Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
06-05-2021 11:02
Static task
static1
Behavioral task
behavioral1
Sample
REVISED ORDER.exe
Resource
win7v20210410
General
-
Target
REVISED ORDER.exe
-
Size
985KB
-
MD5
61f942cbb67b5a5de8f72dfe65227175
-
SHA1
45271b8b2797e1232efe813d9d34e9ca9c7564a4
-
SHA256
979a3e20b43d1aad57018b9c867e4bde7606d0515c9c71b2050b02c0b5e5fd10
-
SHA512
f6448602b457f455e3da9f8e2c30c5d0062ed81c10b420f180a6ba7b7c4fa5dd3eef4cfc95db68a476d27ee40bb6bb86a4a8b55b4fedea87ada32ba87ddb80f7
Malware Config
Extracted
xloader
2.3
http://www.athomecp.com/owws/
trolljoke.com
contex3.info
jabashir51.com
brittand.com
djaya.asia
lab-wealth.com
greyfriararabians.com
oxfordhabits.com
softwaresreports.info
abjms.com
winsteadarchitecture.com
brucerolfsboulder.com
unitytribune.com
cyjulebu.com
abaplants.com
theexerciseforyou.com
codigodebarrasser.com
barbicanroadproductions.com
sportenango.com
hostsnc.com
clubdonovoka.com
adaptive.science
meeplesisters.com
shubhkari.com
pooliswaiting.com
sempat-ya8.com
davispackphotography.com
dezigo.design
faxbbs.com
lunarvac.com
thewerideveloper.com
ingenesinstitute.com
elizabethfulco.com
assemble-4u.com
jingcilian.com
rnpynsjw.net
raphainfosec.com
gdzas08.cloud
murrpurrs.net
hakua36tokyo.com
rakennuskolibri.net
renerossi.com
raphaelyejesiel.com
phoxinh.net
amrshadhartanah21.com
thehoneyglo.com
xn--mariachilen-zeb.com
excelfaq.online
expandetusingresos.com
cupsteam.com
your-new-body-plan.com
misskarenenglishreacher.com
pulkitkumar.wtf
tluxebeautyexperience.com
sissysundays.com
ketoburnerrevolution.com
babdestaffing.com
easywayplanet.com
rewealth.club
siamboss.com
shamansmoke.com
truervoice.com
denisekohli.com
gx17.net
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3840-126-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3840-127-0x000000000041CFF0-mapping.dmp xloader behavioral2/memory/1520-134-0x0000000000960000-0x0000000000988000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.exemstsc.exedescription pid process target process PID 512 set thread context of 3840 512 REVISED ORDER.exe REVISED ORDER.exe PID 3840 set thread context of 388 3840 REVISED ORDER.exe Explorer.EXE PID 1520 set thread context of 388 1520 mstsc.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.exemstsc.exepid process 512 REVISED ORDER.exe 512 REVISED ORDER.exe 512 REVISED ORDER.exe 3840 REVISED ORDER.exe 3840 REVISED ORDER.exe 3840 REVISED ORDER.exe 3840 REVISED ORDER.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe 1520 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 388 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
REVISED ORDER.exemstsc.exepid process 3840 REVISED ORDER.exe 3840 REVISED ORDER.exe 3840 REVISED ORDER.exe 1520 mstsc.exe 1520 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
REVISED ORDER.exeREVISED ORDER.exemstsc.exedescription pid process Token: SeDebugPrivilege 512 REVISED ORDER.exe Token: SeDebugPrivilege 3840 REVISED ORDER.exe Token: SeDebugPrivilege 1520 mstsc.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 388 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
REVISED ORDER.exeExplorer.EXEmstsc.exedescription pid process target process PID 512 wrote to memory of 3984 512 REVISED ORDER.exe schtasks.exe PID 512 wrote to memory of 3984 512 REVISED ORDER.exe schtasks.exe PID 512 wrote to memory of 3984 512 REVISED ORDER.exe schtasks.exe PID 512 wrote to memory of 3840 512 REVISED ORDER.exe REVISED ORDER.exe PID 512 wrote to memory of 3840 512 REVISED ORDER.exe REVISED ORDER.exe PID 512 wrote to memory of 3840 512 REVISED ORDER.exe REVISED ORDER.exe PID 512 wrote to memory of 3840 512 REVISED ORDER.exe REVISED ORDER.exe PID 512 wrote to memory of 3840 512 REVISED ORDER.exe REVISED ORDER.exe PID 512 wrote to memory of 3840 512 REVISED ORDER.exe REVISED ORDER.exe PID 388 wrote to memory of 1520 388 Explorer.EXE mstsc.exe PID 388 wrote to memory of 1520 388 Explorer.EXE mstsc.exe PID 388 wrote to memory of 1520 388 Explorer.EXE mstsc.exe PID 1520 wrote to memory of 2188 1520 mstsc.exe cmd.exe PID 1520 wrote to memory of 2188 1520 mstsc.exe cmd.exe PID 1520 wrote to memory of 2188 1520 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aBUqpPcrdY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp88FC.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REVISED ORDER.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp88FC.tmpMD5
f896c14fd016108f53438ac250889bcd
SHA170cc1c9d29e2e49eb42d5d9a91957448f068fd36
SHA256061bff73944be5dda556967eeb199b9db7425ec4d943fde0de61ae0a4fa8f69c
SHA5122aa9a41fc2db0ec9a880762ede4e5530b57d06312f8ab2ef69db2c9604a0ae713a703db6a92508eaab17618384c0800f19a5aa8901861d15e4aa067581670df6
-
memory/388-138-0x0000000005C50000-0x0000000005D2E000-memory.dmpFilesize
888KB
-
memory/388-131-0x00000000058B0000-0x0000000005972000-memory.dmpFilesize
776KB
-
memory/512-120-0x00000000093F0000-0x00000000093F1000-memory.dmpFilesize
4KB
-
memory/512-117-0x0000000007880000-0x0000000007881000-memory.dmpFilesize
4KB
-
memory/512-114-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/512-121-0x0000000002A70000-0x0000000002A7E000-memory.dmpFilesize
56KB
-
memory/512-122-0x00000000052E0000-0x0000000005370000-memory.dmpFilesize
576KB
-
memory/512-123-0x0000000005970000-0x00000000059B0000-memory.dmpFilesize
256KB
-
memory/512-116-0x0000000007CE0000-0x0000000007CE1000-memory.dmpFilesize
4KB
-
memory/512-118-0x00000000074D0000-0x00000000074D1000-memory.dmpFilesize
4KB
-
memory/512-119-0x0000000007840000-0x0000000007841000-memory.dmpFilesize
4KB
-
memory/1520-132-0x0000000000000000-mapping.dmp
-
memory/1520-133-0x00000000012C0000-0x00000000015BC000-memory.dmpFilesize
3.0MB
-
memory/1520-134-0x0000000000960000-0x0000000000988000-memory.dmpFilesize
160KB
-
memory/1520-136-0x0000000004E90000-0x00000000051B0000-memory.dmpFilesize
3.1MB
-
memory/1520-137-0x0000000004D50000-0x0000000004DDF000-memory.dmpFilesize
572KB
-
memory/2188-135-0x0000000000000000-mapping.dmp
-
memory/3840-127-0x000000000041CFF0-mapping.dmp
-
memory/3840-130-0x0000000001C30000-0x0000000001C40000-memory.dmpFilesize
64KB
-
memory/3840-129-0x0000000001840000-0x0000000001B60000-memory.dmpFilesize
3.1MB
-
memory/3840-126-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3984-124-0x0000000000000000-mapping.dmp