Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-05-2021 10:12
Static task
static1
Behavioral task
behavioral1
Sample
REVISED ORDER.exe
Resource
win7v20210410
General
-
Target
REVISED ORDER.exe
-
Size
985KB
-
MD5
61f942cbb67b5a5de8f72dfe65227175
-
SHA1
45271b8b2797e1232efe813d9d34e9ca9c7564a4
-
SHA256
979a3e20b43d1aad57018b9c867e4bde7606d0515c9c71b2050b02c0b5e5fd10
-
SHA512
f6448602b457f455e3da9f8e2c30c5d0062ed81c10b420f180a6ba7b7c4fa5dd3eef4cfc95db68a476d27ee40bb6bb86a4a8b55b4fedea87ada32ba87ddb80f7
Malware Config
Extracted
xloader
2.3
http://www.athomecp.com/owws/
trolljoke.com
contex3.info
jabashir51.com
brittand.com
djaya.asia
lab-wealth.com
greyfriararabians.com
oxfordhabits.com
softwaresreports.info
abjms.com
winsteadarchitecture.com
brucerolfsboulder.com
unitytribune.com
cyjulebu.com
abaplants.com
theexerciseforyou.com
codigodebarrasser.com
barbicanroadproductions.com
sportenango.com
hostsnc.com
clubdonovoka.com
adaptive.science
meeplesisters.com
shubhkari.com
pooliswaiting.com
sempat-ya8.com
davispackphotography.com
dezigo.design
faxbbs.com
lunarvac.com
thewerideveloper.com
ingenesinstitute.com
elizabethfulco.com
assemble-4u.com
jingcilian.com
rnpynsjw.net
raphainfosec.com
gdzas08.cloud
murrpurrs.net
hakua36tokyo.com
rakennuskolibri.net
renerossi.com
raphaelyejesiel.com
phoxinh.net
amrshadhartanah21.com
thehoneyglo.com
xn--mariachilen-zeb.com
excelfaq.online
expandetusingresos.com
cupsteam.com
your-new-body-plan.com
misskarenenglishreacher.com
pulkitkumar.wtf
tluxebeautyexperience.com
sissysundays.com
ketoburnerrevolution.com
babdestaffing.com
easywayplanet.com
rewealth.club
siamboss.com
shamansmoke.com
truervoice.com
denisekohli.com
gx17.net
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/288-68-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/288-69-0x000000000041CFF0-mapping.dmp xloader behavioral1/memory/1148-79-0x00000000000D0000-0x00000000000F8000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 13 1148 rundll32.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1224 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.exerundll32.exedescription pid process target process PID 1116 set thread context of 288 1116 REVISED ORDER.exe REVISED ORDER.exe PID 288 set thread context of 1292 288 REVISED ORDER.exe Explorer.EXE PID 288 set thread context of 1292 288 REVISED ORDER.exe Explorer.EXE PID 1148 set thread context of 1292 1148 rundll32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.exerundll32.exepid process 1116 REVISED ORDER.exe 1116 REVISED ORDER.exe 288 REVISED ORDER.exe 288 REVISED ORDER.exe 288 REVISED ORDER.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe 1148 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
REVISED ORDER.exerundll32.exepid process 288 REVISED ORDER.exe 288 REVISED ORDER.exe 288 REVISED ORDER.exe 288 REVISED ORDER.exe 1148 rundll32.exe 1148 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.exerundll32.exedescription pid process Token: SeDebugPrivilege 1116 REVISED ORDER.exe Token: SeDebugPrivilege 288 REVISED ORDER.exe Token: SeDebugPrivilege 1148 rundll32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1292 Explorer.EXE 1292 Explorer.EXE 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1292 Explorer.EXE 1292 Explorer.EXE 1292 Explorer.EXE 1292 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.exerundll32.exedescription pid process target process PID 1116 wrote to memory of 396 1116 REVISED