Overview
overview
10Static
static
1033.exe
windows10-2004-x64
1034.exe
windows10-2004-x64
1035.exe
windows10-2004-x64
1036.exe
windows10-2004-x64
1037.exe
windows10-2004-x64
1038.exe
windows10-2004-x64
1039.exe
windows10-2004-x64
1040.exe
windows10-2004-x64
1041.exe
windows10-2004-x64
1042.exe
windows10-2004-x64
1043.exe
windows10-2004-x64
1044.exe
windows10-2004-x64
1045.exe
windows10-2004-x64
1046.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
02-09-2022 03:27
Behavioral task
behavioral1
Sample
33.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral2
Sample
34.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral3
Sample
35.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral4
Sample
36.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
37.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral6
Sample
38.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
39.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral8
Sample
40.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
41.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral10
Sample
42.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
43.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral12
Sample
44.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
45.exe
Resource
win10v2004-20220812-en
General
-
Target
37.exe
-
Size
176KB
-
MD5
67dc61588f11f816b92690ea723fcd8e
-
SHA1
73fd5e1d4bc161d5aa803ed1db493ce7cbca5f75
-
SHA256
35876cb065b7b1a590a882ab9b85539d567043c53362208955f69093855e9ea9
-
SHA512
7995ff412f92a72eeffc14633d225fb0bb68bfb5c54f0babd13416be4e11ab035d7f4ea7875de42ddb9fd899f25810b56009ca8b26f6d88d255c59e6f1e89a01
-
SSDEEP
3072:DO+opXUUl1BGq3gjSW7ho/xYTXdS3cR+Z7v+cj5ilpbvHi21PQdk775cxIh0d:DaDzsggjHe/xY7d4cR+Zv+cN4B1IOP5c
Malware Config
Extracted
xloader
2.9
fofg
FHyydxpFBs0S8b4ZlP7ZEtd/
EVaCEKb/cVV9xQ==
U9I5lke0IuU7vj5EXus=
rXD3AKPV3qUblOUsV41KMfU=
PwBSy5z56XNzIvnS3ygsKv0=
CQe1BLbSnGXX
HuhKjxhLhxqBy2FFz8WoFA==
QJymezEoLOFZ1T5EXus=
V8r5PAdwuGK2AUARohas
b1XV06ANH9s5uj5EXus=
3EiEhwo7Euw2tl8=
c2PjK8Izkydy5N8x
CXCkYf0m/qPrv8QajKyT6Oo=
pHjy+Mk0CqvWBXdCz8WoFA==
QjSwr3/j5rAyvz5EXus=
+edxANg/sU+k8YFQz8WoFA==
tWiQq3rqyl6cTAG9pA==
GeAyMQxBUOlDwD5EXus=
nQ5eoT2mEKkhDN2DwBek
JP5dIbHlrXXR8umDwBek
BMT8B9n1OyBvqL+WUSgsKv0=
RSeJYDyteizAdQbSCyHeYCCMZL1A
NOgCENlCLthl5TV9YsWpTzHAdjCmUw==
s2npDaPJBhAdm10=
TXr1YfxiKOkqcgfcHV092XmTHA==
aTXN1nHe/gVFvD5EXus=
TS+nK+9V4pW+9cko
GuBk6sExhxNLr7wYhPbZEtd/
oHWjdWHDv228J/jg0q6xYvzLcxRiMhI=
z6pB06UWdBZHuj5EXus=
nZ7gYT4zv3fY
gXHxw16/sjbOAABSuAnZEtd/
m2asNcPsiDe3I27NxByg2XmTHA==
leg4fQ1h3ZG+9cko
AmB4B64SvFJ6t1G2z8WoFA==
7agWYtMw0Wu2yptkrA==
yzl7iRI/QhdFiRV+eQXh2qsEinZosxo=
gcntJ8YrjSVy5N8x
hmi6U/JgAY/CyptkrA==
/2edLM81848QdjaiqyLu051h
57A/tEumUOZ3Nc6c3Q/aQx8Hiq38AvyPxw==
qI77ulvxShNayD5EXus=
IPA6VOUd6xAdm10=
6LAL4bkhuGHG5+WDwBek
06pAU/Af78kc13PYvx2l2XmTHA==
LhRuu47pEuACWUo=
98ue7uq/cVV9xQ==
Vxxkh13O3ZwXwlcqp5L/6OM=
XhYUTkQR6hAdm10=
RQE/ijRllTFI8umlUSgsKv0=
+2bIH8U2olR6PVYuAlnzaCaMZL1A
BMQ9MRDgCcoYGZlxF2gFHXp1
fmrbKPeT/LD1azf/CIEZLeKVCw==
