Overview
overview
10Static
static
10XPloit.zip
windows7-x64
3XPloit.zip
windows10-2004-x64
1ForlornApi.dll
windows7-x64
1ForlornApi.dll
windows10-2004-x64
1ForlornInject.dll
windows7-x64
1ForlornInject.dll
windows10-2004-x64
7XPloit.deps.json
windows7-x64
3XPloit.deps.json
windows10-2004-x64
3XPloit.exe
windows7-x64
10XPloit.exe
windows10-2004-x64
10XPloit.exe
windows7-x64
10XPloit.exe
windows10-2004-x64
10main.pyc
windows7-x64
3main.pyc
windows10-2004-x64
3XPloit.pdb
windows7-x64
3XPloit.pdb
windows10-2004-x64
3XPloit.run...g.json
windows7-x64
3XPloit.run...g.json
windows10-2004-x64
3workspace/IY_FE.iy
windows7-x64
3workspace/IY_FE.iy
windows10-2004-x64
3workspace/...s.json
windows7-x64
3workspace/...s.json
windows10-2004-x64
3Resubmissions
21-12-2024 17:42
241221-v9y3xavlaz 1020-12-2024 23:19
241220-3bbtqawpat 1020-12-2024 19:29
241220-x7fjwssqdm 10Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-12-2024 17:42
Behavioral task
behavioral1
Sample
XPloit.zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
XPloit.zip
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
ForlornApi.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
ForlornApi.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
ForlornInject.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
ForlornInject.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
XPloit.deps.json
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
XPloit.deps.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
XPloit.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
XPloit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
XPloit.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
XPloit.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
main.pyc
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
main.pyc
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
XPloit.pdb
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
XPloit.pdb
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
XPloit.runtimeconfig.json
Resource
win7-20241023-en
Behavioral task
behavioral18
Sample
XPloit.runtimeconfig.json
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
workspace/IY_FE.iy
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
workspace/IY_FE.iy
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
workspace/MercurySettings.json
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
workspace/MercurySettings.json
Resource
win10v2004-20241007-en
General
-
Target
XPloit.runtimeconfig.json
-
Size
443B
-
MD5
9db099f143ead47e224653d0dde19fe9
-
SHA1
d050db767fc64aa1705353132da3e35048475d3c
-
SHA256
7e79af92820e50910b90f1cade2728f45987393f24b50e384dc225d9773b7194
-
SHA512
579c3c870903b3d47dbc2567153fa7c73e0aa47387c6969b8982037884033a4b25de702e0efb8c7ae717b6b463192b917b18a79b1ef5f8c969f257422af2b65f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 216 OpenWith.exe
Processes
Network
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request28.118.140.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request136.71.105.51.in-addr.arpaIN PTRResponse
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
133.211.185.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
140.32.126.40.in-addr.arpa
DNS Request
140.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
28.118.140.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
56.163.245.4.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
11.227.111.52.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
136.71.105.51.in-addr.arpa