ORDER.exe schtasks.exe PID 1116 wrote to memory of 396 1116 REVISED ORDER.exe schtasks.exe PID 1116 wrote to memory of 396 1116 REVISED ORDER.exe schtasks.exe PID 1116 wrote to memory of 396 1116 REVISED ORDER.exe schtasks.exe PID 1116 wrote to memory of 288 1116 REVISED ORDER.exe REVISED ORDER.exe PID 1116 wrote to memory of 288 1116 REVISED ORDER.exe REVISED ORDER.exe PID 1116 wrote to memory of 288 1116 REVISED ORDER.exe REVISED ORDER.exe PID 1116 wrote to memory of 288 1116 REVISED ORDER.exe REVISED ORDER.exe PID 1116 wrote to memory of 288 1116 REVISED ORDER.exe REVISED ORDER.exe PID 1116 wrote to memory of 288 1116 REVISED ORDER.exe REVISED ORDER.exe PID 1116 wrote to memory of 288 1116 REVISED ORDER.exe REVISED ORDER.exe PID 288 wrote to memory of 1148 288 REVISED ORDER.exe rundll32.exe PID 288 wrote to memory of 1148 288 REVISED ORDER.exe rundll32.exe PID 288 wrote to memory of 1148 288 REVISED ORDER.exe rundll32.exe PID 288 wrote to memory of 1148 288 REVISED ORDER.exe rundll32.exe PID 288 wrote to memory of 1148 288 REVISED ORDER.exe rundll32.exe PID 288 wrote to memory of 1148 288 REVISED ORDER.exe rundll32.exe PID 288 wrote to memory of 1148 288 REVISED ORDER.exe rundll32.exe PID 1148 wrote to memory of 1224 1148 rundll32.exe cmd.exe PID 1148 wrote to memory of 1224 1148 rundll32.exe cmd.exe PID 1148 wrote to memory of 1224 1148 rundll32.exe cmd.exe PID 1148 wrote to memory of 1224 1148 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBUqpPcrdY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9DA6.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"4⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp9DA6.tmpMD5
0c3aed9b5afdcd71dca5d614c56064d9
SHA1a93d5b02764f87e1b5f3f993f32c73dedc02f075
SHA25645790da5c41a18899ed398002bbfca251cdcd83e6bba8093d1b5997f1801d1f4
SHA51257d30f0e9c4346e0d1e3b686e7cc38bb194730859db6274ac5df38fc142faa8d34d74e3069efb0c20059e48cc1c48abfb9a6a58444a8c800a84e1731b04976f6
-
memory/288-74-0x00000000002A0000-0x00000000002B0000-memory.dmpFilesize
64KB
-
memory/288-68-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/288-69-0x000000000041CFF0-mapping.dmp
-
memory/288-72-0x0000000000080000-0x0000000000090000-memory.dmpFilesize
64KB
-
memory/288-71-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/396-66-0x0000000000000000-mapping.dmp
-
memory/1116-62-0x0000000006F20000-0x0000000006F21000-memory.dmpFilesize
4KB
-
memory/1116-63-0x0000000000540000-0x000000000054E000-memory.dmpFilesize
56KB
-
memory/1116-64-0x0000000004DC0000-0x0000000004E50000-memory.dmpFilesize
576KB
-
memory/1116-65-0x0000000000A40000-0x0000000000A80000-memory.dmpFilesize
256KB
-
memory/1116-60-0x0000000001240000-0x0000000001241000-memory.dmpFilesize
4KB
-
memory/1148-77-0x00000000767B1000-0x00000000767B3000-memory.dmpFilesize
8KB
-
memory/1148-76-0x0000000000000000-mapping.dmp
-
memory/1148-78-0x0000000000C70000-0x0000000000C7E000-memory.dmpFilesize
56KB
-
memory/1148-80-0x0000000002080000-0x0000000002383000-memory.dmpFilesize
3.0MB
-
memory/1148-79-0x00000000000D0000-0x00000000000F8000-memory.dmpFilesize
160KB
-
memory/1148-82-0x0000000000AC0000-0x0000000000B4F000-memory.dmpFilesize
572KB
-
memory/1224-81-0x0000000000000000-mapping.dmp
-
memory/1292-75-0x0000000006C20000-0x0000000006D97000-memory.dmpFilesize
1.5MB
-
memory/1292-73-0x0000000004740000-0x000000000481F000-memory.dmpFilesize
892KB
-
memory/1292-83-0x0000000009140000-0x00000000092AE000-memory.dmpFilesize
1.4MB