Analysis
-
max time kernel
119s -
max time network
18s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-05-2021 10:44
Static task
static1
Behavioral task
behavioral1
Sample
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe
Resource
win7v20210408
General
-
Target
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe
-
Size
671KB
-
MD5
089175069d5c095f078b7f8a3b28a22d
-
SHA1
a563615dfe562e7a11c2b7f21dcfcd412594eeee
-
SHA256
173797a7a7a881f3d6230015620bae28d21b4b41b7e568c2a881b3c0829dd67e
-
SHA512
987900b187a7757e186238fcc1a6b72c26a8b6619818ea34d91df86c8f1a1f79e31323d42f054f98cb705ec9c6b4720c5159f5746739388fa971942db79b5694
Malware Config
Extracted
xloader
2.3
http://www.evrbrite.com/o86d/
marielivet.com
shadowlovely.com
novfarm.com
genialnetero.com
nj-yanhua.com
thaihuay88.com
iizponja.com
stark-stg.net
nueforma.com
fincheckxu.com
joycasino-2020.club
9thwrld.com
komofood.com
weekendcost.com
marczeimet.com
santequebec.info
arpinaindustriesllc.com
soyakmuzayede.com
trivesse.online
shonanwakukengyou.com
whatisleanmanagement.com
9icem.com
blueberry-intl.com
mylifequotenow.com
octafxmate.com
garnogroup.com
saurara.com
mydreamtv.net
1fhewm.com
agungproduk.com
be7tv.com
ohyescart.com
sherylabrahamphotography.com
oxfordfinancialadvising.com
xn--80aaf2ckffc3a.xn--p1acf
firstcoastelope.com
novaquitaine-solidaire.com
morumi.site
lr-tn.com
avondalevotes.com
saranaturals.net
thebraidedbreadcompany.com
recruit-japan-hcm.com
innovate.works
changfangxinxi.com
ckitco.com
lacommusic.net
cibass.com
cafeciberseguridad.com
fittogo.net
franciszekmanteau.com
liquidmarin.com
toky5555.xyz
bloomberg.sucks
bluejay.ventures
valleywomanforwoman.com
helmutbuntjer.com
870830.com
xmrxapp.com
lashicorn.com
visionsbarbershop.com
cinmax.xyz
website-bazar.com
zenseotools.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1120-68-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1120-69-0x000000000041CFB0-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exedescription pid process target process PID 684 set thread context of 1120 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exea563615dfe562e7a11c2b7f21dcfcd412594eeee.exepid process 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe 1120 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exedescription pid process Token: SeDebugPrivilege 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exepid process 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exedescription pid process target process PID 684 wrote to memory of 1516 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe schtasks.exe PID 684 wrote to memory of 1516 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe schtasks.exe PID 684 wrote to memory of 1516 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe schtasks.exe PID 684 wrote to memory of 1516 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe schtasks.exe PID 684 wrote to memory of 1476 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 684 wrote to memory of 1476 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 684 wrote to memory of 1476 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 684 wrote to memory of 1476 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 684 wrote to memory of 1120 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 684 wrote to memory of 1120 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 684 wrote to memory of 1120 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 684 wrote to memory of 1120 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 684 wrote to memory of 1120 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 684 wrote to memory of 1120 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 684 wrote to memory of 1120 684 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe"C:\Users\Admin\AppData\Local\Temp\a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OfCxSfBf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1AC1.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe"C:\Users\Admin\AppData\Local\Temp\a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe"C:\Users\Admin\AppData\Local\Temp\a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1AC1.tmpMD5
233ab4d6979a2a5eff9490ea49b0e2f3
SHA12578163a006975227022233cd3884234ce526ea2
SHA256ec35fe478889a837909e3c4b43cad23d7955857e2f84c19d6e6dbf3dca192d33
SHA5124aa475911d5b07e58db62e839334f0bd8fe90a038f290a7d6e356d439ccedda7b71d8bd5e764dc21e649ed3666415be9d4576998fe028e6fab19352cc30ddf59
-
memory/684-60-0x0000000075C71000-0x0000000075C73000-memory.dmpFilesize
8KB
-
memory/684-61-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/684-63-0x0000000000A62000-0x0000000000A63000-memory.dmpFilesize
4KB
-
memory/684-62-0x0000000000A61000-0x0000000000A62000-memory.dmpFilesize
4KB
-
memory/684-64-0x0000000000A64000-0x0000000000A65000-memory.dmpFilesize
4KB
-
memory/684-65-0x0000000000A69000-0x0000000000A7A000-memory.dmpFilesize
68KB
-
memory/1120-68-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1120-69-0x000000000041CFB0-mapping.dmp
-
memory/1120-71-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/1516-66-0x0000000000000000-mapping.dmp