Analysis
-
max time kernel
149s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 08:31
Static task
static1
Behavioral task
behavioral1
Sample
yxrp7aBc7KHBCsk.exe
Resource
win7-20220812-en
General
-
Target
yxrp7aBc7KHBCsk.exe
-
Size
1.1MB
-
MD5
48ab3af9d46affb38d6bba63215f606f
-
SHA1
5a5f9ddc5cf46787a03c8cefe1c038274b69f2eb
-
SHA256
0b064f0ef5c1fc97add6a750c3166edc03d6ebbcf0ed5b0e36cec598ff2e301e
-
SHA512
7eea0bfbd69f74003a5a24c6ae9cfcb13321454e932bee8026a6ef636e5ad9750aff3b081b6f3bd031578c600df9e3e2a6f0122551540aa23f5ec174bae33647
-
SSDEEP
24576:0ufO+8zjZ1dSvam6fNgyDh1u7hDi7hdqkMzjVfr:nz8zjZbSz6Vy7UT5OJfr
Malware Config
Extracted
formbook
cqd8
9zPItsSBQPthH0B1
iyz2ugC7TUMEaZEDDTNIzw==
uVc25zCFO03zbYzHxXLElk5HHccFoes=
RYDZw1su7yszucXjwqtgrz1tSccFoes=
AiB+KfBdDLRFs8sOAsmAllKZeg==
w5T7/Y1lNGBeMdKkKNl8tUl3fTWjlURG
mcIHqPCaEavSyg==
YA7dyN6xKf1MKJa/RA==
Dt789IRVd/fO8FeQNOiV3g==
jYfu3dS4b/1OL59exnPPEo4=
SjyOSKD6lRhpWwUmMwE8ncB1KOg=
JIT782/TaO41DXw3hYJa1g==
uT4u7SwA+3yA/iCo0O7tHyeffA==
/gJzPfngDySzwndmyHPPEo4=
+Um8wD7b9bCQ8A9cK4Nl1oA=
RaikVqx5ozxW3vd6khgIHsDMgKrv
hyYEyRMIEJ8WdnFePeLgHyeffA==
bCov6raFJ30odm5fJQQ=
1rMMrXrTf7OZqyLVM708wZ0=
U4nspOC6sJ3et2I=
Amsy4i4MxPTrXYWeojyK
qqYLwgp2O/CAx73ntWL3DLmD
v+o9+ruZZv5gEuvofQ4=
Q2TEpDYKHJSOCCGbqS91tm+gZCM193JQ
myoIxQ/iiohHn17RlzWI
rzQd05nrgI907Re4QPfYHyeffA==
QkC8sCmTTfZrZLz5hAw=
t5r3o/G/cZ+vdu+g+oMEE8B1KOg=
C0u8wFktz793xKe4jnATIMyJ
TjKaV5ZbDyQHOJcUcFCC
djpCCcmZXwlBpMPyIUZf3A==
Un779oxhdgtHI8SnDdcOIJc=
YKgTvQjejYw4pbqeojyK
KBd0a2BKX1jU15Ctom33DLmD
aZ7/sQblqNS+Nla7AauEB8sNyUDm9Cki3A==
zJhnWWws5JL973c6hYJa1g==
gb0n1xj1K9MC+ad0z3Q9RRUT7+A=
0sQMsgbWCJyyZFPrSA==
20IjpORM6MDYxQ==
N2y7vVIlDbMG+AQ9Xw==
agEIEhBjAg3OQ16NYNzfakfMbRKp7w==
wDsU0Rr/6MDYxQ==
NTeghQ12G3s0MZTduZkswZ8=
L97Zk19BYXUZfWlr/Hbj7Vt5T8cFoes=
YHzblVUr2IQblbeeojyK
NWrc623LYOxVqMvtvtcOIJc=
Dop0ZWnNM31cvnASfhs=
cKw08CYD6MDYxQ==
lz8u3baYpK4zHYw3hw6iJc3MgKrv
0Z9yXF01VUO1A/rtvHT3DLmD
7IxuWmMwLzEGXXr7TPzbHyeffA==
S+IyyYGNQ+w=
OWLEsDwEJcYYEcOg8Jv2NZ0=
hpoR35NpipozlYN/D8SS7rT7bRKp7w==
mZgB83regxFgYgTmbOhb3LW2m5Sa02tO
P4jc4mGzUuhRSebNpG73DLmD
rjMAwp8+nZxq
t9Ab0ZFjaHgssun2RiGA
CEKgRx1lGCe1DvvzfjFHWAGQNu4=
295oZvzAc4xt4wVshYJa1g==
+f5vXOqxxTQWorueojyK
CMKeTBzmgQ+IlQgskhU=
2lhYTVMvVGIRj7GeojyK
BCq+UU4+nZxq
tornoallavita.com
Extracted
xloader
3.8
cqd8
9zPItsSBQPthH0B1
iyz2ugC7TUMEaZEDDTNIzw==
uVc25zCFO03zbYzHxXLElk5HHccFoes=
RYDZw1su7yszucXjwqtgrz1tSccFoes=
AiB+KfBdDLRFs8sOAsmAllKZeg==
w5T7/Y1lNGBeMdKkKNl8tUl3fTWjlURG
mcIHqPCaEavSyg==
YA7dyN6xKf1MKJa/RA==
Dt789IRVd/fO8FeQNOiV3g==
jYfu3dS4b/1OL59exnPPEo4=
SjyOSKD6lRhpWwUmMwE8ncB1KOg=
JIT782/TaO41DXw3hYJa1g==
uT4u7SwA+3yA/iCo0O7tHyeffA==
/gJzPfngDySzwndmyHPPEo4=
+Um8wD7b9bCQ8A9cK4Nl1oA=
RaikVqx5ozxW3vd6khgIHsDMgKrv
hyYEyRMIEJ8WdnFePeLgHyeffA==
bCov6raFJ30odm5fJQQ=
1rMMrXrTf7OZqyLVM708wZ0=
U4nspOC6sJ3et2I=
Amsy4i4MxPTrXYWeojyK
qqYLwgp2O/CAx73ntWL3DLmD
v+o9+ruZZv5gEuvofQ4=
Q2TEpDYKHJSOCCGbqS91tm+gZCM193JQ
myoIxQ/iiohHn17RlzWI
rzQd05nrgI907Re4QPfYHyeffA==
QkC8sCmTTfZrZLz5hAw=
t5r3o/G/cZ+vdu+g+oMEE8B1KOg=
C0u8wFktz793xKe4jnATIMyJ
TjKaV5ZbDyQHOJcUcFCC
djpCCcmZXwlBpMPyIUZf3A==
Un779oxhdgtHI8SnDdcOIJc=
