Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
15-10-2021 21:19
Static task
static1
Behavioral task
behavioral1
Sample
Quotation- urgent basis.exe
Resource
win7-en-20211014
General
-
Target
Quotation- urgent basis.exe
-
Size
349KB
-
MD5
ef946df7574b283bf24b349d2cb679bf
-
SHA1
5100dfe4456adfd5cea41b5c137ea9e2fd10c7f7
-
SHA256
5bb8975c8a7e8080a8a68034458adfb7b8e9812b5a1fdd15f891656b03d086e6
-
SHA512
1a06445a1433fa1701ce6a06b9c3d134f2322dde48994a4ed1d1805fb2b8d49b859d2ffefcfa7f967af49b4f761e2629530e3a37389d271516719b8b43e94108
Malware Config
Extracted
xloader
2.5
b2c0
http://www.thesewhitevvalls.com/b2c0/
bjyxszd520.xyz
hsvfingerprinting.com
elliotpioneer.com
bf396.com
chinaopedia.com
6233v.com
shopeuphoricapparel.com
loccssol.store
truefictionpictures.com
playstarexch.com
peruviancoffee.store
shobhajoshi.com
philme.net
avito-rules.com
independencehomecenters.com
atp-cayenne.com
invetorsbank.com
sasanos.com
scentfreebnb.com
catfuid.com
sunshinefamilysupport.com
madison-co-atty.net
newhousebr.com
newstodayupdate.com
kamalaanjna.com
itpronto.com
hi-loentertainment.com
sadpartyrentals.com
vertuminy.com
khomayphotocopy.club
roleconstructora.com
cottonhome.online
starsspell.com
bedrijfs-kledingshop.com
aydeyahouse.com
miaintervista.com
taolemix.com
lnagvv.space
bjmobi.com
collabkc.art
onayli.net
ecostainable.com
vi88.info
brightlifeprochoice.com
taoluzhibo.info
techgobble.com
ideemimarlikinsaat.com
andajzx.com
shineshaft.website
arroundworld.com
reyuzed.com
emilfaucets.com
lumberjackguitarloops.com
pearl-interior.com
altitudebc.com
cqjiubai.com
kutahyaescortbayanlarim.xyz
metalworkingadditives.online
unasolucioendesa.com
andrewfjohnston.com
visionmark.net
dxxlewis.com
carts-amazon.com
anadolu.academy
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3080-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3080-126-0x000000000041D4C0-mapping.dmp xloader behavioral2/memory/3080-131-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1796-137-0x0000000000940000-0x0000000000969000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Quotation- urgent basis.exeQuotation- urgent basis.exeraserver.exedescription pid process target process PID 2548 set thread context of 3080 2548 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 3080 set thread context of 3028 3080 Quotation- urgent basis.exe Explorer.EXE PID 3080 set thread context of 3028 3080 Quotation- urgent basis.exe Explorer.EXE PID 1796 set thread context of 3028 1796 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
Quotation- urgent basis.exeQuotation- urgent basis.exeraserver.exepid process 2548 Quotation- urgent basis.exe 2548 Quotation- urgent basis.exe 3080 Quotation- urgent basis.exe 3080 Quotation- urgent basis.exe 3080 Quotation- urgent basis.exe 3080 Quotation- urgent basis.exe 3080 Quotation- urgent basis.exe 3080 Quotation- urgent basis.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe 1796 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Quotation- urgent basis.exeraserver.exepid process 3080 Quotation- urgent basis.exe 3080 Quotation- urgent basis.exe 3080 Quotation- urgent basis.exe 3080 Quotation- urgent basis.exe 1796 raserver.exe 1796 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Quotation- urgent basis.exeQuotation- urgent basis.exeraserver.exedescription pid process Token: SeDebugPrivilege 2548 Quotation- urgent basis.exe Token: SeDebugPrivilege 3080 Quotation- urgent basis.exe Token: SeDebugPrivilege 1796 raserver.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Quotation- urgent basis.exeQuotation- urgent basis.exeraserver.exedescription pid process target process PID 2548 wrote to memory of 3020 2548 Quotation- urgent basis.exe schtasks.exe PID 2548 wrote to memory of 3020 2548 Quotation- urgent basis.exe schtasks.exe PID 2548 wrote to memory of 3020 2548 Quotation- urgent basis.exe schtasks.exe PID 2548 wrote to memory of 3080 2548 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 2548 wrote to memory of 3080 2548 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 2548 wrote to memory of 3080 2548 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 2548 wrote to memory of 3080 2548 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 2548 wrote to memory of 3080 2548 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 2548 wrote to memory of 3080 2548 Quotation- urgent basis.exe Quotation- urgent basis.exe PID 3080 wrote to memory of 1796 3080 Quotation- urgent basis.exe raserver.exe PID 3080 wrote to memory of 1796 3080 Quotation- urgent basis.exe raserver.exe PID 3080 wrote to memory of 1796 3080 Quotation- urgent basis.exe raserver.exe PID 1796 wrote to memory of 1328 1796 raserver.exe cmd.exe PID 1796 wrote to memory of 1328 1796 raserver.exe cmd.exe PID 1796 wrote to memory of 1328 1796 raserver.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Quotation- urgent basis.exe"C:\Users\Admin\AppData\Local\Temp\Quotation- urgent basis.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tSXhFZeobghlE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp896F.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Quotation- urgent basis.exe"C:\Users\Admin\AppData\Local\Temp\Quotation- urgent basis.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"4⤵
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation- urgent basis.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1328-135-0x0000000000000000-mapping.dmp
-
memory/1796-134-0x0000000000000000-mapping.dmp
-
memory/1796-139-0x0000000004930000-0x00000000049C0000-memory.dmpFilesize
576KB
-
memory/1796-137-0x0000000000940000-0x0000000000969000-memory.dmpFilesize
164KB
-
memory/1796-138-0x0000000004AD0000-0x0000000004DF0000-memory.dmpFilesize
3.1MB
-
memory/1796-136-0x0000000001380000-0x000000000139F000-memory.dmpFilesize
124KB
-
memory/2548-122-0x0000000007AA0000-0x0000000007AA1000-memory.dmpFilesize
4KB
-
memory/2548-123-0x0000000007A50000-0x0000000007A9B000-memory.dmpFilesize
300KB
-
memory/2548-117-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/2548-118-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/2548-119-0x00000000052D0000-0x00000000057CE000-memory.dmpFilesize
5.0MB
-
memory/2548-120-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/2548-121-0x0000000005590000-0x0000000005595000-memory.dmpFilesize
20KB
-
memory/2548-115-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB
-
memory/3020-124-0x0000000000000000-mapping.dmp
-
memory/3028-133-0x0000000006620000-0x0000000006767000-memory.dmpFilesize
1.3MB
-
memory/3028-130-0x00000000064C0000-0x0000000006612000-memory.dmpFilesize
1.3MB
-
memory/3028-140-0x0000000002BB0000-0x0000000002C92000-memory.dmpFilesize
904KB
-
memory/3080-132-0x0000000002DE0000-0x0000000002DF1000-memory.dmpFilesize
68KB
-
memory/3080-131-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3080-128-0x0000000000FB0000-0x00000000012D0000-memory.dmpFilesize
3.1MB
-
memory/3080-129-0x0000000001480000-0x0000000001491000-memory.dmpFilesize
68KB
-
memory/3080-126-0x000000000041D4C0-mapping.dmp
-
memory/3080-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB