Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
22/03/2021, 07:35
Static task
static1
Behavioral task
behavioral1
Sample
MACHINE SPECIFICATION.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target MACHINE SPECIFICATION.exe
- Size 141KB
- Sample210322-dsytqpfncx
- SHA256 fd32e6bad3561c5fe9dcb7cc9429fb110fea37c843753f33f453b18df751520e
- MD5 b0a9731f9bbba99a908362d88de6151e
- SHA1 5b3bfae3291a00bf6a9296dd027ccae6f404cf64
- SHA512 3f043af094dc4c2ab62a81e86ba48af53b7f4f86fde13ae62b78455fd05b354ef59d693e65d67086ad418a6edbbd85a4292b27712560e948170d22566ddf3678
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
C2
-
http://www.dubainights.net/rrrq/
Decoy
-
sdlcutps.com
-
novieffendi.com
-
highpointedu.com
-
sagaming.today
-
charlottesteer.com
-
kilopapa.net
-
prime-executive.com
-
8893270.com
-
gorillaikka.com
-
coynesgastropub.com
-
sun9376.xyz
-
coolkilo.com
-
1clickdoc.online
-
fosa.info
-
smileburgerdelivery.com
-
ronpaulmessge17.com
-
sqwigs.com
-
xn--c1ajbkdnb9b0g.xn--p1acf
-
gelzers.info
-
banpluspay.com
-
chemluan.com
-
vehcimbev.com
-
voyageesthetique.com
-
gurmishpainting.com
-
egofickle.com
-
klikhoster.net
-
chainlinkbulls.com
-
6987599.com
-
curtex.info
-
dogcollarcartoons.com
-
videomediaaid.online
-
qoyal.com
-
girloliver.com
-
indoorcannabisproducer.com
-
josefloreslive.com
-
pomtpu.com
-
gwalletcc.com
-
lapsteelator.com
-
vitalyst.digital
-
teleworkstar.info
-
kansas-chiefs.com
-
ingeniousmkt.com
-
whowealth.com
-
mycfhp.com
-
st-plumbing.com
-
listsouth.com
-
citestaccnt1598618655.com
-
x-tech.design
-
carmellastore.com
-
petalpetal.net
-
myworldporn.com
-
crgxdz.com
-
ladronesdepalabras.com
-
becomestateman.com
-
thebigmessages.com
-
novak-versand.com
-
melekhemfuzaylovrealtor.com
-
deeanaespinosa.com
-
cachpay.com
-
beyond-luxury-villas.com
-
qrrnwdev.icu
-
revolutionofwork.com
-
whatsonpk.com
-
solidaritybrother.com
Signatures
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/3164-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3164-14-0x000000000041CFC0-mapping.dmp xloader behavioral2/memory/200-23-0x0000000000850000-0x0000000000878000-memory.dmp xloader - Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
pid Process 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4020 set thread context of 3164 4020 MACHINE SPECIFICATION.exe 78 PID 3164 set thread context of 3128 3164 applaunch.exe 16 PID 200 set thread context of 3128 200 cscript.exe 16 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Delays execution with timeout.exe 1 IoCs
pid Process 4028 timeout.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 4020 MACHINE SPECIFICATION.exe 3164 applaunch.exe 3164 applaunch.exe 3164 applaunch.exe 3164 applaunch.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe 200 cscript.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3164 applaunch.exe 3164 applaunch.exe 3164 applaunch.exe 200 cscript.exe 200 cscript.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4020 MACHINE SPECIFICATION.exe Token: SeDebugPrivilege 3164 applaunch.exe Token: SeDebugPrivilege 200 cscript.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3128 Explorer.EXE - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 4020 wrote to memory of 4084 4020 MACHINE SPECIFICATION.exe 75 PID 4020 wrote to memory of 4084 4020 MACHINE SPECIFICATION.exe 75 PID 4020 wrote to memory of 4084 4020 MACHINE SPECIFICATION.exe 75 PID 4084 wrote to memory of 4028 4084 cmd.exe 77 PID 4084 wrote to memory of 4028 4084 cmd.exe 77 PID 4084 wrote to memory of 4028 4084 cmd.exe 77 PID 4020 wrote to memory of 3164 4020 MACHINE SPECIFICATION.exe 78 PID 4020 wrote to memory of 3164 4020 MACHINE SPECIFICATION.exe 78 PID 4020 wrote to memory of 3164 4020 MACHINE SPECIFICATION.exe 78 PID 4020 wrote to memory of 3164 4020 MACHINE SPECIFICATION.exe 78 PID 4020 wrote to memory of 3164 4020 MACHINE SPECIFICATION.exe 78 PID 4020 wrote to memory of 3164 4020 MACHINE SPECIFICATION.exe 78 PID 4020 wrote to memory of 3164 4020 MACHINE SPECIFICATION.exe 78 PID 3128 wrote to memory of 200 3128 Explorer.EXE 79 PID 3128 wrote to memory of 200 3128 Explorer.EXE 79 PID 3128 wrote to memory of 200 3128 Explorer.EXE 79 PID 200 wrote to memory of 3636 200 cscript.exe 82 PID 200 wrote to memory of 3636 200 cscript.exe 82 PID 200 wrote to memory of 3636 200 cscript.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\MACHINE SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\MACHINE SPECIFICATION.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 13⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\timeout.exetimeout 14⤵
- Delays execution with timeout.exe
PID:4028
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\applaunch.exe"3⤵PID:3636
-
-