memory.dmpFilesize
100KB
-
memory/4064-187-0x0000000000EB0000-0x0000000000EDC000-memory.dmpFilesize
176KB
-
memory/4064-188-0x0000000004E50000-0x0000000005170000-memory.dmpFilesize
3.1MB
-
memory/4064-153-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-152-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-192-0x0000000004B10000-0x0000000004CAA000-memory.dmpFilesize
1.6MB
-
memory/4064-193-0x0000000000EB0000-0x0000000000EDC000-memory.dmpFilesize
176KB
-
memory/4064-151-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-195-0x0000000004B10000-0x0000000004CAA000-memory.dmpFilesize
1.6MB
-
memory/4064-149-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-148-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-147-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-146-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-145-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-144-0x0000000077360000-0x00000000774EE000-memory.dmpFilesize
1.6MB
-
memory/4064-143-0x0000000000000000-mapping.dmp