Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-04-2021 19:43
Static task
static1
Behavioral task
behavioral1
Sample
purchase order.ARJ.exe
Resource
win7v20210408
General
-
Target
purchase order.ARJ.exe
-
Size
210KB
-
MD5
fa96f770af00841a9138bedbba1f0277
-
SHA1
4be4790f83f34c603d9423d8feea35d7315f2ea6
-
SHA256
4b880b8ba9e0e635de04312ad9cfa89328606faa0364972cff8c61b7685f5045
-
SHA512
e60818987f2161046094b606e0a2eb46910295bad4364724295875c53ea25395c009939e96f3aea1bcbc839c74472441b53323865561f34973effd3bf9e2b67f
Malware Config
Extracted
xloader
2.3
http://www.reisentuerkei.com/h6fe/
fortirecon.com
owlions.com
openrhodes.net
hannahjohnston.com
legacyfreshmarket.com
themedicareenroll.com
hpondsmarket.com
2manyads.com
kiralikservis.com
oxfordprinters.com
yamalo.club
apagyms.com
gulsahdevarsiv.com
employmentpakistan.com
insidegamez.com
curiget.xyz
pinturayanexo.com
myltcpool.com
greenfirewoodash.com
gabrielaalcantarperiodista.com
7856353.com
thefrozendeserts.com
alienblacque.com
arcticsnowmobiles.com
perfectingwealth.com
sjaikikai.com
healthylooksbeautiful.com
carrieblackshaw.com
commercexm.com
covidpreventionshop.com
kktee.net
ledlighting-en.com
vr1234.chat
istanbulplastic.com
gcsapartners.com
app-confirmation.com
schluesseldienst-nuernberg.info
xhxet.com
archanashahofficial.com
wiloasbanhsgtarewdasc.solutions
sani-ball.com
tlctrueloveconnection.com
teambuddhashirts.com
ravibags.com
whocanteachme.com
antoniosabato.info
hbfrolin.com
resilientairecircle.com
cookiesvegasdispensary.com
vinhorapido.com
brazilpe.com
dynamic-strategies.com
daxuangou.com
aneshinchi.info
danielsfencellc.com
proactol-information.com
ka1288.com
xn--pckuay0l6a7c.site
youngdigitalpartners.com
adophile.com
marycieloingrid.com
drsimaipediatrics.com
nostophobia.com
pkillian.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1028-118-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2852-127-0x0000000003240000-0x0000000003269000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
purchase order.ARJ.exepid process 3172 purchase order.ARJ.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
purchase order.ARJ.exepurchase order.ARJ.exesystray.exedescription pid process target process PID 3172 set thread context of 1028 3172 purchase order.ARJ.exe purchase order.ARJ.exe PID 1028 set thread context of 2716 1028 purchase order.ARJ.exe Explorer.EXE PID 1028 set thread context of 2716 1028 purchase order.ARJ.exe Explorer.EXE PID 2852 set thread context of 2716 2852 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
purchase order.ARJ.exesystray.exepid process 1028 purchase order.ARJ.exe 1028 purchase order.ARJ.exe 1028 purchase order.ARJ.exe 1028 purchase order.ARJ.exe 1028 purchase order.ARJ.exe 1028 purchase order.ARJ.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe 2852 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2716 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
purchase order.ARJ.exepurchase order.ARJ.exesystray.exepid process 3172 purchase order.ARJ.exe 1028 purchase order.ARJ.exe 1028 purchase order.ARJ.exe 1028 purchase order.ARJ.exe 1028 purchase order.ARJ.exe 2852 systray.exe 2852 systray.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
purchase order.ARJ.exeExplorer.EXEsystray.exedescription pid process Token: SeDebugPrivilege 1028 purchase order.ARJ.exe Token: SeShutdownPrivilege 2716 Explorer.EXE Token: SeCreatePagefilePrivilege 2716 Explorer.EXE Token: SeShutdownPrivilege 2716 Explorer.EXE Token: SeCreatePagefilePrivilege 2716 Explorer.EXE Token: SeDebugPrivilege 2852 systray.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2716 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
purchase order.ARJ.exeExplorer.EXEsystray.exedescription pid process target process PID 3172 wrote to memory of 1028 3172 purchase order.ARJ.exe purchase order.ARJ.exe PID 3172 wrote to memory of 1028 3172 purchase order.ARJ.exe purchase order.ARJ.exe PID 3172 wrote to memory of 1028 3172 purchase order.ARJ.exe purchase order.ARJ.exe PID 3172 wrote to memory of 1028 3172 purchase order.ARJ.exe purchase order.ARJ.exe PID 2716 wrote to memory of 2852 2716 Explorer.EXE systray.exe PID 2716 wrote to memory of 2852 2716 Explorer.EXE systray.exe PID 2716 wrote to memory of 2852 2716 Explorer.EXE systray.exe PID 2852 wrote to memory of 4092 2852 systray.exe cmd.exe PID 2852 wrote to memory of 4092 2852 systray.exe cmd.exe PID 2852 wrote to memory of 4092 2852 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\purchase order.ARJ.exe"C:\Users\Admin\AppData\Local\Temp\purchase order.ARJ.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\purchase order.ARJ.exe"C:\Users\Admin\AppData\Local\Temp\purchase order.ARJ.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\purchase order.ARJ.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsnF59.tmp\y03w6qd58839m4g.dllMD5
9d41977d11adb48e7296540d1138aff2
SHA19b9813ecda2a4417201072af65d31013c8550a30
SHA25634ea63ef0122e1d6d8a5b401778b1d95efaab258880a728cc710812f6fa4e2a6
SHA512fb0f9c8c19a1190cbb7f1c46681c15954223fb0629e2a7ca86700c5a1d2dd110f20984531d67c45d2819af48c88cb371f9fcfd12246531808a991b992d517f7a
-
memory/1028-115-0x000000000041D0E0-mapping.dmp
-
memory/1028-118-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1028-119-0x0000000000A90000-0x0000000000DB0000-memory.dmpFilesize
3.1MB
-
memory/1028-120-0x00000000004F0000-0x000000000063A000-memory.dmpFilesize
1.3MB
-
memory/1028-122-0x00000000004F0000-0x000000000063A000-memory.dmpFilesize
1.3MB
-
memory/2716-123-0x0000000005320000-0x00000000054AE000-memory.dmpFilesize
1.6MB
-
memory/2716-130-0x0000000005FE0000-0x0000000006153000-memory.dmpFilesize
1.4MB
-
memory/2716-121-0x0000000005180000-0x0000000005318000-memory.dmpFilesize
1.6MB
-
memory/2852-126-0x0000000000F80000-0x0000000000F86000-memory.dmpFilesize
24KB
-
memory/2852-124-0x0000000000000000-mapping.dmp
-
memory/2852-128-0x0000000004780000-0x0000000004AA0000-memory.dmpFilesize
3.1MB
-
memory/2852-127-0x0000000003240000-0x0000000003269000-memory.dmpFilesize
164KB
-
memory/2852-129-0x0000000004B30000-0x0000000004BBF000-memory.dmpFilesize
572KB
-
memory/3172-117-0x0000000002C01000-0x0000000002C03000-memory.dmpFilesize
8KB
-
memory/3172-116-0x0000000002C00000-0x0000000002C01000-memory.dmpFilesize
4KB
-
memory/4092-125-0x0000000000000000-mapping.dmp