Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 11:12
Static task
static1
Behavioral task
behavioral1
Sample
REE20212110575259OCT.exe
Resource
win7-en-20210920
General
-
Target
REE20212110575259OCT.exe
-
Size
498KB
-
MD5
9c00fc940483cff2a0f3f619db16ad54
-
SHA1
6f9c746d9cfb4e0bbf829783a82b883f7317b16b
-
SHA256
8a54e41751369783c64f56f30133b985933092324e9b2dad025641d23643280c
-
SHA512
30451538f9ed65159280a168c711056d7bc0776d0c30f1c82bfa4dfacfe4373c01f503004f1eacc1a690104f99bf7e78c61c5436261c0813508467ff5dd4ff21
Malware Config
Extracted
xloader
2.5
gab8
http://www.purodetalle.com/gab8/
amateurfeetworship.com
big-food.biz
metaversevolution.com
profecional-pacasmayo.com
royzoom.com
bekindevolution.com
hokozaki.com
waltersswholesale.com
wayfinderacu.com
schnurrgallery.com
babygearrentals.net
imggtoken.club
24x7x366.com
lakiernictwo.info
les-cours.com
dwticket.com
onarollshades.com
ramireztradepartners.com
safarparfums.com
6ngie.info
hoedetamni.quest
europeangurl.com
sakhakot.com
franciscoalpizar.com
jsyysn.com
goldberg-lighting.com
symbebidas.online
aucoeurducadeau.com
diamondscaterers.com
surswain.quest
gequper.xyz
roytsb.com
332151.com
hienrenow.com
skullother.com
betnubhelp.com
donerightcleaningnation.info
noukou-tonkotsu.xyz
bulkysofthome.com
yuejiayouhua.com
sevillalimpieza.com
involvefinance.com
obz7mo9amu.com
niftyfashionreward.com
refunddngame.com
norllix.com
vergadercentrumdji.com
1006e.com
boraeresici.com
partnerbebefits.com
hejabbanifatemi.com
bigskypediatrics.com
thefortclub.com
blacksource.xyz
happyklikshop.com
fullamodatoptan.com
pinupcams.info
javnfts.com
duocvietpharmacy.com
babyfloki.tech
cequitycorp.com
frenziedflora.com
5cherries.com
slurcap.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1740-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1740-64-0x000000000041D3B0-mapping.dmp xloader behavioral1/memory/1740-73-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/956-80-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1456 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
REE20212110575259OCT.exeREE20212110575259OCT.exerundll32.exedescription pid process target process PID 1720 set thread context of 1740 1720 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1740 set thread context of 1400 1740 REE20212110575259OCT.exe Explorer.EXE PID 1740 set thread context of 1400 1740 REE20212110575259OCT.exe Explorer.EXE PID 956 set thread context of 1400 956 rundll32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
REE20212110575259OCT.exepowershell.exerundll32.exepid process 1740 REE20212110575259OCT.exe 568 powershell.exe 1740 REE20212110575259OCT.exe 1740 REE20212110575259OCT.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe 956 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
REE20212110575259OCT.exerundll32.exepid process 1740 REE20212110575259OCT.exe 1740 REE20212110575259OCT.exe 1740 REE20212110575259OCT.exe 1740 REE20212110575259OCT.exe 956 rundll32.exe 956 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
REE20212110575259OCT.exepowershell.exerundll32.exedescription pid process Token: SeDebugPrivilege 1740 REE20212110575259OCT.exe Token: SeDebugPrivilege 568 powershell.exe Token: SeDebugPrivilege 956 rundll32.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1400 Explorer.EXE 1400 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
REE20212110575259OCT.exeExplorer.EXErundll32.exedescription pid process target process PID 1720 wrote to memory of 568 1720 REE20212110575259OCT.exe powershell.exe PID 1720 wrote to memory of 568 1720 REE20212110575259OCT.exe powershell.exe PID 1720 wrote to memory of 568 1720 REE20212110575259OCT.exe powershell.exe PID 1720 wrote to memory of 568 1720 REE20212110575259OCT.exe powershell.exe PID 1720 wrote to memory of 1740 1720 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1720 wrote to memory of 1740 1720 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1720 wrote to memory of 1740 1720 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1720 wrote to memory of 1740 1720 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1720 wrote to memory of 1740 1720 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1720 wrote to memory of 1740 1720 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1720 wrote to memory of 1740 1720 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1400 wrote to memory of 956 1400 Explorer.EXE rundll32.exe PID 1400 wrote to memory of 956 1400 Explorer.EXE rundll32.exe PID 1400 wrote to memory of 956 1400 Explorer.EXE rundll32.exe PID 1400 wrote to memory of 956 1400 Explorer.EXE rundll32.exe PID 1400 wrote to memory of 956 1400 Explorer.EXE rundll32.exe PID 1400 wrote to memory of 956 1400 Explorer.EXE rundll32.exe PID 1400 wrote to memory of 956 1400 Explorer.EXE rundll32.exe PID 956 wrote to memory of 1456 956 rundll32.exe cmd.exe PID 956 wrote to memory of 1456 956 rundll32.exe cmd.exe PID 956 wrote to memory of 1456 956 rundll32.exe cmd.exe PID 956 wrote to memory of 1456 956 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/568-60-0x0000000000000000-mapping.dmp
-
memory/568-70-0x0000000002482000-0x0000000002484000-memory.dmpFilesize
8KB
-
memory/568-67-0x0000000002480000-0x0000000002481000-memory.dmpFilesize
4KB
-
memory/568-68-0x0000000002481000-0x0000000002482000-memory.dmpFilesize
4KB
-
memory/956-80-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/956-79-0x0000000000720000-0x000000000072E000-memory.dmpFilesize
56KB
-
memory/956-76-0x0000000000000000-mapping.dmp
-
memory/956-81-0x00000000021B0000-0x00000000024B3000-memory.dmpFilesize
3.0MB
-
memory/956-82-0x0000000001E50000-0x0000000001EE0000-memory.dmpFilesize
576KB
-
memory/1400-83-0x0000000008B10000-0x0000000008C0C000-memory.dmpFilesize
1008KB
-
memory/1400-75-0x0000000006A70000-0x0000000006BAD000-memory.dmpFilesize
1.2MB
-
memory/1400-72-0x0000000006950000-0x0000000006A65000-memory.dmpFilesize
1.1MB
-
memory/1456-78-0x0000000000000000-mapping.dmp
-
memory/1720-58-0x0000000004830000-0x0000000004831000-memory.dmpFilesize
4KB
-
memory/1720-57-0x00000000004F0000-0x00000000004F7000-memory.dmpFilesize
28KB
-
memory/1720-56-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1720-59-0x0000000004E10000-0x0000000004E5B000-memory.dmpFilesize
300KB
-
memory/1720-54-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1740-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1740-74-0x00000000003B0000-0x00000000003C1000-memory.dmpFilesize
68KB
-
memory/1740-73-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1740-71-0x0000000000270000-0x0000000000281000-memory.dmpFilesize
68KB
-
memory/1740-69-0x00000000009C0000-0x0000000000CC3000-memory.dmpFilesize
3.0MB
-
memory/1740-64-0x000000000041D3B0-mapping.dmp
-
memory/1740-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1740-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB