Analysis
-
max time kernel
115s -
max time network
53s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-09-2021 04:11
Static task
static1
Behavioral task
behavioral1
Sample
b6a81cd859b1f1c626d3202bf8da8a71.exe
Resource
win7v20210408
General
-
Target
b6a81cd859b1f1c626d3202bf8da8a71.exe
-
Size
810KB
-
MD5
b6a81cd859b1f1c626d3202bf8da8a71
-
SHA1
b61a593a3b9a98b525a6b6613d105e6b768c9b31
-
SHA256
d6456da8222e011fc380867758b9841728e223ff6addf03d48009de853368ff0
-
SHA512
319c7eec5fcd9572fb460fc2956391325cf9b93656ce12fb851fa32ebc0a0d29f0f816828c371e2525e1b8f9ad0022324ff1a6ee706579cabc13060ba132dcbc
Malware Config
Extracted
xloader
2.5
tows
http://www.steadycycling.com/tows/
affordableorganizing.net
airstreamnear.com
mindequalsmoney.com
ganleychevybuyscars.com
g17cp.com
flahertystudios.com
jermainemyersonlam.com
ivermectinbuyonline.online
leapconfront.com
rosevillerose.com
fjlypc.com
jugnievents.com
fulvicgump.com
lawofficeofgeorgeefootepx.com
cityinfoyellowpagesnepal.com
thenorthfacesale.online
citadel-soft.com
real-estate-lake-tahoe.com
middleeastclean.services
xinsufu.xyz
peartreebeach.com
panaceapp.com
heimass.xyz
seavisionconference.com
shjinbojiaju.com
iyisa.com
shanghaistrip.com
discgolfdrivingrange.com
jechercheunartisan.com
covid19voi.com
nqyuz.com
opalandamber.com
redsesystemes.com
heraeusmedia.com
reviewdetails.info
newspapers.digital
b95202.com
kyousaku.net
kangyewuliu.com
chsclbd.com
semantic-soft.com
hydrogenbins.com
qahy4wua.xyz
timtheodoroffbuilder.com
castlemarne.store
haoangjituan.com
tigeralquds.com
jabipeb.com
cablinqee.com
jsbaosteel.com
the-edge-apartments.info
southfloridafingerprints.com
atoosanasiri.com
coupons.computer
elittebeautyhair.com
fivestarinc.construction
ntntntnt.com
ateliemarinababy.com
werfen-appm.com
cpiu-67esk.com
guokopt.com
csolll.com
support-team-hawaiiantel.net
healthyfruitsmoothies.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1320-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1320-67-0x000000000041D4D0-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b6a81cd859b1f1c626d3202bf8da8a71.exedescription pid process target process PID 1980 set thread context of 1320 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
b6a81cd859b1f1c626d3202bf8da8a71.exepowershell.exepid process 1320 b6a81cd859b1f1c626d3202bf8da8a71.exe 1696 powershell.exe 1696 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1696 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
b6a81cd859b1f1c626d3202bf8da8a71.exedescription pid process target process PID 1980 wrote to memory of 1696 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe powershell.exe PID 1980 wrote to memory of 1696 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe powershell.exe PID 1980 wrote to memory of 1696 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe powershell.exe PID 1980 wrote to memory of 1696 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe powershell.exe PID 1980 wrote to memory of 1320 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe PID 1980 wrote to memory of 1320 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe PID 1980 wrote to memory of 1320 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe PID 1980 wrote to memory of 1320 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe PID 1980 wrote to memory of 1320 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe PID 1980 wrote to memory of 1320 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe PID 1980 wrote to memory of 1320 1980 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6a81cd859b1f1c626d3202bf8da8a71.exe"C:\Users\Admin\AppData\Local\Temp\b6a81cd859b1f1c626d3202bf8da8a71.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b6a81cd859b1f1c626d3202bf8da8a71.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\b6a81cd859b1f1c626d3202bf8da8a71.exe"C:\Users\Admin\AppData\Local\Temp\b6a81cd859b1f1c626d3202bf8da8a71.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1320-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1320-69-0x00000000008A0000-0x0000000000BA3000-memory.dmpFilesize
3.0MB
-
memory/1320-67-0x000000000041D4D0-mapping.dmp
-
memory/1696-65-0x0000000000000000-mapping.dmp
-
memory/1696-72-0x00000000048E0000-0x00000000048E1000-memory.dmpFilesize
4KB
-
memory/1696-107-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/1696-106-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/1696-92-0x00000000062B0000-0x00000000062B1000-memory.dmpFilesize
4KB
-
memory/1696-68-0x0000000075AD1000-0x0000000075AD3000-memory.dmpFilesize
8KB
-
memory/1696-70-0x0000000001F10000-0x0000000002B5A000-memory.dmpFilesize
12.3MB
-
memory/1696-91-0x0000000006240000-0x0000000006241000-memory.dmpFilesize
4KB
-
memory/1696-71-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/1696-84-0x00000000061A0000-0x00000000061A1000-memory.dmpFilesize
4KB
-
memory/1696-73-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/1696-74-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/1696-77-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1696-78-0x0000000006030000-0x0000000006031000-memory.dmpFilesize
4KB
-
memory/1696-83-0x0000000006080000-0x0000000006081000-memory.dmpFilesize
4KB
-
memory/1980-64-0x0000000000990000-0x00000000009BF000-memory.dmpFilesize
188KB
-
memory/1980-61-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/1980-62-0x0000000000580000-0x0000000000587000-memory.dmpFilesize
28KB
-
memory/1980-63-0x0000000004910000-0x000000000496F000-memory.dmpFilesize
380KB
-
memory/1980-59-0x0000000001170000-0x0000000001171000-memory.dmpFilesize
4KB