Analysis
-
max time kernel
147s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-09-2021 14:08
Static task
static1
Behavioral task
behavioral1
Sample
9d38faec3253e9ce395c8970d03d8180.exe
Resource
win7-en-20210920
General
-
Target
9d38faec3253e9ce395c8970d03d8180.exe
-
Size
253KB
-
MD5
9d38faec3253e9ce395c8970d03d8180
-
SHA1
53128b83b922c39ed32065c9d8baae2c13059719
-
SHA256
1771bccdd4c4fdc7d50d97ac10e5b1e0f980a4ff31233c59e9cfa17e9cd36a24
-
SHA512
0c883d98ff5f255f3c4cdc1664f726606e44280e867dd727caa19cd6aa3aee849c4dc5d9555b118310f2b648a2c217d30d297005648c61edd40969e21dd2271a
Malware Config
Extracted
xloader
2.5
9gdg
http://www.dechocolate.online/9gdg/
cao-catos.ca
humanityumbrella.com
heatherflintford.com
paddyjulian.com
venturedart.com
pimpyoursmile.com
shellbacklabs.com
acesteeisupply.com
socotrajeweltours.com
aykutozden.com
corncobmeal.com
lesbiansforever.com
picknock.com
pawspetreiki.com
waikikidesignco.com
lelittnpasumo4.xyz
billing-updating.info
barangdapo.com
gatorfirerescue.com
jmovt.com
yozotnpasumo4.xyz
theindiandreams.com
javfish.com
algorham.photography
eurocustompainting.com
commentcard.club
probinns.com
yourlenderjake.net
bestofmdi.guide
miniperfumeria.com
shanxishuangcheng.com
viviantle.com
metaverseliveshopping.com
xn--vckzfv91k.com
garygoodtime.com
meysaninsaat.com
vietnamagritourism.online
greenpillers.net
hughhegartyhedgecutting.com
clarkdn.com
b148t1rfm01qvtbnvgc5418.com
trump-911-memorial.com
seekr.tech
amarettoliqueur.info
planext4u.com
dzairfoot24.com
freshstartdaycarecenterinc.com
redwoodwomen.com
reallyfuntastic.com
cc-expert.com
vaccineexemption.net
goforgreentech.com
800maintenance.services
xn--zimmerei-lking-psb.info
football-latest.mobi
livenetsex.com
christinamossoriginals.com
zebraadz.com
targonia.com
pampashub.com
pallavitatelier.com
aboveallsupplies.com
hyderabadgroceries.com
starpluscommercial.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1704-56-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
9d38faec3253e9ce395c8970d03d8180.exepid process 1048 9d38faec3253e9ce395c8970d03d8180.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9d38faec3253e9ce395c8970d03d8180.exedescription pid process target process PID 1048 set thread context of 1704 1048 9d38faec3253e9ce395c8970d03d8180.exe 9d38faec3253e9ce395c8970d03d8180.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
9d38faec3253e9ce395c8970d03d8180.exepid process 1704 9d38faec3253e9ce395c8970d03d8180.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
9d38faec3253e9ce395c8970d03d8180.exepid process 1048 9d38faec3253e9ce395c8970d03d8180.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
9d38faec3253e9ce395c8970d03d8180.exedescription pid process target process PID 1048 wrote to memory of 1704 1048 9d38faec3253e9ce395c8970d03d8180.exe 9d38faec3253e9ce395c8970d03d8180.exe PID 1048 wrote to memory of 1704 1048 9d38faec3253e9ce395c8970d03d8180.exe 9d38faec3253e9ce395c8970d03d8180.exe PID 1048 wrote to memory of 1704 1048 9d38faec3253e9ce395c8970d03d8180.exe 9d38faec3253e9ce395c8970d03d8180.exe PID 1048 wrote to memory of 1704 1048 9d38faec3253e9ce395c8970d03d8180.exe 9d38faec3253e9ce395c8970d03d8180.exe PID 1048 wrote to memory of 1704 1048 9d38faec3253e9ce395c8970d03d8180.exe 9d38faec3253e9ce395c8970d03d8180.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d38faec3253e9ce395c8970d03d8180.exe"C:\Users\Admin\AppData\Local\Temp\9d38faec3253e9ce395c8970d03d8180.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d38faec3253e9ce395c8970d03d8180.exe"C:\Users\Admin\AppData\Local\Temp\9d38faec3253e9ce395c8970d03d8180.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsvAC36.tmp\chav.dllMD5
03cae9032f6d2d44d8ecd93c87f1313f
SHA1fe8f16836750db7d7fcb42d1d0ea77d55d145832
SHA256ba8dc1fbfac80564485d83433578839c4ffe432e4ec3e81182fb7eadcc54c6b8
SHA5125871980c59e457f47e47c86232640b2211c89bc6d3a9da7f89bf73f8f09fc6a8a48c9b88412c84367d7162349103192107ec24af637cd96227edd0db320fdc67
-
memory/1048-53-0x00000000755A1000-0x00000000755A3000-memory.dmpFilesize
8KB
-
memory/1704-55-0x000000000041D4A0-mapping.dmp
-
memory/1704-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1704-57-0x0000000000730000-0x0000000000A33000-memory.dmpFilesize
3.0MB