Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-05-2021 10:12
Static task
static1
Behavioral task
behavioral1
Sample
REVISED ORDER.exe
Resource
win7v20210410
General
-
Target
REVISED ORDER.exe
-
Size
985KB
-
MD5
61f942cbb67b5a5de8f72dfe65227175
-
SHA1
45271b8b2797e1232efe813d9d34e9ca9c7564a4
-
SHA256
979a3e20b43d1aad57018b9c867e4bde7606d0515c9c71b2050b02c0b5e5fd10
-
SHA512
f6448602b457f455e3da9f8e2c30c5d0062ed81c10b420f180a6ba7b7c4fa5dd3eef4cfc95db68a476d27ee40bb6bb86a4a8b55b4fedea87ada32ba87ddb80f7
Malware Config
Extracted
xloader
2.3
http://www.athomecp.com/owws/
trolljoke.com
contex3.info
jabashir51.com
brittand.com
djaya.asia
lab-wealth.com
greyfriararabians.com
oxfordhabits.com
softwaresreports.info
abjms.com
winsteadarchitecture.com
brucerolfsboulder.com
unitytribune.com
cyjulebu.com
abaplants.com
theexerciseforyou.com
codigodebarrasser.com
barbicanroadproductions.com
sportenango.com
hostsnc.com
clubdonovoka.com
adaptive.science
meeplesisters.com
shubhkari.com
pooliswaiting.com
sempat-ya8.com
davispackphotography.com
dezigo.design
faxbbs.com
lunarvac.com
thewerideveloper.com
ingenesinstitute.com
elizabethfulco.com
assemble-4u.com
jingcilian.com
rnpynsjw.net
raphainfosec.com
gdzas08.cloud
murrpurrs.net
hakua36tokyo.com
rakennuskolibri.net
renerossi.com
raphaelyejesiel.com
phoxinh.net
amrshadhartanah21.com
thehoneyglo.com
xn--mariachilen-zeb.com
excelfaq.online
expandetusingresos.com
cupsteam.com
your-new-body-plan.com
misskarenenglishreacher.com
pulkitkumar.wtf
tluxebeautyexperience.com
sissysundays.com
ketoburnerrevolution.com
babdestaffing.com
easywayplanet.com
rewealth.club
siamboss.com
shamansmoke.com
truervoice.com
denisekohli.com
gx17.net
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2276-126-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/2276-127-0x000000000041CFF0-mapping.dmp xloader behavioral2/memory/2200-136-0x0000000000310000-0x0000000000338000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 22 2200 msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.exemsiexec.exedescription pid process target process PID 908 set thread context of 2276 908 REVISED ORDER.exe REVISED ORDER.exe PID 2276 set thread context of 2644 2276 REVISED ORDER.exe Explorer.EXE PID 2200 set thread context of 2644 2200 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 47 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.exemsiexec.exepid process 908 REVISED ORDER.exe 908 REVISED ORDER.exe 908 REVISED ORDER.exe 2276 REVISED ORDER.exe 2276 REVISED ORDER.exe 2276 REVISED ORDER.exe 2276 REVISED ORDER.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe 2200 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2644 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
REVISED ORDER.exemsiexec.exepid process 2276 REVISED ORDER.exe 2276 REVISED ORDER.exe 2276 REVISED ORDER.exe 2200 msiexec.exe 2200 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.exemsiexec.exedescription pid process Token: SeDebugPrivilege 908 REVISED ORDER.exe Token: SeDebugPrivilege 2276 REVISED ORDER.exe Token: SeDebugPrivilege 2200 msiexec.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2644 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
REVISED ORDER.exeExplorer.EXEmsiexec.exedescription pid process target process PID 908 wrote to memory of 3488 908 REVISED ORDER.exe schtasks.exe PID 908 wrote to memory of 3488 908 REVISED ORDER.exe schtasks.exe PID 908 wrote to memory of 3488 908 REVISED ORDER.exe schtasks.exe PID 908 wrote to memory of 2276 908 REVISED ORDER.exe REVISED ORDER.exe PID 908 wrote to memory of 2276 908 REVISED ORDER.exe REVISED ORDER.exe PID 908 wrote to memory of 2276 908 REVISED ORDER.exe REVISED ORDER.exe PID 908 wrote to memory of 2276 908 REVISED ORDER.exe REVISED ORDER.exe PID 908 wrote to memory of 2276 908 REVISED ORDER.exe REVISED ORDER.exe PID 908 wrote to memory of 2276 908 REVISED ORDER.exe REVISED ORDER.exe PID 2644 wrote to memory of 2200 2644 Explorer.EXE msiexec.exe PID 2644 wrote to memory of 2200 2644 Explorer.EXE msiexec.exe PID 2644 wrote to memory of 2200 2644 Explorer.EXE msiexec.exe PID 2200 wrote to memory of 1376 2200 msiexec.exe cmd.exe PID 2200 wrote to memory of 1376 2200 msiexec.exe cmd.exe PID 2200 wrote to memory of 1376 2200 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBUqpPcrdY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4065.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4065.tmpMD5
363c7317eaf1d317ea833a90a56ce2df
SHA1cabe64aab71f254356c3387247517c6ffe6efcd6
SHA25604e87522fbbee841bb8f33009058bddc4302136f88752269ce7561479baad61b
SHA5129a86206150c45276cb94b2b5af2f5bf3caa32c93aaa3825a265c6ae17e341791f3b4ccc357864fba15c982be78f1c10748c964d792b2df0e5857b2c96774df2a
-
memory/908-120-0x000000000B090000-0x000000000B091000-memory.dmpFilesize
4KB
-
memory/908-118-0x0000000007A50000-0x0000000007A51000-memory.dmpFilesize
4KB
-
memory/908-117-0x0000000007E50000-0x0000000007E51000-memory.dmpFilesize
4KB
-
memory/908-119-0x0000000007BC0000-0x0000000007BC1000-memory.dmpFilesize
4KB
-
memory/908-114-0x0000000000770000-0x0000000000771000-memory.dmpFilesize
4KB
-
memory/908-121-0x0000000002BA0000-0x0000000002BAE000-memory.dmpFilesize
56KB
-
memory/908-122-0x0000000005460000-0x00000000054F0000-memory.dmpFilesize
576KB
-
memory/908-123-0x0000000005AF0000-0x0000000005B30000-memory.dmpFilesize
256KB
-
memory/908-116-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/1376-138-0x0000000000000000-mapping.dmp
-
memory/2200-132-0x0000000000000000-mapping.dmp
-
memory/2200-139-0x0000000000ED0000-0x0000000000F5F000-memory.dmpFilesize
572KB
-
memory/2200-135-0x0000000001050000-0x0000000001062000-memory.dmpFilesize
72KB
-
memory/2200-136-0x0000000000310000-0x0000000000338000-memory.dmpFilesize
160KB
-
memory/2200-137-0x0000000004610000-0x0000000004930000-memory.dmpFilesize
3.1MB
-
memory/2276-129-0x0000000001710000-0x0000000001A30000-memory.dmpFilesize
3.1MB
-
memory/2276-130-0x0000000001100000-0x000000000124A000-memory.dmpFilesize
1.3MB
-
memory/2276-127-0x000000000041CFF0-mapping.dmp
-
memory/2276-126-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2644-131-0x0000000006460000-0x0000000006598000-memory.dmpFilesize
1.2MB
-
memory/2644-140-0x0000000002C20000-0x0000000002D15000-memory.dmpFilesize
980KB
-
memory/3488-124-0x0000000000000000-mapping.dmp