Analysis
- max time kernel
149s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
04/10/2021, 06:35
Static task
static1
Behavioral task
behavioral1
Sample
doc#0210903000.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target doc#0210903000.exe
- Size 256KB
- Sample211004-hcdz9afhd6
- SHA256 5852e0b1479d914e16a2f1cf21d61ff4e1f3d35b6fa5dbcf0055cfc2c9a89936
- MD5 9b8f96489ef491a4378ae2552ee9950f
- SHA1 276b5857cd4b0b4289660efa6751821df93f374f
- SHA512 7bd616157ae2c8021434937438fbcff60c139aafbb31f8c9b431925ecc2543af16216236557ba32360c784a6a65ef86f1e59b5a2fba47602035b9569731eac9a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
ycnd
C2
-
http://www.pollutepklucc.xyz/ycnd/
Decoy
-
com-weekly.email
-
mfcon.net
-
bepcfinanceira.com
-
fattynoodlefitness.com
-
1pavij.cloud
-
sddn36.xyz
-
bestmoviequote.com
-
pntex.xyz
-
epicdefence.com
-
severiendepruis.online
-
spatialarray.com
-
aa6588.com
-
delucagiuseppe.com
-
xn--lu5bu5b0wddtl.com
-
staffingbackgrounds.com
-
miragetorrent.com
-
zdofmsk.online
-
charmsandfables.com
-
pifsdefistudio.com
-
paisacollection.com
-
clashofkingsgame.net
-
osakas.online
-
heyitsje.com
-
youlookverynice.space
-
quotextaiwan.com
-
davysbar.com
-
tcato.xyz
-
helpinghand.vote
-
themixedlifeacademy.com
-
tblaf.store
-
barbaracissie.top
-
grahambeller.com
-
24cto.com
-
afthvanderheijden.info
-
zoebiotech.com
-
sociwall.com
-
cisew.com
-
a-mic-i-di-sergio-zuni-no.com
-
himadecor.com
-
amadacncfanuc.com
-
25-tattvas.com
-
hhqm118.com
-
aszturia-jewelry.com
-
thepurldistrict.com
-
py5d.top
-
high-clicks.com
-
loveandsaffron.com
-
erie-holdings.com
-
greetwithgadgets.com
-
sddn17.xyz
-
profitdaly.space
-
jiayicnc.com
-
daniellebargo.com
-
healingpowerlife.com
-
the-leftorium.com
-
lpsfhls.com
-
jhtmr.com
-
rojasandrojas.com
-
theinbetweencolorado.com
-
canelausafm.com
-
dcpfp.com
-
feriaspravida.com
-
lokumgunu.xyz
-
46che.com
Signatures
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/1048-115-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1048-116-0x000000000041D3C0-mapping.dmp xloader behavioral2/memory/1196-122-0x0000000000770000-0x0000000000799000-memory.dmp xloader - Loads dropped DLL 1 IoCs
pid Process 396 doc#0210903000.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 396 set thread context of 1048 396 doc#0210903000.exe 68 PID 1048 set thread context of 3032 1048 doc#0210903000.exe 12 PID 1196 set thread context of 3032 1196 cscript.exe 12 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1048 doc#0210903000.exe 1048 doc#0210903000.exe 1048 doc#0210903000.exe 1048 doc#0210903000.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe 1196 cscript.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3032 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1048 doc#0210903000.exe 1048 doc#0210903000.exe 1048 doc#0210903000.exe 1196 cscript.exe 1196 cscript.exe - Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 1048 doc#0210903000.exe Token: SeDebugPrivilege 1196 cscript.exe Token: SeShutdownPrivilege 3032 Explorer.EXE Token: SeCreatePagefilePrivilege 3032 Explorer.EXE Token: SeShutdownPrivilege 3032 Explorer.EXE Token: SeCreatePagefilePrivilege 3032 Explorer.EXE Token: SeShutdownPrivilege 3032 Explorer.EXE Token: SeCreatePagefilePrivilege 3032 Explorer.EXE - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE 3032 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 396 wrote to memory of 1048 396 doc#0210903000.exe 68 PID 396 wrote to memory of 1048 396 doc#0210903000.exe 68 PID 396 wrote to memory of 1048 396 doc#0210903000.exe 68 PID 396 wrote to memory of 1048 396 doc#0210903000.exe 68 PID 396 wrote to memory of 1048 396 doc#0210903000.exe 68 PID 396 wrote to memory of 1048 396 doc#0210903000.exe 68 PID 3032 wrote to memory of 1196 3032 Explorer.EXE 69 PID 3032 wrote to memory of 1196 3032 Explorer.EXE 69 PID 3032 wrote to memory of 1196 3032 Explorer.EXE 69 PID 1196 wrote to memory of 1440 1196 cscript.exe 70 PID 1196 wrote to memory of 1440 1196 cscript.exe 70 PID 1196 wrote to memory of 1440 1196 cscript.exe 70
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\doc#0210903000.exe"C:\Users\Admin\AppData\Local\Temp\doc#0210903000.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Users\Admin\AppData\Local\Temp\doc#0210903000.exe"C:\Users\Admin\AppData\Local\Temp\doc#0210903000.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\doc#0210903000.exe"3⤵PID:1440
-
-