Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
25-04-2023 09:57
Static task
static1
Behavioral task
behavioral1
Sample
f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe
Resource
win7-20230220-en
General
-
Target
f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe
-
Size
352KB
-
MD5
fc7eb63804088472b1cac1ac9fe5d16f
-
SHA1
63205c7b5c84296478f1ad7d335aa06b8b7da536
-
SHA256
f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a
-
SHA512
57c0dcf7689e04e172d4adfdd6295618cb5695034739a4c57d0fd871b864345e54dd05ed5c3475579ff742c947202618c59db0ea351f52521e1cf7622f007734
-
SSDEEP
6144:UwxU76BJzteu9g8LJId0ER61it8LeZf5sm22UPLwkkBPPmK4vQniV:JU74eYg8ddER6C8LCKJ6PPmJvQiV
Malware Config
Extracted
xloader
2.5
d6cd
fatmerlion.com
gpo777.com
pacpointfg.com
s3k9r3de.com
jakitrade.com
tmsweets.biz
goodfoodsme.com
teddydefi.com
banahinvestments.com
kuvinziarno.quest
gma-bea10.com
onepotato.xyz
olympusconstructioncompany.com
amvids.info
tmc.wiki
swiftlybliss.com
provopreserve.com
rsvprose.com
staffremotely.com
diversifiedcontractingla.com
uniastroworld.com
becklily.top
lysa-security.com
socichat.one
sybarite.store
floridaevictionsattorney.com
designsbygemini.com
wsrtp.com
mobizoneoficial.com
newriverwinery.com
aminsfy.com
pinoytechnopreneur.com
license-taxi.online
morgan-supply.com
uka789.com
foodroutine.com
ctwchina.com
wexiyou.xyz
thermalsystems.net
outofthehands.com
resveratrol-us.com
skydaddy.store
riyad-ia.online
stockholderdemocracy.com
distressedthenblessed.com
proppainluv.com
pioquealoe.quest
studiospacestation.com
dhroad.com
relatedsearchesonline.com
loanofficerrecruiter.com
ginamora.com
timezaim.online
micron365.com
minhetouzi.com
allindesignz.com
irsokx.com
dream-kidz.com
markbizness.com
kurkuma-paderborn.com
shashistyle.com
ff4c6vgmi.xyz
sangsang23.com
toprealtorlincoln.com
theartistworth.com
Signatures
-
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1736-65-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1736-72-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1736-76-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1416-81-0x0000000000080000-0x00000000000A9000-memory.dmp xloader behavioral1/memory/1416-83-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
ktvrnf.exektvrnf.exepid process 1996 ktvrnf.exe 1736 ktvrnf.exe -
Loads dropped DLL 2 IoCs
Processes:
f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exektvrnf.exepid process 324 f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe 1996 ktvrnf.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ktvrnf.exektvrnf.exenetsh.exedescription pid process target process PID 1996 set thread context of 1736 1996 ktvrnf.exe ktvrnf.exe PID 1736 set thread context of 1360 1736 ktvrnf.exe Explorer.EXE PID 1736 set thread context of 1360 1736 ktvrnf.exe Explorer.EXE PID 1416 set thread context of 1360 1416 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
ktvrnf.exenetsh.exepid process 1736 ktvrnf.exe 1736 ktvrnf.exe 1736 ktvrnf.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe 1416 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ktvrnf.exenetsh.exepid process 1736 ktvrnf.exe 1736 ktvrnf.exe 1736 ktvrnf.exe 1736 ktvrnf.exe 1416 netsh.exe 1416 netsh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ktvrnf.exenetsh.exedescription pid process Token: SeDebugPrivilege 1736 ktvrnf.exe Token: SeDebugPrivilege 1416 netsh.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exektvrnf.exektvrnf.exenetsh.exedescription pid process target process PID 324 wrote to memory of 1996 324 f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe ktvrnf.exe PID 324 wrote to memory of 1996 324 f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe ktvrnf.exe PID 324 wrote to memory of 1996 324 f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe ktvrnf.exe PID 324 wrote to memory of 1996 324 f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe ktvrnf.exe PID 1996 wrote to memory of 1736 1996 ktvrnf.exe ktvrnf.exe PID 1996 wrote to memory of 1736 1996 ktvrnf.exe ktvrnf.exe PID 1996 wrote to memory of 1736 1996 ktvrnf.exe ktvrnf.exe PID 1996 wrote to memory of 1736 1996 ktvrnf.exe ktvrnf.exe PID 1996 wrote to memory of 1736 1996 ktvrnf.exe ktvrnf.exe PID 1996 wrote to memory of 1736 1996 ktvrnf.exe ktvrnf.exe PID 1996 wrote to memory of 1736 1996 ktvrnf.exe ktvrnf.exe PID 1736 wrote to memory of 1416 1736 ktvrnf.exe netsh.exe PID 1736 wrote to memory of 1416 1736 ktvrnf.exe netsh.exe PID 1736 wrote to memory of 1416 1736 ktvrnf.exe netsh.exe PID 