Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
26-02-2021 06:43
Static task
static1
Behavioral task
behavioral1
Sample
Ordine -159-pdf.exe
Resource
win7v20201028
General
-
Target
Ordine -159-pdf.exe
-
Size
212KB
-
MD5
77ef1adb73a2c4bf01fa2c3521b5df8e
-
SHA1
dca2092fd1a203ba7d6bb9f043620a1b1700fca2
-
SHA256
61b36d9d2e055b9e7be872cd42f44e78e9abfd505e5bc4e719d5b9801200d99e
-
SHA512
a7efeae6777e57d14b09909b9c5f3d20e39afc03fc93e032482819b5292b02cb88d74d44f7ec0b24ada41e59bc0b3a9faeb1683430c1fabb18cf5cb52804ef6e
Malware Config
Extracted
formbook
http://www.northwestcitraland.com/uqf5/
chennaimarketplace.com
connect-c-mutue1.com
red4x.com
hongbei413.com
hckjxx.club
leadingdatasms.com
flash2mp3.com
njjvxin.com
bostonm.info
sgvision.net
linkit-mx.online
preferential.today
wmcanesthesiology.com
nationallawfulassent.com
atelierlun.com
hydeparkattulsahills.com
jamesprep.com
forcexconsulting.com
funkyleo.com
blackownedcapital.com
diversifiedappraisal.info
just-trump2020.com
hk-attorneys.com
thehairandnailcabin.com
unitedhealthequipment.com
ivvymo.com
getthepicshare.com
nutriclub-online.com
ytruifeng.com
515-capital.com
baixingxieye.com
autowarrantygurus.com
iaauh.com
yardsandfeets.com
baoyongshiye.com
zaorski.trade
atz.xyz
28yunce.com
assessoriasolverebrasil.com
gdballoon.com
torocyncocomix.com
jamorootsmusic.com
chinametercloud.com
suggenda.com
thesimsrecouce.com
collins-white.com
heathenweddings.com
goldandfeathers.com
glamsfaceshield.com
thegoldlite.com
nbpunch.com
kidsfashionconscious.cloud
cataphstfa.com
kefu.press
twist-la.com
mujerydeportes.com
altilium-metals.com
distritobotana.com
icaroagencia.com
astrapropre.com
northofthecities.com
thecapitalitaim.com
thykingdomcome.love
nutritionalproductions.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1580-6-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1788-15-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1904 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
Ordine -159-pdf.exepid process 2028 Ordine -159-pdf.exe 2028 Ordine -159-pdf.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Ordine -159-pdf.exeOrdine -159-pdf.exeexplorer.exedescription pid process target process PID 2028 set thread context of 1580 2028 Ordine -159-pdf.exe Ordine -159-pdf.exe PID 1580 set thread context of 1252 1580 Ordine -159-pdf.exe Explorer.EXE PID 1788 set thread context of 1252 1788 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
Ordine -159-pdf.exeOrdine -159-pdf.exeexplorer.exepid process 2028 Ordine -159-pdf.exe 2028 Ordine -159-pdf.exe 2028 Ordine -159-pdf.exe 2028 Ordine -159-pdf.exe 1580 Ordine -159-pdf.exe 1580 Ordine -159-pdf.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe 1788 explorer.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Ordine -159-pdf.exeOrdine -159-pdf.exeexplorer.exepid process 2028 Ordine -159-pdf.exe 1580 Ordine -159-pdf.exe 1580 Ordine -159-pdf.exe 1580 Ordine -159-pdf.exe 1788 explorer.exe 1788 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Ordine -159-pdf.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1580 Ordine -159-pdf.exe Token: SeDebugPrivilege 1788 explorer.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Ordine -159-pdf.exeExplorer.EXEexplorer.exedescription pid process target process PID 2028 wrote to memory of 1580 2028 Ordine -159-pdf.exe Ordine -159-pdf.exe PID 2028 wrote to memory of 1580 2028 Ordine -159-pdf.exe Ordine -159-pdf.exe PID 2028 wrote to memory of 1580 2028 Ordine -159-pdf.exe Ordine -159-pdf.exe PID 2028 wrote to memory of 1580 2028 Ordine -159-pdf.exe Ordine -159-pdf.exe PID 2028 wrote to memory of 1580 2028 Ordine -159-pdf.exe Ordine -159-pdf.exe PID 1252 wrote to memory of 1788 1252 Explorer.EXE explorer.exe PID 1252 wrote to memory of 1788 1252 Explorer.EXE explorer.exe PID 1252 wrote to memory of 1788 1252 Explorer.EXE explorer.exe PID 1252 wrote to memory of 1788 1252 Explorer.EXE explorer.exe PID 1788 wrote to memory of 1904 1788 explorer.exe cmd.exe PID 1788 wrote to memory of 1904 1788 explorer.exe cmd.exe PID 1788 wrote to memory of 1904 1788 explorer.exe cmd.exe PID 1788 wrote to memory of 1904 1788 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\Ordine -159-pdf.exe"C:\Users\Admin\AppData\Local\Temp\Ordine -159-pdf.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\Ordine -159-pdf.exe"C:\Users\Admin\AppData\Local\Temp\Ordine -159-pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1580 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Ordine -159-pdf.exe"3⤵
- Deletes itself
PID:1904
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\9e8l7wc53tl.dllMD5
1d16d1a1f10db85d1ccc19a53a9fb425
SHA10da84b1cfab34bd7dec54ad7a3574649645acb41
SHA2560a503b80e7e37f257eea874d37cd2dfe616db0ecd8a817c848381eb48f74e0da
SHA512cc900e954d7886201c3dac2994f7b97b7386dd097bf1c64ebded6fff7c9aafe247916a6fb4e4646f2e87a51d33b4c147b7b313e94a27654bb63264d951c4ded8
-
\Users\Admin\AppData\Local\Temp\nsnB96.tmp\System.dllMD5
fccff8cb7a1067e23fd2e2b63971a8e1
SHA130e2a9e137c1223a78a0f7b0bf96a1c361976d91
SHA2566fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e
SHA512f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c
-
memory/1252-18-0x0000000009100000-0x000000000928C000-memory.dmpFilesize
1.5MB
-
memory/1252-9-0x0000000006F70000-0x000000000710F000-memory.dmpFilesize
1.6MB
-
memory/1580-5-0x000000000041D0A0-mapping.dmp
-
memory/1580-6-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1580-7-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/1580-8-0x0000000000360000-0x0000000000371000-memory.dmpFilesize
68KB
-
memory/1788-10-0x0000000000000000-mapping.dmp
-
memory/1788-12-0x0000000075461000-0x0000000075463000-memory.dmpFilesize
8KB
-
memory/1788-14-0x0000000000280000-0x0000000000501000-memory.dmpFilesize
2.5MB
-
memory/1788-15-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1788-16-0x00000000022D0000-0x00000000025D3000-memory.dmpFilesize
3.0MB
-
memory/1788-17-0x0000000002140000-0x00000000021D0000-memory.dmpFilesize
576KB
-
memory/1904-13-0x0000000000000000-mapping.dmp
-
memory/2028-2-0x0000000075C31000-0x0000000075C33000-memory.dmpFilesize
8KB