Analysis
-
max time kernel
164s -
max time network
162s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
11-10-2021 14:18
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe
Resource
win7-en-20210920
General
-
Target
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe
-
Size
603KB
-
MD5
f8ba5db8bad75222081bc6b9297126a4
-
SHA1
290a186a9869a6f3ded1049b1d567eafe0041f5d
-
SHA256
b4fc77c70794670f21a4c4fbc3b608589cef7b9d98acadf9b0a956404f6ca0be
-
SHA512
70f90c213dfd898c3f9e91bb6855493ab894604f04ced9b910c3f37eb1bbe658b6944cc847e315d7fe9d793bf1dba8772c38ef12fbf3cf41c52fcde3adca26d5
Malware Config
Extracted
xloader
2.5
b2c0
http://www.thesewhitevvalls.com/b2c0/
bjyxszd520.xyz
hsvfingerprinting.com
elliotpioneer.com
bf396.com
chinaopedia.com
6233v.com
shopeuphoricapparel.com
loccssol.store
truefictionpictures.com
playstarexch.com
peruviancoffee.store
shobhajoshi.com
philme.net
avito-rules.com
independencehomecenters.com
atp-cayenne.com
invetorsbank.com
sasanos.com
scentfreebnb.com
catfuid.com
sunshinefamilysupport.com
madison-co-atty.net
newhousebr.com
newstodayupdate.com
kamalaanjna.com
itpronto.com
hi-loentertainment.com
sadpartyrentals.com
vertuminy.com
khomayphotocopy.club
roleconstructora.com
cottonhome.online
starsspell.com
bedrijfs-kledingshop.com
aydeyahouse.com
miaintervista.com
taolemix.com
lnagvv.space
bjmobi.com
collabkc.art
onayli.net
ecostainable.com
vi88.info
brightlifeprochoice.com
taoluzhibo.info
techgobble.com
ideemimarlikinsaat.com
andajzx.com
shineshaft.website
arroundworld.com
reyuzed.com
emilfaucets.com
lumberjackguitarloops.com
pearl-interior.com
altitudebc.com
cqjiubai.com
kutahyaescortbayanlarim.xyz
metalworkingadditives.online
unasolucioendesa.com
andrewfjohnston.com
visionmark.net
dxxlewis.com
carts-amazon.com
anadolu.academy
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1092-115-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1092-116-0x000000000041D4C0-mapping.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exepid process 1076 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exedescription pid process target process PID 1076 set thread context of 1092 1076 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\Debug\ESE.TXT svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 4 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\16\52C64B7E svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exepid process 1092 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe 1092 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exedescription pid process target process PID 1076 wrote to memory of 1092 1076 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe PID 1076 wrote to memory of 1092 1076 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe PID 1076 wrote to memory of 1092 1076 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe PID 1076 wrote to memory of 1092 1076 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe PID 1076 wrote to memory of 1092 1076 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe PID 1076 wrote to memory of 1092 1076 SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.NSISX.Spy.Gen.2.16645.16215.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsf2D3C.tmp\fqbakxndgg.dllMD5
0ec0b6676a0c830fa1d12a82e0e2ccfc
SHA161edae0d4bb19dd31b9ed2ed4d76c99b4f04ebe2
SHA256c168119aced865f94f0856f3d7419f33142ffe0e8f90c94205d5707b60710617
SHA512ea5496d61a19ac03a49788d5cc7ae18603ec728c153b9c580f6faa7cfc850c297f9978429627e765467d8130409ca25ce041f0f42065d14fe53c6ef69943e574
-
memory/1092-115-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1092-116-0x000000000041D4C0-mapping.dmp
-
memory/1092-117-0x0000000000990000-0x0000000000CB0000-memory.dmpFilesize
3.1MB