YKgTvQjejYw4pbqeojyK
KBd0a2BKX1jU15Ctom33DLmD
aZ7/sQblqNS+Nla7AauEB8sNyUDm9Cki3A==
zJhnWWws5JL973c6hYJa1g==
gb0n1xj1K9MC+ad0z3Q9RRUT7+A=
0sQMsgbWCJyyZFPrSA==
20IjpORM6MDYxQ==
N2y7vVIlDbMG+AQ9Xw==
agEIEhBjAg3OQ16NYNzfakfMbRKp7w==
wDsU0Rr/6MDYxQ==
NTeghQ12G3s0MZTduZkswZ8=
L97Zk19BYXUZfWlr/Hbj7Vt5T8cFoes=
YHzblVUr2IQblbeeojyK
NWrc623LYOxVqMvtvtcOIJc=
Dop0ZWnNM31cvnASfhs=
cKw08CYD6MDYxQ==
lz8u3baYpK4zHYw3hw6iJc3MgKrv
0Z9yXF01VUO1A/rtvHT3DLmD
7IxuWmMwLzEGXXr7TPzbHyeffA==
S+IyyYGNQ+w=
OWLEsDwEJcYYEcOg8Jv2NZ0=
hpoR35NpipozlYN/D8SS7rT7bRKp7w==
mZgB83regxFgYgTmbOhb3LW2m5Sa02tO
P4jc4mGzUuhRSebNpG73DLmD
rjMAwp8+nZxq
t9Ab0ZFjaHgssun2RiGA
CEKgRx1lGCe1DvvzfjFHWAGQNu4=
295oZvzAc4xt4wVshYJa1g==
+f5vXOqxxTQWorueojyK
CMKeTBzmgQ+IlQgskhU=
2lhYTVMvVGIRj7GeojyK
BCq+UU4+nZxq
tornoallavita.com
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
yxrp7aBc7KHBCsk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\International\Geo\Nation yxrp7aBc7KHBCsk.exe -
Loads dropped DLL 1 IoCs
Processes:
help.exepid process 884 help.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
yxrp7aBc7KHBCsk.exeyxrp7aBc7KHBCsk.exehelp.exedescription pid process target process PID 964 set thread context of 1220 964 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 1220 set thread context of 1268 1220 yxrp7aBc7KHBCsk.exe Explorer.EXE PID 884 set thread context of 1268 884 help.exe Explorer.EXE -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
yxrp7aBc7KHBCsk.exehelp.exepid process 1220 yxrp7aBc7KHBCsk.exe 1220 yxrp7aBc7KHBCsk.exe 1220 yxrp7aBc7KHBCsk.exe 1220 yxrp7aBc7KHBCsk.exe 884 help.exe 884 help.exe 884 help.exe 884 help.exe 884 help.exe 884 help.exe 884 help.exe 884 help.exe 884 help.exe 884 help.exe 884 help.exe 884 help.exe 884 help.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
yxrp7aBc7KHBCsk.exehelp.exepid process 1220 yxrp7aBc7KHBCsk.exe 1220 yxrp7aBc7KHBCsk.exe 1220 yxrp7aBc7KHBCsk.exe 884 help.exe 884 help.exe 884 help.exe 884 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
yxrp7aBc7KHBCsk.exehelp.exedescription pid process Token: SeDebugPrivilege 1220 yxrp7aBc7KHBCsk.exe Token: SeDebugPrivilege 884 help.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
yxrp7aBc7KHBCsk.exeExplorer.EXEpid process 964 yxrp7aBc7KHBCsk.exe 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
yxrp7aBc7KHBCsk.exeExplorer.EXEpid process 964 yxrp7aBc7KHBCsk.exe 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
yxrp7aBc7KHBCsk.exeExplorer.EXEhelp.exedescription pid process target process PID 964 wrote to memory of 1220 964 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 964 wrote to memory of 1220 964 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 964 wrote to memory of 1220 964 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 964 wrote to memory of 1220 964 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 964 wrote to memory of 1220 964 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 964 wrote to memory of 1220 964 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 964 wrote to memory of 1220 964 yxrp7aBc7KHBCsk.exe