Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10_x64 -
resource
win10-de-20211014 -
submitted
21-10-2021 12:23
Static task
static1
Behavioral task
behavioral1
Sample
REE20212110575259OCT.exe
Resource
win7-ja-20211014
Behavioral task
behavioral2
Sample
REE20212110575259OCT.exe
Resource
win7-en-20210920
Behavioral task
behavioral3
Sample
REE20212110575259OCT.exe
Resource
win7-de-20211014
Behavioral task
behavioral4
Sample
REE20212110575259OCT.exe
Resource
win11
Behavioral task
behavioral5
Sample
REE20212110575259OCT.exe
Resource
win10-ja-20211014
Behavioral task
behavioral6
Sample
REE20212110575259OCT.exe
Resource
win10-en-20210920
General
-
Target
REE20212110575259OCT.exe
-
Size
498KB
-
MD5
9c00fc940483cff2a0f3f619db16ad54
-
SHA1
6f9c746d9cfb4e0bbf829783a82b883f7317b16b
-
SHA256
8a54e41751369783c64f56f30133b985933092324e9b2dad025641d23643280c
-
SHA512
30451538f9ed65159280a168c711056d7bc0776d0c30f1c82bfa4dfacfe4373c01f503004f1eacc1a690104f99bf7e78c61c5436261c0813508467ff5dd4ff21
Malware Config
Extracted
xloader
2.5
gab8
http://www.purodetalle.com/gab8/
amateurfeetworship.com
big-food.biz
metaversevolution.com
profecional-pacasmayo.com
royzoom.com
bekindevolution.com
hokozaki.com
waltersswholesale.com
wayfinderacu.com
schnurrgallery.com
babygearrentals.net
imggtoken.club
24x7x366.com
lakiernictwo.info
les-cours.com
dwticket.com
onarollshades.com
ramireztradepartners.com
safarparfums.com
6ngie.info
hoedetamni.quest
europeangurl.com
sakhakot.com
franciscoalpizar.com
jsyysn.com
goldberg-lighting.com
symbebidas.online
aucoeurducadeau.com
diamondscaterers.com
surswain.quest
gequper.xyz
roytsb.com
332151.com
hienrenow.com
skullother.com
betnubhelp.com
donerightcleaningnation.info
noukou-tonkotsu.xyz
bulkysofthome.com
yuejiayouhua.com
sevillalimpieza.com
involvefinance.com
obz7mo9amu.com
niftyfashionreward.com
refunddngame.com
norllix.com
vergadercentrumdji.com
1006e.com
boraeresici.com
partnerbebefits.com
hejabbanifatemi.com
bigskypediatrics.com
thefortclub.com
blacksource.xyz
happyklikshop.com
fullamodatoptan.com
pinupcams.info
javnfts.com
duocvietpharmacy.com
babyfloki.tech
cequitycorp.com
frenziedflora.com
5cherries.com
slurcap.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral7/memory/1808-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral7/memory/1808-126-0x000000000041D3B0-mapping.dmp xloader behavioral7/memory/2260-145-0x00000000010F0000-0x0000000001119000-memory.dmp xloader -
Drops file in System32 directory 4 IoCs
Processes:
OfficeC2RClient.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-wal OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-shm OfficeC2RClient.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
REE20212110575259OCT.exeREE20212110575259OCT.exemsdt.exedescription pid process target process PID 1188 set thread context of 1808 1188 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1808 set thread context of 2540 1808 REE20212110575259OCT.exe Explorer.EXE PID 2260 set thread context of 2540 2260 msdt.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 21 IoCs
Processes:
OfficeC2RClient.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry\RulesLastAudienceReported\officec2rclient.exe = "Production" OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" OfficeC2RClient.exe -
Suspicious behavior: EnumeratesProcesses 45 IoCs
Processes:
REE20212110575259OCT.exepowershell.exemsdt.exepid process 1808 REE20212110575259OCT.exe 1808 REE20212110575259OCT.exe 1808 REE20212110575259OCT.exe 1808 REE20212110575259OCT.exe 1420 powershell.exe 1420 powershell.exe 2260 msdt.exe 2260 msdt.exe 1420 powershell.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe 2260 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2540 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
REE20212110575259OCT.exemsdt.exepid process 1808 REE20212110575259OCT.exe 1808 REE20212110575259OCT.exe 1808 REE20212110575259OCT.exe 2260 msdt.exe 2260 msdt.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
REE20212110575259OCT.exepowershell.exemsdt.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1808 REE20212110575259OCT.exe Token: SeDebugPrivilege 1420 powershell.exe Token: SeDebugPrivilege 2260 msdt.exe Token: SeShutdownPrivilege 2540 Explorer.EXE Token: SeCreatePagefilePrivilege 2540 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OfficeC2RClient.exepid process 2836 OfficeC2RClient.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
