Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
04-03-2021 03:34
Static task
static1
Behavioral task
behavioral1
Sample
jabastin.exe
Resource
win7v20201028
General
-
Target
jabastin.exe
-
Size
219KB
-
MD5
bf2280363178076f4f5e4f6b1560c4bb
-
SHA1
8cff680cbc56da797f68e234901b16a8067abbd8
-
SHA256
c0c03ed0990ed10f1f253b8db22d6126a344388797b920909c64f5307c42da40
-
SHA512
b2b652de7fa1341d8b868c7d995a2713e25184cc12255dc9831ca6d4b04a60d060ecd1b9364deed565114906fae423bd36f4c43182d4215d3505a9f69253aee9
Malware Config
Extracted
xloader
http://www.injectionhub.com/nppk/
jwfbc.com
thebroncooutfitters.com
andaplafonpadang.com
zixi20.com
lanzhoubuxiugang.com
saielectronicsonline.com
amazonishop.com
theblindshops.com
polyanom.com
stunningsinglemama.com
softfsafawt.site
fuyunniu.com
choose-deal.com
pornstarpimp.com
hairthatshappy.com
one-etz.com
sharonbrandman.com
servidordigital.company
don-dejohn.com
malaysianwhitecoffee.com
directfulfillmentusa.com
handohealth.com
biometricappointment.com
kelleherlacrosseclub.com
justmagnificentlimo.com
bellescrafts.com
crit-them.com
romaniamatrimony.com
zffinancial.com
brevardcountyfl.com
wvcee.com
dadiruy.com
faithtemplechurchofboca.com
anloctin.com
thirstytampa.com
xswlwfspn.icu
itsacolorfulllife.com
fmeasds.me
leonardoexp.com
loveypro.com
kato6211.info
zapatosmaxes.com
aprende.website
mompreneurtv.watch
lifedesignforkids.com
commagx4.info
3932899.com
mmhh3.net
xolalounge.com
thelaunchingblueprint.com
ussouthernhome.com
onsale30.com
cvisualee.com
apple-mac.com
aliexpress-search.com
caremaac.com
ishaqalmuhaimin.com
bulkcannabisdelivery.com
maestroabraham.com
allsignaturesolutions.com
healcares.com
meaca-tech.com
disneymovie.info
in10sifiedapparel.net
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1904-5-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1860-13-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 772 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
jabastin.exepid process 844 jabastin.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
jabastin.exejabastin.execolorcpl.exedescription pid process target process PID 844 set thread context of 1904 844 jabastin.exe jabastin.exe PID 1904 set thread context of 1204 1904 jabastin.exe Explorer.EXE PID 1860 set thread context of 1204 1860 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
jabastin.exejabastin.execolorcpl.exepid process 844 jabastin.exe 844 jabastin.exe 844 jabastin.exe 844 jabastin.exe 1904 jabastin.exe 1904 jabastin.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe 1860 colorcpl.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
jabastin.exejabastin.execolorcpl.exepid process 844 jabastin.exe 1904 jabastin.exe 1904 jabastin.exe 1904 jabastin.exe 1860 colorcpl.exe 1860 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
jabastin.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1904 jabastin.exe Token: SeDebugPrivilege 1860 colorcpl.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE 1204 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
jabastin.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 844 wrote to memory of 1904 844 jabastin.exe jabastin.exe PID 844 wrote to memory of 1904 844 jabastin.exe jabastin.exe PID 844 wrote to memory of 1904 844 jabastin.exe jabastin.exe PID 844 wrote to memory of 1904 844 jabastin.exe jabastin.exe PID 844 wrote to memory of 1904 844 jabastin.exe jabastin.exe PID 1204 wrote to memory of 1860 1204 Explorer.EXE colorcpl.exe PID 1204 wrote to memory of 1860 1204 Explorer.EXE colorcpl.exe PID 1204 wrote to memory of 1860 1204 Explorer.EXE colorcpl.exe PID 1204 wrote to memory of 1860 1204 Explorer.EXE colorcpl.exe PID 1860 wrote to memory of 772 1860 colorcpl.exe cmd.exe PID 1860 wrote to memory of 772 1860 colorcpl.exe cmd.exe PID 1860 wrote to memory of 772 1860 colorcpl.exe cmd.exe PID 1860 wrote to memory of 772 1860 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jabastin.exe"C:\Users\Admin\AppData\Local\Temp\jabastin.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jabastin.exe"C:\Users\Admin\AppData\Local\Temp\jabastin.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\jabastin.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsi69EB.tmp\p3tkf.dllMD5
d4f92f1c48fff5c30de03897eee21c95
SHA13341a9ca0906f94e95856453b19385a7957e101f
SHA2562036564a7e2ffa08e02d3e52a51727e28297e7d7901b3cf659a1142719a52cd4
SHA512e53bd79f0e853f5b699d54482bc94ebbaa627e0ea861e3fc82ff38d3049f04034c91ea85910731dccaec0434ea63b6f78581b26f8872c7d9039a1e768f24411b
-
memory/772-11-0x0000000000000000-mapping.dmp
-
memory/844-2-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/1204-16-0x0000000004D10000-0x0000000004DF8000-memory.dmpFilesize
928KB
-
memory/1204-8-0x0000000004020000-0x0000000004107000-memory.dmpFilesize
924KB
-
memory/1860-13-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1860-15-0x0000000000350000-0x00000000003E0000-memory.dmpFilesize
576KB
-
memory/1860-14-0x00000000021D0000-0x00000000024D3000-memory.dmpFilesize
3.0MB
-
memory/1860-9-0x0000000000000000-mapping.dmp
-
memory/1860-12-0x0000000000DB0000-0x0000000000DC8000-memory.dmpFilesize
96KB
-
memory/1904-5-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1904-7-0x0000000000360000-0x0000000000371000-memory.dmpFilesize
68KB
-
memory/1904-6-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/1904-4-0x000000000041D090-mapping.dmp