Analysis
-
max time kernel
109s -
max time network
135s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
04-05-2021 10:44
Static task
static1
Behavioral task
behavioral1
Sample
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe
Resource
win7v20210408
General
-
Target
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe
-
Size
671KB
-
MD5
089175069d5c095f078b7f8a3b28a22d
-
SHA1
a563615dfe562e7a11c2b7f21dcfcd412594eeee
-
SHA256
173797a7a7a881f3d6230015620bae28d21b4b41b7e568c2a881b3c0829dd67e
-
SHA512
987900b187a7757e186238fcc1a6b72c26a8b6619818ea34d91df86c8f1a1f79e31323d42f054f98cb705ec9c6b4720c5159f5746739388fa971942db79b5694
Malware Config
Extracted
xloader
2.3
http://www.evrbrite.com/o86d/
marielivet.com
shadowlovely.com
novfarm.com
genialnetero.com
nj-yanhua.com
thaihuay88.com
iizponja.com
stark-stg.net
nueforma.com
fincheckxu.com
joycasino-2020.club
9thwrld.com
komofood.com
weekendcost.com
marczeimet.com
santequebec.info
arpinaindustriesllc.com
soyakmuzayede.com
trivesse.online
shonanwakukengyou.com
whatisleanmanagement.com
9icem.com
blueberry-intl.com
mylifequotenow.com
octafxmate.com
garnogroup.com
saurara.com
mydreamtv.net
1fhewm.com
agungproduk.com
be7tv.com
ohyescart.com
sherylabrahamphotography.com
oxfordfinancialadvising.com
xn--80aaf2ckffc3a.xn--p1acf
firstcoastelope.com
novaquitaine-solidaire.com
morumi.site
lr-tn.com
avondalevotes.com
saranaturals.net
thebraidedbreadcompany.com
recruit-japan-hcm.com
innovate.works
changfangxinxi.com
ckitco.com
lacommusic.net
cibass.com
cafeciberseguridad.com
fittogo.net
franciszekmanteau.com
liquidmarin.com
toky5555.xyz
bloomberg.sucks
bluejay.ventures
valleywomanforwoman.com
helmutbuntjer.com
870830.com
xmrxapp.com
lashicorn.com
visionsbarbershop.com
cinmax.xyz
website-bazar.com
zenseotools.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3088-122-0x000000000041CFB0-mapping.dmp xloader behavioral2/memory/3088-121-0x0000000000400000-0x0000000000428000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exedescription pid process target process PID 2256 set thread context of 3088 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exea563615dfe562e7a11c2b7f21dcfcd412594eeee.exepid process 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe 3088 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe 3088 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exedescription pid process Token: SeDebugPrivilege 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exepid process 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
a563615dfe562e7a11c2b7f21dcfcd412594eeee.exedescription pid process target process PID 2256 wrote to memory of 3616 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe schtasks.exe PID 2256 wrote to memory of 3616 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe schtasks.exe PID 2256 wrote to memory of 3616 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe schtasks.exe PID 2256 wrote to memory of 3088 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 2256 wrote to memory of 3088 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 2256 wrote to memory of 3088 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 2256 wrote to memory of 3088 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 2256 wrote to memory of 3088 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe PID 2256 wrote to memory of 3088 2256 a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe"C:\Users\Admin\AppData\Local\Temp\a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OfCxSfBf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCB01.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe"C:\Users\Admin\AppData\Local\Temp\a563615dfe562e7a11c2b7f21dcfcd412594eeee.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpCB01.tmpMD5
5a77d158f763ef0453a986a6b142bdb3
SHA16530e8d2c8a7f2d8781550d35d0d479cde4bf232
SHA2562cd1ac3b5754e183b15ce8a5adf187c791c421b511bd754a147f1fb48a074a65
SHA512b2829c5711d98b514a0c6174f1d53a85185521d18914cc3265bbc9dd80745c3f3147dabf9788a9a22f1b8b217da3669e705117ed82e3767bc6bad7b7e46389c9
-
memory/2256-114-0x0000000002EE0000-0x0000000002EE1000-memory.dmpFilesize
4KB
-
memory/2256-116-0x0000000002EE2000-0x0000000002EE3000-memory.dmpFilesize
4KB
-
memory/2256-115-0x0000000002EE1000-0x0000000002EE2000-memory.dmpFilesize
4KB
-
memory/2256-117-0x0000000002EE3000-0x0000000002EE4000-memory.dmpFilesize
4KB
-
memory/2256-118-0x0000000002EE4000-0x0000000002EE5000-memory.dmpFilesize
4KB
-
memory/3088-122-0x000000000041CFB0-mapping.dmp
-
memory/3088-121-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3088-124-0x0000000000F50000-0x0000000001270000-memory.dmpFilesize
3.1MB
-
memory/3616-119-0x0000000000000000-mapping.dmp