Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
15-10-2021 21:19
Static task
static1
Behavioral task
behavioral1
Sample
Quotation- urgent basis.exe
Resource
win7-en-20211014
General
-
Target
Quotation- urgent basis.exe
-
Size
349KB
-
MD5
ef946df7574b283bf24b349d2cb679bf
-
SHA1
5100dfe4456adfd5cea41b5c137ea9e2fd10c7f7
-
SHA256
5bb8975c8a7e8080a8a68034458adfb7b8e9812b5a1fdd15f891656b03d086e6
-
SHA512
1a06445a1433fa1701ce6a06b9c3d134f2322dde48994a4ed1d1805fb2b8d49b859d2ffefcfa7f967af49b4f761e2629530e3a37389d271516719b8b43e94108
Malware Config
Extracted
xloader
2.5
b2c0
http://www.thesewhitevvalls.com/b2c0/
bjyxszd520.xyz
hsvfingerprinting.com
elliotpioneer.com
bf396.com
chinaopedia.com
6233v.com
shopeuphoricapparel.com
loccssol.store
truefictionpictures.com
playstarexch.com
peruviancoffee.store
shobhajoshi.com
philme.net
avito-rules.com
independencehomecenters.com
atp-cayenne.com
invetorsbank.com
sasanos.com
scentfreebnb.com
catfuid.com
sunshinefamilysupport.com
madison-co-atty.net
newhousebr.com
newstodayupdate.com
kamalaanjna.com
itpronto.com
hi-loentertainment.com
sadpartyrentals.com
vertuminy.com
khomayphotocopy.club
roleconstructora.com
cottonhome.online
starsspell.com
bedrijfs-kledingshop.com
aydeyahouse.com
miaintervista.com
taolemix.com
lnagvv.space
bjmobi.com
collabkc.art
onayli.net
ecostainable.com
vi88.info
brightlifeprochoice.com
taoluzhibo.info
techgobble.com
ideemimarlikinsaat.com
andajzx.com
shineshaft.website
arroundworld.com
reyuzed.com
emilfaucets.com
lumberjackguitarloops.com
pearl-interior.com
altitudebc.com
cqjiubai.com
kutahyaescortbayanlarim.xyz
metalworkingadditives.online
unasolucioendesa.com
andrewfjohnston.com
visionmark.net
dxxlewis.com
carts-amazon.com
anadolu.academy
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/912-64-0x000000000041D4C0-mapping.dmp xloader behavioral1/memory/912-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/912-69-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1096-74-0x00000000000F0000-0x0000000000119000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1084 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Quotation- urgent basis.exeQuotation- urgent basis.exewuapp.exedescription pid process target process PID 1752 set thread context of 912 1752 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 912 set thread context of 1392 912 Quotation- urgent basis.exe Explorer.EXE PID 912 set thread context of 1392 912 Quotation- urgent basis.exe Explorer.EXE PID 1096 set thread context of 1392 1096 wuapp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
Quotation- urgent basis.exeQuotation- urgent basis.exewuapp.exepid process 1752 Quotation- urgent basis.exe 1752 Quotation- urgent basis.exe 912 Quotation- urgent basis.exe 912 Quotation- urgent basis.exe 912 Quotation- urgent basis.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe 1096 wuapp.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Quotation- urgent basis.exewuapp.exepid process 912 Quotation- urgent basis.exe 912 Quotation- urgent basis.exe 912 Quotation- urgent basis.exe 912 Quotation- urgent basis.exe 1096 wuapp.exe 1096 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Quotation- urgent basis.exeQuotation- urgent basis.exewuapp.exedescription pid process Token: SeDebugPrivilege 1752 Quotation- urgent basis.exe Token: SeDebugPrivilege 912 Quotation- urgent basis.exe Token: SeDebugPrivilege 1096 wuapp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE 1392 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE 1392 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
