Analysis
-
max time kernel
152s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-04-2021 07:05
Static task
static1
Behavioral task
behavioral1
Sample
PO7321.exe
Resource
win7v20201028
General
-
Target
PO7321.exe
-
Size
562KB
-
MD5
774eca4068dce6d3db505c49af0a516e
-
SHA1
7708d1ed2bb3166bf74d0e92ac95bb8e379e1cf4
-
SHA256
3a96891372a8578aab18d70a377d68a795ab2f92c4c97c5f0986d7f1006490d1
-
SHA512
b9534efd5b6d87f87cc5a83f3e8a8875600f059bcfef60daa5526908cb0414d291682953cae75fab6c48805cfa9f5711f2b6dac04b299741a78a71f82b3954e0
Malware Config
Extracted
xloader
2.3
http://www.013y.com/pnqr/
bullexch9.com
hiiidesigns.com
yosapark-gakuenmae.com
movementinspires.com
orlandas.com
flowga.world
opende.info
jiconic.com
selviclothingco.com
herbalmedicineresearch.com
contex33.xyz
riord.com
alchemistslibrary.com
ecalyte.com
tutu119.com
61ue00.com
properwayllc.com
tamitoe.com
adacompliantsoftware.com
deliabe.com
edrcounselling.group
indigoconsultinguganda.com
stjom.church
vegansonfire.com
bostonimaginggroup.com
greenchilicountryjamboree.com
culvercoop.com
northlakerental.com
lpp888.xyz
hostinganl.com
spin889988.club
thedoctornearme.com
luolan99.com
gamers-casino.space
dailyovertips.com
torer.net
fuhrerscheindienst.com
diysergeant.com
neuralnuture.net
hysplashes.xyz
tretkurbel.site
ccelaya.com
electricalpanelmonterey.com
hullabaloocookies.com
sunnyshousebrooklyn.com
mini-jeep-willys.online
angelaharriotthomes.com
vpathletics.online
moeginokai.com
jesusistderweg.info
printsublimbandung.com
empirehomeservicesllc.com
fiestaselenas.com
elyonkioficial.com
instaseries94.com
digivalplan.com
highaltitudeballooning.com
choosefour.com
fitpawsmobile.com
radiancebyreilly.com
finlst.com
volmaqhsogroup.com
malayziascandles.com
lazerworkshop.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1180-6-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/868-12-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 796 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
PO7321.exepid process 1884 PO7321.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO7321.exePO7321.exesvchost.exedescription pid process target process PID 1884 set thread context of 1180 1884 PO7321.exe PO7321.exe PID 1180 set thread context of 1268 1180 PO7321.exe Explorer.EXE PID 868 set thread context of 1268 868 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
PO7321.exesvchost.exepid process 1180 PO7321.exe 1180 PO7321.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe 868 svchost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PO7321.exePO7321.exesvchost.exepid process 1884 PO7321.exe 1180 PO7321.exe 1180 PO7321.exe 1180 PO7321.exe 868 svchost.exe 868 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO7321.exesvchost.exedescription pid process Token: SeDebugPrivilege 1180 PO7321.exe Token: SeDebugPrivilege 868 svchost.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
PO7321.exeExplorer.EXEsvchost.exedescription pid process target process PID 1884 wrote to memory of 1180 1884 PO7321.exe PO7321.exe PID 1884 wrote to memory of 1180 1884 PO7321.exe PO7321.exe PID 1884 wrote to memory of 1180 1884 PO7321.exe PO7321.exe PID 1884 wrote to memory of 1180 1884 PO7321.exe PO7321.exe PID 1884 wrote to memory of 1180 1884 PO7321.exe PO7321.exe PID 1268 wrote to memory of 868 1268 Explorer.EXE svchost.exe PID 1268 wrote to memory of 868 1268 Explorer.EXE svchost.exe PID 1268 wrote to memory of 868 1268 Explorer.EXE svchost.exe PID 1268 wrote to memory of 868 1268 Explorer.EXE svchost.exe PID 868 wrote to memory of 796 868 svchost.exe cmd.exe PID 868 wrote to memory of 796 868 svchost.exe cmd.exe PID 868 wrote to memory of 796 868 svchost.exe cmd.exe PID 868 wrote to memory of 796 868 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO7321.exe"C:\Users\Admin\AppData\Local\Temp\PO7321.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO7321.exe"C:\Users\Admin\AppData\Local\Temp\PO7321.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO7321.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsi5533.tmp\57cmo2.dllMD5
7418f8dc5479eeb371264cf36b4cf551
SHA140401572084a68334c508d98bf10aaa5a199bdc5
SHA256c5adce72a02aafb28dab7c360b1f5555bdedfe1d9d97bda574b6d9d29377bda0
SHA51295d76945159a4e25440281d4c361f3672798c0129aa0cdc18f187e98df90e499d30da80c6c9d8e3ae5cbebc9b98084b8cf10e3716f88e042140e07c80ca7406b
-
memory/440-18-0x000007FEF6F80000-0x000007FEF71FA000-memory.dmpFilesize
2.5MB
-
memory/796-14-0x0000000000000000-mapping.dmp
-
memory/868-10-0x0000000000000000-mapping.dmp
-
memory/868-12-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/868-11-0x0000000000CD0000-0x0000000000CD8000-memory.dmpFilesize
32KB
-
memory/868-13-0x00000000007A0000-0x0000000000AA3000-memory.dmpFilesize
3.0MB
-
memory/868-15-0x0000000000580000-0x000000000060F000-memory.dmpFilesize
572KB
-
memory/1180-6-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1180-7-0x0000000000230000-0x0000000000240000-memory.dmpFilesize
64KB
-
memory/1180-9-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/1180-4-0x000000000041D020-mapping.dmp
-
memory/1268-8-0x0000000003C10000-0x0000000003CD2000-memory.dmpFilesize
776KB
-
memory/1268-16-0x0000000004D90000-0x0000000004EBB000-memory.dmpFilesize
1.2MB
-
memory/1884-2-0x0000000074D11000-0x0000000074D13000-memory.dmpFilesize
8KB
-
memory/1884-5-0x0000000000950000-0x0000000000952000-memory.dmpFilesize
8KB