Analysis
-
max time kernel
147s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
06-05-2021 11:02
Static task
static1
Behavioral task
behavioral1
Sample
REVISED ORDER.exe
Resource
win7v20210410
General
-
Target
REVISED ORDER.exe
-
Size
985KB
-
MD5
61f942cbb67b5a5de8f72dfe65227175
-
SHA1
45271b8b2797e1232efe813d9d34e9ca9c7564a4
-
SHA256
979a3e20b43d1aad57018b9c867e4bde7606d0515c9c71b2050b02c0b5e5fd10
-
SHA512
f6448602b457f455e3da9f8e2c30c5d0062ed81c10b420f180a6ba7b7c4fa5dd3eef4cfc95db68a476d27ee40bb6bb86a4a8b55b4fedea87ada32ba87ddb80f7
Malware Config
Extracted
xloader
2.3
http://www.athomecp.com/owws/
trolljoke.com
contex3.info
jabashir51.com
brittand.com
djaya.asia
lab-wealth.com
greyfriararabians.com
oxfordhabits.com
softwaresreports.info
abjms.com
winsteadarchitecture.com
brucerolfsboulder.com
unitytribune.com
cyjulebu.com
abaplants.com
theexerciseforyou.com
codigodebarrasser.com
barbicanroadproductions.com
sportenango.com
hostsnc.com
clubdonovoka.com
adaptive.science
meeplesisters.com
shubhkari.com
pooliswaiting.com
sempat-ya8.com
davispackphotography.com
dezigo.design
faxbbs.com
lunarvac.com
thewerideveloper.com
ingenesinstitute.com
elizabethfulco.com
assemble-4u.com
jingcilian.com
rnpynsjw.net
raphainfosec.com
gdzas08.cloud
murrpurrs.net
hakua36tokyo.com
rakennuskolibri.net
renerossi.com
raphaelyejesiel.com
phoxinh.net
amrshadhartanah21.com
thehoneyglo.com
xn--mariachilen-zeb.com
excelfaq.online
expandetusingresos.com
cupsteam.com
your-new-body-plan.com
misskarenenglishreacher.com
pulkitkumar.wtf
tluxebeautyexperience.com
sissysundays.com
ketoburnerrevolution.com
babdestaffing.com
easywayplanet.com
rewealth.club
siamboss.com
shamansmoke.com
truervoice.com
denisekohli.com
gx17.net
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/796-68-0x000000000041CFF0-mapping.dmp xloader behavioral1/memory/796-67-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1232-76-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 760 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.execontrol.exedescription pid process target process PID 788 set thread context of 796 788 REVISED ORDER.exe REVISED ORDER.exe PID 796 set thread context of 1256 796 REVISED ORDER.exe Explorer.EXE PID 1232 set thread context of 1256 1232 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.execontrol.exepid process 788 REVISED ORDER.exe 788 REVISED ORDER.exe 788 REVISED ORDER.exe 788 REVISED ORDER.exe 788 REVISED ORDER.exe 788 REVISED ORDER.exe 788 REVISED ORDER.exe 788 REVISED ORDER.exe 788 REVISED ORDER.exe 788 REVISED ORDER.exe 796 REVISED ORDER.exe 796 REVISED ORDER.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe 1232 control.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
REVISED ORDER.execontrol.exepid process 796 REVISED ORDER.exe 796 REVISED ORDER.exe 796 REVISED ORDER.exe 1232 control.exe 1232 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.execontrol.exedescription pid process Token: SeDebugPrivilege 788 REVISED ORDER.exe Token: SeDebugPrivilege 796 REVISED ORDER.exe Token: SeDebugPrivilege 1232 control.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE 1256 Explorer.EXE -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
REVISED ORDER.exeExplorer.EXEcontrol.exedescription pid process target process PID 788 wrote to memory of 1632 788 REVISED ORDER.exe schtasks.exe PID 788 wrote to memory of 1632 788 REVISED ORDER.exe schtasks.exe PID 788 wrote to memory of 1632 788 REVISED ORDER.exe schtasks.exe PID 788 wrote to memory of 1632 788 REVISED ORDER.exe schtasks.exe PID 788 wrote to memory of 332 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 332 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 332 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 332 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 1764 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 1764 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 1764 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 1764 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 968 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 968 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 968 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 968 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 544 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 544 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 544 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 544 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 796 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 796 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 796 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 796 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 796 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 796 788 REVISED ORDER.exe REVISED ORDER.exe PID 788 wrote to memory of 796 788 REVISED ORDER.exe REVISED ORDER.exe PID 1256 wrote to memory of 1232 1256 Explorer.EXE control.exe PID 1256 wrote to memory of 1232 1256 Explorer.EXE control.exe PID 1256 wrote to memory of 1232 1256 Explorer.EXE control.exe PID 1256 wrote to memory of 1232 1256 Explorer.EXE control.exe PID 1232 wrote to memory of 760 1232 control.exe cmd.exe PID 1232 wrote to memory of 760 1232 control.exe cmd.exe PID 1232 wrote to memory of 760 1232 control.exe cmd.exe PID 1232 wrote to memory of 760 1232 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBUqpPcrdY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp844D.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"{path}"3⤵
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp844D.tmpMD5
0c3aed9b5afdcd71dca5d614c56064d9
SHA1a93d5b02764f87e1b5f3f993f32c73dedc02f075
SHA25645790da5c41a18899ed398002bbfca251cdcd83e6bba8093d1b5997f1801d1f4
SHA51257d30f0e9c4346e0d1e3b686e7cc38bb194730859db6274ac5df38fc142faa8d34d74e3069efb0c20059e48cc1c48abfb9a6a58444a8c800a84e1731b04976f6
-
memory/760-77-0x0000000000000000-mapping.dmp
-
memory/788-59-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/788-61-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/788-62-0x00000000005F0000-0x00000000005FE000-memory.dmpFilesize
56KB
-
memory/788-63-0x0000000004F70000-0x0000000005000000-memory.dmpFilesize
576KB
-
memory/788-64-0x0000000001F20000-0x0000000001F60000-memory.dmpFilesize
256KB
-
memory/796-68-0x000000000041CFF0-mapping.dmp
-
memory/796-67-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/796-70-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB
-
memory/796-71-0x00000000002C0000-0x00000000002D0000-memory.dmpFilesize
64KB
-
memory/1232-76-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/1232-73-0x0000000000000000-mapping.dmp
-
memory/1232-74-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/1232-75-0x0000000000200000-0x000000000021F000-memory.dmpFilesize
124KB
-
memory/1232-78-0x0000000001ED0000-0x00000000021D3000-memory.dmpFilesize
3.0MB
-
memory/1232-79-0x0000000001DE0000-0x0000000001E6F000-memory.dmpFilesize
572KB
-
memory/1256-72-0x0000000006640000-0x00000000067C2000-memory.dmpFilesize
1.5MB
-
memory/1256-80-0x0000000007010000-0x0000000007184000-memory.dmpFilesize
1.5MB
-
memory/1632-65-0x0000000000000000-mapping.dmp