Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2023 09:57
Static task
static1
Behavioral task
behavioral1
Sample
f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe
Resource
win7-20230220-en
General
-
Target
f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe
-
Size
352KB
-
MD5
fc7eb63804088472b1cac1ac9fe5d16f
-
SHA1
63205c7b5c84296478f1ad7d335aa06b8b7da536
-
SHA256
f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a
-
SHA512
57c0dcf7689e04e172d4adfdd6295618cb5695034739a4c57d0fd871b864345e54dd05ed5c3475579ff742c947202618c59db0ea351f52521e1cf7622f007734
-
SSDEEP
6144:UwxU76BJzteu9g8LJId0ER61it8LeZf5sm22UPLwkkBPPmK4vQniV:JU74eYg8ddER6C8LCKJ6PPmJvQiV
Malware Config
Extracted
xloader
2.5
d6cd
fatmerlion.com
gpo777.com
pacpointfg.com
s3k9r3de.com
jakitrade.com
tmsweets.biz
goodfoodsme.com
teddydefi.com
banahinvestments.com
kuvinziarno.quest
gma-bea10.com
onepotato.xyz
olympusconstructioncompany.com
amvids.info
tmc.wiki
swiftlybliss.com
provopreserve.com
rsvprose.com
staffremotely.com
diversifiedcontractingla.com
uniastroworld.com
becklily.top
lysa-security.com
socichat.one
sybarite.store
floridaevictionsattorney.com
designsbygemini.com
wsrtp.com
mobizoneoficial.com
newriverwinery.com
aminsfy.com
pinoytechnopreneur.com
license-taxi.online
morgan-supply.com
uka789.com
foodroutine.com
ctwchina.com
wexiyou.xyz
thermalsystems.net
outofthehands.com
resveratrol-us.com
skydaddy.store
riyad-ia.online
stockholderdemocracy.com
distressedthenblessed.com
proppainluv.com
pioquealoe.quest
studiospacestation.com
dhroad.com
relatedsearchesonline.com
loanofficerrecruiter.com
ginamora.com
timezaim.online
micron365.com
minhetouzi.com
allindesignz.com
irsokx.com
dream-kidz.com
markbizness.com
kurkuma-paderborn.com
shashistyle.com
ff4c6vgmi.xyz
sangsang23.com
toprealtorlincoln.com
theartistworth.com
Signatures
-
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/812-141-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/812-146-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1736-153-0x0000000000FC0000-0x0000000000FE9000-memory.dmp xloader behavioral2/memory/1736-155-0x0000000000FC0000-0x0000000000FE9000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
ktvrnf.exektvrnf.exepid process 1104 ktvrnf.exe 812 ktvrnf.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ktvrnf.exektvrnf.exeNETSTAT.EXEdescription pid process target process PID 1104 set thread context of 812 1104 ktvrnf.exe ktvrnf.exe PID 812 set thread context of 3132 812 ktvrnf.exe Explorer.EXE PID 1736 set thread context of 3132 1736 NETSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1736 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
ktvrnf.exeNETSTAT.EXEpid process 812 ktvrnf.exe 812 ktvrnf.exe 812 ktvrnf.exe 812 ktvrnf.exe 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE 1736 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3132 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
ktvrnf.exeNETSTAT.EXEpid process 812 ktvrnf.exe 812 ktvrnf.exe 812 ktvrnf.exe 1736 NETSTAT.EXE 1736 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ktvrnf.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 812 ktvrnf.exe Token: SeDebugPrivilege 1736 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exektvrnf.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 4644 wrote to memory of 1104 4644 f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe ktvrnf.exe PID 4644 wrote to memory of 1104 4644 f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe ktvrnf.exe PID 4644 wrote to memory of 1104 4644 f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe ktvrnf.exe PID 1104 wrote to memory of 812 1104 ktvrnf.exe ktvrnf.exe PID 1104 wrote to memory of 812 1104 ktvrnf.exe ktvrnf.exe PID 1104 wrote to memory of 812 1104 ktvrnf.exe ktvrnf.exe PID 1104 wrote to memory of 812 1104 ktvrnf.exe