Analysis
-
max time kernel
154s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
05-05-2021 19:03
Static task
static1
Behavioral task
behavioral1
Sample
P.O.exe
Resource
win7v20210408
General
-
Target
P.O.exe
-
Size
207KB
-
MD5
eb71efe60cabc2d6aa9a49a82a4ded77
-
SHA1
c188402835e985adac142eee6e0b31fd4c0c0ae6
-
SHA256
9b70fcd07ba7d3dcef17f3b28cf75e304840a67e8611dc149744215f8483066d
-
SHA512
3654b1ff3b57ca883b6fc6d086a8c90654f3e59f2efbe7341677ac85216bc8c1d2bc448940081eb9852f10f43a51d71f4eeef05445e046b9726108f792bdc1c2
Malware Config
Extracted
xloader
2.3
http://www.onyxcomputing.com/u8nw/
constructionjadams.com
organicwellnessfarm.com
beautiful.tours
medvows.com
foxparanormal.com
fsmxmc.com
graniterealestategroup.net
qgi1.com
astrologicsolutions.com
rafbar.com
bastiontools.net
emotist.com
stacyleets.com
bloodtypealpha.com
healtybenenfitsplus.com
vavadadoa3.com
chefbenhk.com
dotgz.com
xn--z4qm188e645c.com
ethyi.com
farrellforcouncil.com
everythingcornea.com
pensje.net
haichuanxin.com
codeproper.com
beautyblvdca.com
namastecarrier.com
xtrator.com
alphabrainbalancing.com
sensationalcleaningservices.net
magistv.info
shotsbynox.com
zioninfosystems.net
yourstoryplace.com
ebmulla.com
turkeyvisa-government.com
albertsonsolutions.com
7brochasmagicas.com
revolutiontourselsalvador.com
eastboundanddowntrucking.com
jkskylights.com
ultimatepoolwater.com
diurr.com
investmentfocused.com
dogscanstay.com
inov8digital.com
paragoncraftevents.com
reservesunbeds.com
melaniesalascosmetics.com
vissito.com
axolc-upoc.xyz
customessayjojo.com
kladki.com
online-securegov.com
xn--demirelik-u3a.com
plgmap.com
contorig2.com
dgyzgs8.com
valuedmind.com
sanacolitademarijuana.com
xn--6j1bs50berk.com
labkitsforstudents.com
lifehakershagirl.online
candidanddevout.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2040-64-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/316-73-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 524 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
P.O.exepid process 1304 P.O.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
P.O.exeP.O.execmmon32.exedescription pid process target process PID 1304 set thread context of 2040 1304 P.O.exe P.O.exe PID 2040 set thread context of 1196 2040 P.O.exe Explorer.EXE PID 2040 set thread context of 1196 2040 P.O.exe Explorer.EXE PID 316 set thread context of 1196 316 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
P.O.execmmon32.exepid process 2040 P.O.exe 2040 P.O.exe 2040 P.O.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe 316 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
P.O.exeP.O.execmmon32.exepid process 1304 P.O.exe 2040 P.O.exe 2040 P.O.exe 2040 P.O.exe 2040 P.O.exe 316 cmmon32.exe 316 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
P.O.execmmon32.exedescription pid process Token: SeDebugPrivilege 2040 P.O.exe Token: SeDebugPrivilege 316 cmmon32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
P.O.exeExplorer.EXEcmmon32.exedescription pid process target process PID 1304 wrote to memory of 2040 1304 P.O.exe P.O.exe PID 1304 wrote to memory of 2040 1304 P.O.exe P.O.exe PID 1304 wrote to memory of 2040 1304 P.O.exe P.O.exe PID 1304 wrote to memory of 2040 1304 P.O.exe P.O.exe PID 1304 wrote to memory of 2040 1304 P.O.exe P.O.exe PID 1196 wrote to memory of 316 1196 Explorer.EXE cmmon32.exe PID 1196 wrote to memory of 316 1196 Explorer.EXE cmmon32.exe PID 1196 wrote to memory of 316 1196 Explorer.EXE cmmon32.exe PID 1196 wrote to memory of 316 1196 Explorer.EXE cmmon32.exe PID 316 wrote to memory of 524 316 cmmon32.exe cmd.exe PID 316 wrote to memory of 524 316 cmmon32.exe cmd.exe PID 316 wrote to memory of 524 316 cmmon32.exe cmd.exe PID 316 wrote to memory of 524 316 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\P.O.exe"C:\Users\Admin\AppData\Local\Temp\P.O.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\P.O.exe"C:\Users\Admin\AppData\Local\Temp\P.O.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\P.O.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsn6E4F.tmp\b0xkyuw645iggtc.dllMD5
2919e2af8bb7f84e49c7b8a2eeea5ce2
SHA16c039175895e89dbcebd2c6137704e10f7257fd4
SHA256615a7c9635e83ef8fe9040d0f37b9f96fa28fbb9333cfd52a1ee3d74ef195904
SHA512122c9afb6826b67501cf5cefa13bbb7a9a50fea3011662a767655ce545d3a3d999593c490dbf1ce9b632e759b2576a587c9ab48f1a2da5c3d410f92b05631650
-
memory/316-72-0x0000000000140000-0x000000000014D000-memory.dmpFilesize
52KB
-
memory/316-75-0x0000000001D70000-0x0000000001DFF000-memory.dmpFilesize
572KB
-
memory/316-74-0x0000000001F30000-0x0000000002233000-memory.dmpFilesize
3.0MB
-
memory/316-73-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/316-70-0x0000000000000000-mapping.dmp
-
memory/524-71-0x0000000000000000-mapping.dmp
-
memory/1196-76-0x0000000006F40000-0x000000000705C000-memory.dmpFilesize
1.1MB
-
memory/1196-67-0x0000000004280000-0x000000000437A000-memory.dmpFilesize
1000KB
-
memory/1196-69-0x0000000006490000-0x00000000065AF000-memory.dmpFilesize
1.1MB
-
memory/1304-62-0x00000000003E0000-0x00000000003E2000-memory.dmpFilesize
8KB
-
memory/1304-60-0x0000000075AD1000-0x0000000075AD3000-memory.dmpFilesize
8KB
-
memory/2040-65-0x00000000008C0000-0x0000000000BC3000-memory.dmpFilesize
3.0MB
-
memory/2040-68-0x0000000000360000-0x0000000000370000-memory.dmpFilesize
64KB
-
memory/2040-66-0x0000000000270000-0x0000000000280000-memory.dmpFilesize
64KB
-
memory/2040-64-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2040-63-0x000000000041D0C0-mapping.dmp