1736 wrote to memory of 1416 1736 ktvrnf.exe netsh.exe PID 1416 wrote to memory of 368 1416 netsh.exe cmd.exe PID 1416 wrote to memory of 368 1416 netsh.exe cmd.exe PID 1416 wrote to memory of 368 1416 netsh.exe cmd.exe PID 1416 wrote to memory of 368 1416 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe"C:\Users\Admin\AppData\Local\Temp\f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ktvrnf.exeC:\Users\Admin\AppData\Local\Temp\ktvrnf.exe C:\Users\Admin\AppData\Local\Temp\krqtdytaag3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ktvrnf.exeC:\Users\Admin\AppData\Local\Temp\ktvrnf.exe C:\Users\Admin\AppData\Local\Temp\krqtdytaag4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ktvrnf.exe"6⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\krqtdytaagFilesize
4KB
MD5b2e7c8631c39f0df1e14be81e7482aaf
SHA1886c520daf38b08b4d32f3f522375cca39ad2c0b
SHA256eee2111c310af6f27fa8e5eb4a9378302bcd4a2a32397ca39119cd057158425f
SHA5121e858289210242b9fd87991e56f4db7fd30f3888fca4e8d78e845f781cdfee3ef508304c09f5d59c656ae933e67f6b9471ea7459721698a4cbedd39d6b7a7e6c
-
C:\Users\Admin\AppData\Local\Temp\ktvrnf.exeFilesize
117KB
MD5918b5b3ab8c29f68394eb7017a42aa85
SHA11a783f39a9ed81412bc018a0d54a116bf9de3277
SHA256b4e506d84bae993428232dd52683753944461f639b7228639be20000563a96e3
SHA5124a50d82e01690f12f6254f31f11db1fe69d40891b84675d4db25b55b90eb58a078ddafbeb125330df7dec31c6d6af752186ba57a05fd9eb5b6592b636885f672
-
C:\Users\Admin\AppData\Local\Temp\ktvrnf.exeFilesize
117KB
MD5918b5b3ab8c29f68394eb7017a42aa85
SHA11a783f39a9ed81412bc018a0d54a116bf9de3277
SHA256b4e506d84bae993428232dd52683753944461f639b7228639be20000563a96e3
SHA5124a50d82e01690f12f6254f31f11db1fe69d40891b84675d4db25b55b90eb58a078ddafbeb125330df7dec31c6d6af752186ba57a05fd9eb5b6592b636885f672
-
C:\Users\Admin\AppData\Local\Temp\ktvrnf.exeFilesize
117KB
MD5918b5b3ab8c29f68394eb7017a42aa85
SHA11a783f39a9ed81412bc018a0d54a116bf9de3277
SHA256b4e506d84bae993428232dd52683753944461f639b7228639be20000563a96e3
SHA5124a50d82e01690f12f6254f31f11db1fe69d40891b84675d4db25b55b90eb58a078ddafbeb125330df7dec31c6d6af752186ba57a05fd9eb5b6592b636885f672
-
C:\Users\Admin\AppData\Local\Temp\l3vfu7hizn2Filesize
210KB
MD55250e815ed0a5fb4eb4f2c9675dfb7e8
SHA146a0b7ddfd941e667e1201dd511a22b9a981cd3d
SHA2560439dbfaa3df7150e41a27bf65f511c3ebb4c1fbbf8b005983c51013b496bc0c
SHA512e31ebda956be17a00e2632a1a10e25dc3070a5feda166354c8dec5accd52e10c353d22ec5447f87f489f24163cd17bbd26a9d50cd3ec48063409293341702cf9
-
\Users\Admin\AppData\Local\Temp\ktvrnf.exeFilesize
117KB
MD5918b5b3ab8c29f68394eb7017a42aa85
SHA11a783f39a9ed81412bc018a0d54a116bf9de3277
SHA256b4e506d84bae993428232dd52683753944461f639b7228639be20000563a96e3
SHA5124a50d82e01690f12f6254f31f11db1fe69d40891b84675d4db25b55b90eb58a078ddafbeb125330df7dec31c6d6af752186ba57a05fd9eb5b6592b636885f672
-
\Users\Admin\AppData\Local\Temp\ktvrnf.exeFilesize
117KB
MD5918b5b3ab8c29f68394eb7017a42aa85
SHA11a783f39a9ed81412bc018a0d54a116bf9de3277
SHA256b4e506d84bae993428232dd52683753944461f639b7228639be20000563a96e3
SHA5124a50d82e01690f12f6254f31f11db1fe69d40891b84675d4db25b55b90eb58a078ddafbeb125330df7dec31c6d6af752186ba57a05fd9eb5b6592b636885f672
-
memory/1360-89-0x0000000006C70000-0x0000000006DC7000-memory.dmpFilesize
1.3MB
-
memory/1360-87-0x0000000006C70000-0x0000000006DC7000-memory.dmpFilesize
1.3MB
-
memory/1360-85-0x0000000006C70000-0x0000000006DC7000-memory.dmpFilesize
1.3MB
-
memory/1360-71-0x0000000006A10000-0x0000000006BB4000-memory.dmpFilesize
1.6MB
-
memory/1360-75-0x00000000064A0000-0x00000000065C6000-memory.dmpFilesize
1.1MB
-
memory/1360-73-0x00000000036E0000-0x00000000037E0000-memory.dmpFilesize
1024KB
-
memory/1416-81-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1416-78-0x00000000013A0000-0x00000000013BB000-memory.dmpFilesize
108KB
-
memory/1416-80-0x00000000013A0000-0x00000000013BB000-memory.dmpFilesize
108KB
-
memory/1416-82-0x0000000000B40000-0x0000000000E43000-memory.dmpFilesize
3.0MB
-
memory/1416-83-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1416-84-0x0000000000450000-0x00000000004E0000-memory.dmpFilesize
576KB
-
memory/1736-74-0x0000000000390000-0x00000000003A1000-memory.dmpFilesize
68KB
-
memory/1736-76-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1736-72-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1736-70-0x0000000000350000-0x0000000000361000-memory.dmpFilesize
68KB
-
memory/1736-68-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/1736-65-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB