Analysis
-
max time kernel
40s -
max time network
11s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
21-01-2021 07:09
Static task
static1
Behavioral task
behavioral1
Sample
14f7d9b43392ee6fc45f4233cffd22af.exe
Resource
win7v20201028
General
-
Target
14f7d9b43392ee6fc45f4233cffd22af.exe
-
Size
1.0MB
-
MD5
14f7d9b43392ee6fc45f4233cffd22af
-
SHA1
549bd3b6249c5c3488e8ce7dd9c117f2aec2ee1a
-
SHA256
1a1316858bdc617d23e0330ddcde1958d2e95a083fa04020675ad4fb01780c46
-
SHA512
48f98e534452954b680e7b769c09b1425d46377d5da7afdb3237fc63c1a0e0f56d8635ea65ce64d77cc4501a2ffa7bde83a37e4198ada138300ca36dabc3cd83
Malware Config
Extracted
formbook
http://www.herbmedia.net/csv8/
slgacha.com
oohdough.com
6983ylc.com
aykassociate.com
latin-hotspot.com
starrockindia.com
beamsubway.com
queensboutique1000.com
madbaddie.com
bhoomimart.com
ankitparivar.com
aldanasanchezmx.com
citest1597669833.com
cristianofreitas.com
myplantus.com
counterfeitmilk.com
8xf39.com
pregnantwomens.com
yyyut6.com
stnanguo.com
fessusesefsee.com
logansshop.net
familydalmatianhomes.com
accessible.legal
epicmassiveconcepts.com
indianfactopedia.com
exit-divorce.com
colliapse.com
nosishop.com
hayat-aljowaily.com
soundon.events
previnacovid19-br.com
traptlongview.com
splendidhotelspa.com
masterzushop.com
ednevents.com
studentdividers.com
treningi-enduro.com
hostingcoaster.com
gourmetgroceriesfast.com
thesouthbeachlife.com
teemergin.com
fixmygearfast.com
arb-invest.com
shemaledreamz.com
1819apparel.com
thedigitalsatyam.com
alparmuhendislik.com
distinctmusicproductions.com
procreditexpert.com
insights4innovation.com
jzbtl.com
1033325.com
sorteocamper.info
scheherazadelegault.com
glowportraiture.com
cleitstaapps.com
globepublishers.com
stattests.com
brainandbodystrengthcoach.com
magenx2.info
escaparati.com
wood-decor24.com
travelnetafrica.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/400-10-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/400-11-0x000000000041D0C0-mapping.dmp xloader -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
14f7d9b43392ee6fc45f4233cffd22af.exedescription pid process target process PID 1932 set thread context of 400 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
14f7d9b43392ee6fc45f4233cffd22af.exe14f7d9b43392ee6fc45f4233cffd22af.exepid process 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 400 14f7d9b43392ee6fc45f4233cffd22af.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
14f7d9b43392ee6fc45f4233cffd22af.exedescription pid process Token: SeDebugPrivilege 1932 14f7d9b43392ee6fc45f4233cffd22af.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
14f7d9b43392ee6fc45f4233cffd22af.exedescription pid process target process PID 1932 wrote to memory of 604 1932 14f7d9b43392ee6fc45f4233cffd22af.exe schtasks.exe PID 1932 wrote to memory of 604 1932 14f7d9b43392ee6fc45f4233cffd22af.exe schtasks.exe PID 1932 wrote to memory of 604 1932 14f7d9b43392ee6fc45f4233cffd22af.exe schtasks.exe PID 1932 wrote to memory of 604 1932 14f7d9b43392ee6fc45f4233cffd22af.exe schtasks.exe PID 1932 wrote to memory of 436 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe PID 1932 wrote to memory of 436 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe PID 1932 wrote to memory of 436 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe PID 1932 wrote to memory of 436 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe PID 1932 wrote to memory of 400 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe PID 1932 wrote to memory of 400 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe PID 1932 wrote to memory of 400 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe PID 1932 wrote to memory of 400 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe PID 1932 wrote to memory of 400 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe PID 1932 wrote to memory of 400 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe PID 1932 wrote to memory of 400 1932 14f7d9b43392ee6fc45f4233cffd22af.exe 14f7d9b43392ee6fc45f4233cffd22af.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14f7d9b43392ee6fc45f4233cffd22af.exe"C:\Users\Admin\AppData\Local\Temp\14f7d9b43392ee6fc45f4233cffd22af.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\LvIUCJi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp93C7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\14f7d9b43392ee6fc45f4233cffd22af.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\14f7d9b43392ee6fc45f4233cffd22af.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp93C7.tmpMD5
79e6228a2b6018e04b833e8c01f22746
SHA18edf733ba0902ed9f101825b9b9628948045d309
SHA256786eb695b00b4366a98bb637257e9a9d03a56550df418ce7289adf8ca892498d
SHA512b38c402ba53f8eae5d25a83680b2543a7d3ac656c727833c94f4d67736e2a3c73e32d6d6c570fd8080282ac41339b0995464116d51d0cadefe662dfde81f5494
-
memory/400-10-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/400-11-0x000000000041D0C0-mapping.dmp
-
memory/400-13-0x0000000000A40000-0x0000000000D43000-memory.dmpFilesize
3.0MB
-
memory/604-8-0x0000000000000000-mapping.dmp
-
memory/1932-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1932-3-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1932-5-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/1932-6-0x00000000004F0000-0x00000000004FE000-memory.dmpFilesize
56KB
-
memory/1932-7-0x00000000051E0000-0x0000000005267000-memory.dmpFilesize
540KB