ajSLMtRD25W+9cko
8LTyD9cHcVV9xQ==
mFi1hCWOhw5Huj5EXus=
FXSUHb8h45vFyptkrA==
lWmcMf1mwF2BLzwh/FncUzfPgHZosxo=
guwbCaTRfBKGAXWKUHUf+e90detZ
QhxpJrXlmzdKeRDrnCjfixcSwulI
Thag+Y/veDtRAOqDwBek
Z0Wp7pLMCBAdm10=
bT9HyWnOXhWYztVF4moy2XmTHA==
kXbZHKvU/Iq+9cko
richardcrebeck.com
Signatures
-
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral5/memory/3796-137-0x0000000000150000-0x000000000017C000-memory.dmp xloader behavioral5/memory/3796-142-0x0000000000150000-0x000000000017C000-memory.dmp xloader C:\Program Files (x86)\Rv8l\updatexfc8ftb.exe xloader C:\Program Files (x86)\Rv8l\updatexfc8ftb.exe xloader -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 31 3796 msiexec.exe -
Executes dropped EXE 1 IoCs
Processes:
updatexfc8ftb.exepid process 3624 updatexfc8ftb.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
37.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 37.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3FEDAN8H5 = "C:\\Program Files (x86)\\Rv8l\\updatexfc8ftb.exe" msiexec.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
37.exemsiexec.exedescription pid process target process PID 3848 set thread context of 2664 3848 37.exe Explorer.EXE PID 3796 set thread context of 2664 3796 msiexec.exe Explorer.EXE -
Drops file in Program Files directory 4 IoCs
Processes:
Explorer.EXEmsiexec.exedescription ioc process File opened for modification C:\Program Files (x86)\Rv8l Explorer.EXE File created C:\Program Files (x86)\Rv8l\updatexfc8ftb.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Rv8l\updatexfc8ftb.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Rv8l\updatexfc8ftb.exe msiexec.exe -
Processes:
msiexec.exedescription ioc process Key created \Registry\User\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msiexec.exe -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
37.exemsiexec.exeupdatexfc8ftb.exepid process 3848 37.exe 3848 37.exe 3848 37.exe 3848 37.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3624 updatexfc8ftb.exe 3624 updatexfc8ftb.exe 3796 msiexec.exe 3796 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2664 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
37.exemsiexec.exepid process 3848 37.exe 3848 37.exe 3848 37.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe 3796 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
37.exemsiexec.exeupdatexfc8ftb.exedescription pid process Token: SeDebugPrivilege 3848 37.exe Token: SeDebugPrivilege 3796 msiexec.exe Token: SeDebugPrivilege 3624 updatexfc8ftb.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Explorer.EXEmsiexec.exedescription pid process target process PID 2664 wrote to memory of 3796 2664 Explorer.EXE msiexec.exe PID 2664 wrote to memory of 3796 2664 Explorer.EXE msiexec.exe PID 2664 wrote to memory of 3796 2664 Explorer.EXE msiexec.exe PID 3796 wrote to memory of 1680 3796 msiexec.exe cmd.exe PID 3796 wrote to memory of 1680 3796 msiexec.exe cmd.exe PID 3796 wrote to memory of 1680 3796 msiexec.exe cmd.exe PID 3796 wrote to memory of 