REE20212110575259OCT.exeExplorer.EXEmsdt.exedescription pid process target process PID 1188 wrote to memory of 1420 1188 REE20212110575259OCT.exe powershell.exe PID 1188 wrote to memory of 1420 1188 REE20212110575259OCT.exe powershell.exe PID 1188 wrote to memory of 1420 1188 REE20212110575259OCT.exe powershell.exe PID 1188 wrote to memory of 1808 1188 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1188 wrote to memory of 1808 1188 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1188 wrote to memory of 1808 1188 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1188 wrote to memory of 1808 1188 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1188 wrote to memory of 1808 1188 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 1188 wrote to memory of 1808 1188 REE20212110575259OCT.exe REE20212110575259OCT.exe PID 2540 wrote to memory of 2260 2540 Explorer.EXE msdt.exe PID 2540 wrote to memory of 2260 2540 Explorer.EXE msdt.exe PID 2540 wrote to memory of 2260 2540 Explorer.EXE msdt.exe PID 2260 wrote to memory of 1716 2260 msdt.exe cmd.exe PID 2260 wrote to memory of 1716 2260 msdt.exe cmd.exe PID 2260 wrote to memory of 1716 2260 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"3⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1188-115-0x0000000000E00000-0x0000000000E01000-memory.dmpFilesize
4KB
-
memory/1188-117-0x0000000005CA0000-0x0000000005CA1000-memory.dmpFilesize
4KB
-
memory/1188-118-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/1188-119-0x00000000057A0000-0x0000000005C9E000-memory.dmpFilesize
5.0MB
-
memory/1188-120-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/1188-121-0x0000000005980000-0x0000000005987000-memory.dmpFilesize
28KB
-
memory/1188-122-0x00000000065C0000-0x00000000065C1000-memory.dmpFilesize
4KB
-
memory/1188-123-0x0000000006570000-0x00000000065BB000-memory.dmpFilesize
300KB
-
memory/1420-139-0x0000000007E50000-0x0000000007E51000-memory.dmpFilesize
4KB
-
memory/1420-159-0x0000000009590000-0x00000000095C3000-memory.dmpFilesize
204KB
-
memory/1420-176-0x0000000009C00000-0x0000000009C01000-memory.dmpFilesize
4KB
-
memory/1420-128-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/1420-127-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/1420-130-0x0000000006E40000-0x0000000006E41000-memory.dmpFilesize
4KB
-
memory/1420-131-0x0000000007620000-0x0000000007621000-memory.dmpFilesize
4KB
-
memory/1420-133-0x0000000006FE0000-0x0000000006FE1000-memory.dmpFilesize
4KB
-
memory/1420-175-0x0000000006FE3000-0x0000000006FE4000-memory.dmpFilesize
4KB
-
memory/1420-174-0x0000000009B10000-0x0000000009B11000-memory.dmpFilesize
4KB
-
memory/1420-136-0x0000000006FE2000-0x0000000006FE3000-memory.dmpFilesize
4KB
-
memory/1420-173-0x000000007EDA0000-0x000000007EDA1000-memory.dmpFilesize
4KB
-
memory/1420-137-0x0000000007380000-0x0000000007381000-memory.dmpFilesize
4KB
-
memory/1420-138-0x0000000007520000-0x0000000007521000-memory.dmpFilesize
4KB
-
memory/1420-124-0x0000000000000000-mapping.dmp
-
memory/1420-140-0x0000000007EC0000-0x0000000007EC1000-memory.dmpFilesize
4KB
-
memory/1420-172-0x0000000009990000-0x0000000009991000-memory.dmpFilesize
4KB
-
memory/1420-142-0x0000000007F30000-0x0000000007F31000-memory.dmpFilesize
4KB
-
memory/1420-143-0x0000000007370000-0x0000000007371000-memory.dmpFilesize
4KB
-
memory/1420-167-0x0000000009570000-0x0000000009571000-memory.dmpFilesize
4KB
-
memory/1420-152-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/1420-146-0x0000000008390000-0x0000000008391000-memory.dmpFilesize
4KB
-
memory/1420-151-0x00000000087C0000-0x00000000087C1000-memory.dmpFilesize
4KB
-
memory/1420-150-0x0000000008980000-0x0000000008981000-memory.dmpFilesize
4KB
-
memory/1420-149-0x00000000082B0000-0x00000000082B1000-memory.dmpFilesize
4KB
-
memory/1716-147-0x0000000000000000-mapping.dmp
-
memory/1808-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1808-134-0x0000000001770000-0x0000000001781000-memory.dmpFilesize
68KB
-
memory/1808-132-0x0000000001970000-0x0000000001C90000-memory.dmpFilesize
3.1MB
-
memory/1808-126-0x000000000041D3B0-mapping.dmp
-
memory/2260-148-0x00000000053E0000-0x0000000005700000-memory.dmpFilesize
3.1MB
-
memory/2260-145-0x00000000010F0000-0x0000000001119000-memory.dmpFilesize
164KB
-
memory/2260-144-0x0000000001240000-0x00000000013B3000-memory.dmpFilesize
1.4MB
-
memory/2260-141-0x0000000000000000-mapping.dmp
-
memory/2260-245-0x00000000050A0000-0x0000000005130000-memory.dmpFilesize
576KB
-
memory/2540-135-0x0000000002520000-0x000000000260A000-memory.dmpFilesize
936KB
-
memory/2540-246-0x00000000026D0000-0x0000000002781000-memory.dmpFilesize
708KB