ktvrnf.exe PID 1104 wrote to memory of 812 1104 ktvrnf.exe ktvrnf.exe PID 1104 wrote to memory of 812 1104 ktvrnf.exe ktvrnf.exe PID 3132 wrote to memory of 1736 3132 Explorer.EXE NETSTAT.EXE PID 3132 wrote to memory of 1736 3132 Explorer.EXE NETSTAT.EXE PID 3132 wrote to memory of 1736 3132 Explorer.EXE NETSTAT.EXE PID 1736 wrote to memory of 2312 1736 NETSTAT.EXE cmd.exe PID 1736 wrote to memory of 2312 1736 NETSTAT.EXE cmd.exe PID 1736 wrote to memory of 2312 1736 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe"C:\Users\Admin\AppData\Local\Temp\f7d7da0700921b339807b5977c36fce50742c5ce87f432d357f9d3e8e683785a.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ktvrnf.exeC:\Users\Admin\AppData\Local\Temp\ktvrnf.exe C:\Users\Admin\AppData\Local\Temp\krqtdytaag3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ktvrnf.exeC:\Users\Admin\AppData\Local\Temp\ktvrnf.exe C:\Users\Admin\AppData\Local\Temp\krqtdytaag4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ktvrnf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\krqtdytaagFilesize
4KB
MD5b2e7c8631c39f0df1e14be81e7482aaf
SHA1886c520daf38b08b4d32f3f522375cca39ad2c0b
SHA256eee2111c310af6f27fa8e5eb4a9378302bcd4a2a32397ca39119cd057158425f
SHA5121e858289210242b9fd87991e56f4db7fd30f3888fca4e8d78e845f781cdfee3ef508304c09f5d59c656ae933e67f6b9471ea7459721698a4cbedd39d6b7a7e6c
-
C:\Users\Admin\AppData\Local\Temp\ktvrnf.exeFilesize
117KB
MD5918b5b3ab8c29f68394eb7017a42aa85
SHA11a783f39a9ed81412bc018a0d54a116bf9de3277
SHA256b4e506d84bae993428232dd52683753944461f639b7228639be20000563a96e3
SHA5124a50d82e01690f12f6254f31f11db1fe69d40891b84675d4db25b55b90eb58a078ddafbeb125330df7dec31c6d6af752186ba57a05fd9eb5b6592b636885f672
-
C:\Users\Admin\AppData\Local\Temp\ktvrnf.exeFilesize
117KB
MD5918b5b3ab8c29f68394eb7017a42aa85
SHA11a783f39a9ed81412bc018a0d54a116bf9de3277
SHA256b4e506d84bae993428232dd52683753944461f639b7228639be20000563a96e3
SHA5124a50d82e01690f12f6254f31f11db1fe69d40891b84675d4db25b55b90eb58a078ddafbeb125330df7dec31c6d6af752186ba57a05fd9eb5b6592b636885f672
-
C:\Users\Admin\AppData\Local\Temp\ktvrnf.exeFilesize
117KB
MD5918b5b3ab8c29f68394eb7017a42aa85
SHA11a783f39a9ed81412bc018a0d54a116bf9de3277
SHA256b4e506d84bae993428232dd52683753944461f639b7228639be20000563a96e3
SHA5124a50d82e01690f12f6254f31f11db1fe69d40891b84675d4db25b55b90eb58a078ddafbeb125330df7dec31c6d6af752186ba57a05fd9eb5b6592b636885f672
-
C:\Users\Admin\AppData\Local\Temp\l3vfu7hizn2Filesize
210KB
MD55250e815ed0a5fb4eb4f2c9675dfb7e8
SHA146a0b7ddfd941e667e1201dd511a22b9a981cd3d
SHA2560439dbfaa3df7150e41a27bf65f511c3ebb4c1fbbf8b005983c51013b496bc0c
SHA512e31ebda956be17a00e2632a1a10e25dc3070a5feda166354c8dec5accd52e10c353d22ec5447f87f489f24163cd17bbd26a9d50cd3ec48063409293341702cf9
-
memory/812-147-0x0000000000AA0000-0x0000000000AB1000-memory.dmpFilesize
68KB
-
memory/812-145-0x0000000000AC0000-0x0000000000E0A000-memory.dmpFilesize
3.3MB
-
memory/812-146-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/812-141-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1736-157-0x0000000001730000-0x00000000017C0000-memory.dmpFilesize
576KB
-
memory/1736-150-0x0000000000190000-0x000000000019B000-memory.dmpFilesize
44KB
-
memory/1736-152-0x0000000000190000-0x000000000019B000-memory.dmpFilesize
44KB
-
memory/1736-153-0x0000000000FC0000-0x0000000000FE9000-memory.dmpFilesize
164KB
-
memory/1736-154-0x00000000018B0000-0x0000000001BFA000-memory.dmpFilesize
3.3MB
-
memory/1736-155-0x0000000000FC0000-0x0000000000FE9000-memory.dmpFilesize
164KB
-
memory/3132-148-0x0000000008E70000-0x0000000008F1F000-memory.dmpFilesize
700KB
-
memory/3132-158-0x0000000008F20000-0x00000000090B0000-memory.dmpFilesize
1.6MB
-
memory/3132-159-0x0000000008F20000-0x00000000090B0000-memory.dmpFilesize
1.6MB
-
memory/3132-161-0x0000000008F20000-0x00000000090B0000-memory.dmpFilesize
1.6MB