2720 3796 msiexec.exe cmd.exe PID 3796 wrote to memory of 2720 3796 msiexec.exe cmd.exe PID 3796 wrote to memory of 2720 3796 msiexec.exe cmd.exe PID 3796 wrote to memory of 5104 3796 msiexec.exe cmd.exe PID 3796 wrote to memory of 5104 3796 msiexec.exe cmd.exe PID 3796 wrote to memory of 5104 3796 msiexec.exe cmd.exe PID 3796 wrote to memory of 4744 3796 msiexec.exe Firefox.exe PID 3796 wrote to memory of 4744 3796 msiexec.exe Firefox.exe PID 3796 wrote to memory of 4744 3796 msiexec.exe Firefox.exe PID 2664 wrote to memory of 3624 2664 Explorer.EXE updatexfc8ftb.exe PID 2664 wrote to memory of 3624 2664 Explorer.EXE updatexfc8ftb.exe PID 2664 wrote to memory of 3624 2664 Explorer.EXE updatexfc8ftb.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\37.exe"C:\Users\Admin\AppData\Local\Temp\37.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\37.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Rv8l\updatexfc8ftb.exe"C:\Program Files (x86)\Rv8l\updatexfc8ftb.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Rv8l\updatexfc8ftb.exeFilesize
176KB
MD567dc61588f11f816b92690ea723fcd8e
SHA173fd5e1d4bc161d5aa803ed1db493ce7cbca5f75
SHA25635876cb065b7b1a590a882ab9b85539d567043c53362208955f69093855e9ea9
SHA5127995ff412f92a72eeffc14633d225fb0bb68bfb5c54f0babd13416be4e11ab035d7f4ea7875de42ddb9fd899f25810b56009ca8b26f6d88d255c59e6f1e89a01
-
C:\Program Files (x86)\Rv8l\updatexfc8ftb.exeFilesize
176KB
MD567dc61588f11f816b92690ea723fcd8e
SHA173fd5e1d4bc161d5aa803ed1db493ce7cbca5f75
SHA25635876cb065b7b1a590a882ab9b85539d567043c53362208955f69093855e9ea9
SHA5127995ff412f92a72eeffc14633d225fb0bb68bfb5c54f0babd13416be4e11ab035d7f4ea7875de42ddb9fd899f25810b56009ca8b26f6d88d255c59e6f1e89a01
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
40KB
MD5b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\DB1Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
memory/1680-138-0x0000000000000000-mapping.dmp
-
memory/2664-143-0x0000000007FB0000-0x00000000080F7000-memory.dmpFilesize
1.3MB
-
memory/2664-134-0x0000000002DE0000-0x0000000002EEE000-memory.dmpFilesize
1.1MB
-
memory/2664-141-0x0000000007FB0000-0x00000000080F7000-memory.dmpFilesize
1.3MB
-
memory/2720-144-0x0000000000000000-mapping.dmp
-
memory/3624-151-0x0000000000DE0000-0x000000000112A000-memory.dmpFilesize
3.3MB
-
memory/3624-148-0x0000000000000000-mapping.dmp
-
memory/3796-136-0x0000000000630000-0x0000000000642000-memory.dmpFilesize
72KB
-
memory/3796-142-0x0000000000150000-0x000000000017C000-memory.dmpFilesize
176KB
-
memory/3796-140-0x00000000020E0000-0x0000000002170000-memory.dmpFilesize
576KB
-
memory/3796-139-0x00000000022C0000-0x000000000260A000-memory.dmpFilesize
3.3MB
-
memory/3796-137-0x0000000000150000-0x000000000017C000-memory.dmpFilesize
176KB
-
memory/3796-135-0x0000000000000000-mapping.dmp
-
memory/3848-132-0x0000000000FD0000-0x000000000131A000-memory.dmpFilesize
3.3MB
-
memory/3848-133-0x00000000008D0000-0x00000000008E1000-memory.dmpFilesize
68KB
-
memory/5104-146-0x0000000000000000-mapping.dmp