Analysis
-
max time kernel
116s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
27-09-2021 04:11
Static task
static1
Behavioral task
behavioral1
Sample
b6a81cd859b1f1c626d3202bf8da8a71.exe
Resource
win7v20210408
General
-
Target
b6a81cd859b1f1c626d3202bf8da8a71.exe
-
Size
810KB
-
MD5
b6a81cd859b1f1c626d3202bf8da8a71
-
SHA1
b61a593a3b9a98b525a6b6613d105e6b768c9b31
-
SHA256
d6456da8222e011fc380867758b9841728e223ff6addf03d48009de853368ff0
-
SHA512
319c7eec5fcd9572fb460fc2956391325cf9b93656ce12fb851fa32ebc0a0d29f0f816828c371e2525e1b8f9ad0022324ff1a6ee706579cabc13060ba132dcbc
Malware Config
Extracted
xloader
2.5
tows
http://www.steadycycling.com/tows/
affordableorganizing.net
airstreamnear.com
mindequalsmoney.com
ganleychevybuyscars.com
g17cp.com
flahertystudios.com
jermainemyersonlam.com
ivermectinbuyonline.online
leapconfront.com
rosevillerose.com
fjlypc.com
jugnievents.com
fulvicgump.com
lawofficeofgeorgeefootepx.com
cityinfoyellowpagesnepal.com
thenorthfacesale.online
citadel-soft.com
real-estate-lake-tahoe.com
middleeastclean.services
xinsufu.xyz
peartreebeach.com
panaceapp.com
heimass.xyz
seavisionconference.com
shjinbojiaju.com
iyisa.com
shanghaistrip.com
discgolfdrivingrange.com
jechercheunartisan.com
covid19voi.com
nqyuz.com
opalandamber.com
redsesystemes.com
heraeusmedia.com
reviewdetails.info
newspapers.digital
b95202.com
kyousaku.net
kangyewuliu.com
chsclbd.com
semantic-soft.com
hydrogenbins.com
qahy4wua.xyz
timtheodoroffbuilder.com
castlemarne.store
haoangjituan.com
tigeralquds.com
jabipeb.com
cablinqee.com
jsbaosteel.com
the-edge-apartments.info
southfloridafingerprints.com
atoosanasiri.com
coupons.computer
elittebeautyhair.com
fivestarinc.construction
ntntntnt.com
ateliemarinababy.com
werfen-appm.com
cpiu-67esk.com
guokopt.com
csolll.com
support-team-hawaiiantel.net
healthyfruitsmoothies.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3568-127-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3568-128-0x000000000041D4D0-mapping.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b6a81cd859b1f1c626d3202bf8da8a71.exedescription pid process target process PID 1796 set thread context of 3568 1796 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exeb6a81cd859b1f1c626d3202bf8da8a71.exepid process 2784 powershell.exe 3568 b6a81cd859b1f1c626d3202bf8da8a71.exe 3568 b6a81cd859b1f1c626d3202bf8da8a71.exe 2784 powershell.exe 2784 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2784 powershell.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b6a81cd859b1f1c626d3202bf8da8a71.exedescription pid process target process PID 1796 wrote to memory of 2784 1796 b6a81cd859b1f1c626d3202bf8da8a71.exe powershell.exe PID 1796 wrote to memory of 2784 1796 b6a81cd859b1f1c626d3202bf8da8a71.exe powershell.exe PID 1796 wrote to memory of 2784 1796 b6a81cd859b1f1c626d3202bf8da8a71.exe powershell.exe PID 1796 wrote to memory of 3568 1796 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe PID 1796 wrote to memory of 3568 1796 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe PID 1796 wrote to memory of 3568 1796 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe PID 1796 wrote to memory of 3568 1796 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe PID 1796 wrote to memory of 3568 1796 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe PID 1796 wrote to memory of 3568 1796 b6a81cd859b1f1c626d3202bf8da8a71.exe b6a81cd859b1f1c626d3202bf8da8a71.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6a81cd859b1f1c626d3202bf8da8a71.exe"C:\Users\Admin\AppData\Local\Temp\b6a81cd859b1f1c626d3202bf8da8a71.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b6a81cd859b1f1c626d3202bf8da8a71.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\b6a81cd859b1f1c626d3202bf8da8a71.exe"C:\Users\Admin\AppData\Local\Temp\b6a81cd859b1f1c626d3202bf8da8a71.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1796-115-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/1796-117-0x0000000005A40000-0x0000000005A41000-memory.dmpFilesize
4KB
-
memory/1796-118-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/1796-119-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/1796-120-0x0000000005540000-0x0000000005A3E000-memory.dmpFilesize
5.0MB
-
memory/1796-121-0x0000000006040000-0x0000000006041000-memory.dmpFilesize
4KB
-
memory/1796-122-0x00000000059A0000-0x00000000059A7000-memory.dmpFilesize
28KB
-
memory/1796-123-0x0000000009190000-0x0000000009191000-memory.dmpFilesize
4KB
-
memory/1796-124-0x0000000009060000-0x00000000090BF000-memory.dmpFilesize
380KB
-
memory/1796-125-0x00000000090D0000-0x00000000090FF000-memory.dmpFilesize
188KB
-
memory/2784-134-0x0000000007DE0000-0x0000000007DE1000-memory.dmpFilesize
4KB
-
memory/2784-157-0x0000000009750000-0x0000000009751000-memory.dmpFilesize
4KB
-
memory/2784-364-0x0000000009A10000-0x0000000009A11000-memory.dmpFilesize
4KB
-
memory/2784-131-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/2784-132-0x0000000007710000-0x0000000007711000-memory.dmpFilesize
4KB
-
memory/2784-133-0x0000000007D40000-0x0000000007D41000-memory.dmpFilesize
4KB
-
memory/2784-126-0x0000000000000000-mapping.dmp
-
memory/2784-135-0x0000000008030000-0x0000000008031000-memory.dmpFilesize
4KB
-
memory/2784-138-0x0000000004CB2000-0x0000000004CB3000-memory.dmpFilesize
4KB
-
memory/2784-137-0x0000000008100000-0x0000000008101000-memory.dmpFilesize
4KB
-
memory/2784-136-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/2784-358-0x0000000009A20000-0x0000000009A21000-memory.dmpFilesize
4KB
-
memory/2784-140-0x0000000007F10000-0x0000000007F11000-memory.dmpFilesize
4KB
-
memory/2784-141-0x0000000008850000-0x0000000008851000-memory.dmpFilesize
4KB
-
memory/2784-142-0x0000000008710000-0x0000000008711000-memory.dmpFilesize
4KB
-
memory/2784-150-0x0000000009770000-0x00000000097A3000-memory.dmpFilesize
204KB
-
memory/2784-233-0x0000000004CB3000-0x0000000004CB4000-memory.dmpFilesize
4KB
-
memory/2784-162-0x00000000098B0000-0x00000000098B1000-memory.dmpFilesize
4KB
-
memory/2784-163-0x0000000009A90000-0x0000000009A91000-memory.dmpFilesize
4KB
-
memory/2784-232-0x000000007F680000-0x000000007F681000-memory.dmpFilesize
4KB
-
memory/3568-127-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3568-139-0x0000000001910000-0x0000000001C30000-memory.dmpFilesize
3.1MB
-
memory/3568-128-0x000000000041D4D0-mapping.dmp