yxrp7aBc7KHBCsk.exe PID 1268 wrote to memory of 884 1268 Explorer.EXE help.exe PID 1268 wrote to memory of 884 1268 Explorer.EXE help.exe PID 1268 wrote to memory of 884 1268 Explorer.EXE help.exe PID 1268 wrote to memory of 884 1268 Explorer.EXE help.exe PID 884 wrote to memory of 760 884 help.exe Firefox.exe PID 884 wrote to memory of 760 884 help.exe Firefox.exe PID 884 wrote to memory of 760 884 help.exe Firefox.exe PID 884 wrote to memory of 760 884 help.exe Firefox.exe PID 884 wrote to memory of 760 884 help.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yxrp7aBc7KHBCsk.exe"C:\Users\Admin\AppData\Local\Temp\yxrp7aBc7KHBCsk.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\yxrp7aBc7KHBCsk.exe"C:\Users\Admin\AppData\Local\Temp\yxrp7aBc7KHBCsk.exe"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\sqlite3.dllFilesize
832KB
MD507fb6d31f37fb1b4164bef301306c288
SHA14cb41af6d63a07324ef6b18b1a1f43ce94e25626
SHA25606ddf0a370af00d994824605a8e1307ba138f89b2d864539f0d19e8804edac02
SHA512cab4a7c5805b80851aba5f2c9b001fabc1416f6648d891f49eacc81fe79287c5baa01306a42298da722750b812a4ea85388ffae9200dcf656dd1d5b5b9323353
-
memory/884-75-0x0000000000E70000-0x0000000000E76000-memory.dmpFilesize
24KB
-
memory/884-76-0x00000000006C0000-0x00000000009C3000-memory.dmpFilesize
3.0MB
-
memory/884-74-0x0000000000000000-mapping.dmp
-
memory/884-77-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/884-79-0x00000000009D0000-0x0000000000A5F000-memory.dmpFilesize
572KB
-
memory/884-81-0x0000000000080000-0x00000000000AD000-memory.dmpFilesize
180KB
-
memory/964-57-0x0000000004E65000-0x0000000004E76000-memory.dmpFilesize
68KB
-
memory/964-54-0x0000000000960000-0x0000000000A82000-memory.dmpFilesize
1.1MB
-
memory/964-60-0x0000000004EA0000-0x0000000004F14000-memory.dmpFilesize
464KB
-
memory/964-67-0x0000000004E65000-0x0000000004E76000-memory.dmpFilesize
68KB
-
memory/964-59-0x0000000008110000-0x00000000081DC000-memory.dmpFilesize
816KB
-
memory/964-58-0x00000000006D0000-0x00000000006DC000-memory.dmpFilesize
48KB
-
memory/964-56-0x00000000006A0000-0x00000000006BC000-memory.dmpFilesize
112KB
-
memory/964-55-0x0000000074AB1000-0x0000000074AB3000-memory.dmpFilesize
8KB
-
memory/1220-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1220-70-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1220-71-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/1220-72-0x00000000000E0000-0x00000000000F0000-memory.dmpFilesize
64KB
-
memory/1220-69-0x0000000000A90000-0x0000000000D93000-memory.dmpFilesize
3.0MB
-
memory/1220-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1220-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1220-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1220-65-0x00000000004012B0-mapping.dmp
-
memory/1268-73-0x0000000004D40000-0x0000000004ECF000-memory.dmpFilesize
1.6MB
-
memory/1268-80-0x0000000004D40000-0x0000000004ECF000-memory.dmpFilesize
1.6MB
-
memory/1268-82-0x0000000006B90000-0x0000000006D05000-memory.dmpFilesize
1.5MB
-
memory/1268-83-0x0000000006B90000-0x0000000006D05000-memory.dmpFilesize
1.5MB