Quotation- urgent basis.exeQuotation- urgent basis.exewuapp.exedescription pid process target process PID 1752 wrote to memory of 860 1752 Quotation- urgent basis.exe schtasks.exe PID 1752 wrote to memory of 860 1752 Quotation- urgent basis.exe schtasks.exe PID 1752 wrote to memory of 860 1752 Quotation- urgent basis.exe schtasks.exe PID 1752 wrote to memory of 860 1752 Quotation- urgent basis.exe schtasks.exe PID 1752 wrote to memory of 912 1752 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 1752 wrote to memory of 912 1752 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 1752 wrote to memory of 912 1752 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 1752 wrote to memory of 912 1752 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 1752 wrote to memory of 912 1752 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 1752 wrote to memory of 912 1752 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 1752 wrote to memory of 912 1752 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 912 wrote to memory of 1096 912 Quotation- urgent basis.exe wuapp.exe PID 912 wrote to memory of 1096 912 Quotation- urgent basis.exe wuapp.exe PID 912 wrote to memory of 1096 912 Quotation- urgent basis.exe wuapp.exe PID 912 wrote to memory of 1096 912 Quotation- urgent basis.exe wuapp.exe PID 912 wrote to memory of 1096 912 Quotation- urgent basis.exe wuapp.exe PID 912 wrote to memory of 1096 912 Quotation- urgent basis.exe wuapp.exe PID 912 wrote to memory of 1096 912 Quotation- urgent basis.exe wuapp.exe PID 1096 wrote to memory of 1084 1096 wuapp.exe cmd.exe PID 1096 wrote to memory of 1084 1096 wuapp.exe cmd.exe PID 1096 wrote to memory of 1084 1096 wuapp.exe cmd.exe PID 1096 wrote to memory of 1084 1096 wuapp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Quotation- urgent basis.exe"C:\Users\Admin\AppData\Local\Temp\Quotation- urgent basis.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tSXhFZeobghlE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp70BD.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Quotation- urgent basis.exe"C:\Users\Admin\AppData\Local\Temp\Quotation- urgent basis.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation- urgent basis.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/860-60-0x0000000000000000-mapping.dmp
-
memory/912-67-0x0000000000210000-0x0000000000221000-memory.dmpFilesize
68KB
-
memory/912-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/912-66-0x0000000000820000-0x0000000000B23000-memory.dmpFilesize
3.0MB
-
memory/912-70-0x0000000000350000-0x0000000000361000-memory.dmpFilesize
68KB
-
memory/912-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/912-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/912-64-0x000000000041D4C0-mapping.dmp
-
memory/912-69-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1084-75-0x0000000000000000-mapping.dmp
-
memory/1096-73-0x0000000000290000-0x000000000029B000-memory.dmpFilesize
44KB
-
memory/1096-77-0x0000000001CA0000-0x0000000001D30000-memory.dmpFilesize
576KB
-
memory/1096-72-0x0000000000000000-mapping.dmp
-
memory/1096-74-0x00000000000F0000-0x0000000000119000-memory.dmpFilesize
164KB
-
memory/1096-76-0x0000000001F70000-0x0000000002273000-memory.dmpFilesize
3.0MB
-
memory/1392-71-0x0000000007160000-0x0000000007283000-memory.dmpFilesize
1.1MB
-
memory/1392-78-0x0000000008DF0000-0x0000000008F0E000-memory.dmpFilesize
1.1MB
-
memory/1392-68-0x00000000061E0000-0x00000000062A2000-memory.dmpFilesize
776KB
-
memory/1752-58-0x0000000000350000-0x0000000000355000-memory.dmpFilesize
20KB
-
memory/1752-54-0x0000000001030000-0x0000000001031000-memory.dmpFilesize
4KB
-
memory/1752-56-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB
-
memory/1752-57-0x0000000000EE0000-0x0000000000EE1000-memory.dmpFilesize
4KB
-
memory/1752-59-0x0000000000CC0000-0x0000000000D0B000-memory.dmpFilesize
300KB