Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 13:44
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION.exe
Resource
win7-en-20210920
General
-
Target
QUOTATION.exe
-
Size
253KB
-
MD5
cadf879ded4e6a753d7b172b77bce50d
-
SHA1
ab4f8431c170d75040d8b2984f5e7eadeeeedab9
-
SHA256
18e91cbaa2d04fa969e97e947ccd011d494f68eb6375b067f0342a7765fb3119
-
SHA512
c685444886b555978228cd2fb47b0725b25443b8fcd19be70f804a5bf433ebc9a35291ea33edf6fcc9030fcd26a89009a3b223c39432a001842494b20bf5f5d7
Malware Config
Extracted
xloader
2.5
d6pu
http://www.bonitaspringshomesearch.com/d6pu/
ifixcreditatl.com
productgeekout.com
electricvehicle-insurance.com
kuiper.business
cloudenglabs.com
gorbepari.com
collecthappy.com
amykrussell.store
clubhousebusinesscourse.com
aplussinifiklima.com
slewis.design
atticwitt.com
galenota.com
griphook.xyz
gsjbd1.club
bootystrapfitness.com
emflawrhks.com
alternativedata.investments
eyehealthtnpasumo3.xyz
naturanzaec.com
vinotrentino.info
thisevent.com
joaopedroeviviane.com
fructuosopascualehijos.net
nftokenartwork.com
gymzara.com
erwan-gueldy-transexual.net
enjoyjourneys.com
sanguinejewellery.com
xxxafricain.com
besrbee.com
kefirusa.com
dualdrivesystem.com
brixbol.com
cor-pt.com
myrhannover.com
entospt.com
slabiesplin.quest
rebuildablecarsonline.com
gangom.com
msulthony.tech
thesmithyvan.com
dharma33.com
rjm226.com
yourbestproduct.com
hyderabadmotorclub.com
karlitomarx.com
sunflowerediting.com
seangreenphotography.com
vikramsparmar.com
roguelakegames.com
globaltechmeet.com
wmr.agency
buksi.biz
ratnagirikosh.com
charleskinzel.com
dunavulkan.quest
diffamr.net
ceveye.com
ss0235.com
7u2mjf.com
getavan.net
thinkcentury.net
diasporahealthfoundation.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1636-56-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1636-57-0x000000000041D4E0-mapping.dmp xloader behavioral1/memory/1836-64-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader behavioral1/memory/1168-77-0x000000000041D4E0-mapping.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
vgazvqlxvc0.exevgazvqlxvc0.exepid process 1652 vgazvqlxvc0.exe 1168 vgazvqlxvc0.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 632 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
QUOTATION.exevgazvqlxvc0.exepid process 1132 QUOTATION.exe 1652 vgazvqlxvc0.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wuapp.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wuapp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OBG4Z = "C:\\Program Files (x86)\\Tqjvh\\vgazvqlxvc0.exe" wuapp.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
QUOTATION.exeQUOTATION.exewuapp.exevgazvqlxvc0.exedescription pid process target process PID 1132 set thread context of 1636 1132 QUOTATION.exe QUOTATION.exe PID 1636 set thread context of 1360 1636 QUOTATION.exe Explorer.EXE PID 1836 set thread context of 1360 1836 wuapp.exe Explorer.EXE PID 1652 set thread context of 1168 1652 vgazvqlxvc0.exe vgazvqlxvc0.exe -
Drops file in Program Files directory 2 IoCs
Processes:
wuapp.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe wuapp.exe File created C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe nsis_installer_1 C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe nsis_installer_2 C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe nsis_installer_1 C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe nsis_installer_2 C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe nsis_installer_1 C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe nsis_installer_2 -
Processes:
wuapp.exedescription ioc process Key created \Registry\User\S-1-5-21-3456797065-1076791440-4146276586-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wuapp.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
QUOTATION.exewuapp.exevgazvqlxvc0.exepid process 1636 QUOTATION.exe 1636 QUOTATION.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1168 vgazvqlxvc0.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
QUOTATION.exewuapp.exepid process 1636 QUOTATION.exe 1636 QUOTATION.exe 1636 QUOTATION.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe 1836 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
QUOTATION.exewuapp.exevgazvqlxvc0.exedescription pid process Token: SeDebugPrivilege 1636 QUOTATION.exe Token: SeDebugPrivilege 1836 wuapp.exe Token: SeDebugPrivilege 1168 vgazvqlxvc0.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
QUOTATION.exeExplorer.EXEwuapp.exevgazvqlxvc0.exedescription pid process target process PID 1132 wrote to memory of 1636 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1636 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1636 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1636 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1636 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1636 1132 QUOTATION.exe QUOTATION.exe PID 1132 wrote to memory of 1636 1132 QUOTATION.exe QUOTATION.exe PID 1360 wrote to memory of 1836 1360 Explorer.EXE wuapp.exe PID 1360 wrote to memory of 1836 1360 Explorer.EXE wuapp.exe PID 1360 wrote to memory of 1836 1360 Explorer.EXE wuapp.exe PID 1360 wrote to memory of 1836 1360 Explorer.EXE wuapp.exe PID 1360 wrote to memory of 1836 1360 Explorer.EXE wuapp.exe PID 1360 wrote to memory of 1836 1360 Explorer.EXE wuapp.exe PID 1360 wrote to memory of 1836 1360 Explorer.EXE wuapp.exe PID 1836 wrote to memory of 632 1836 wuapp.exe cmd.exe PID 1836 wrote to memory of 632 1836 wuapp.exe cmd.exe PID 1836 wrote to memory of 632 1836 wuapp.exe cmd.exe PID 1836 wrote to memory of 632 1836 wuapp.exe cmd.exe PID 1360 wrote to memory of 1652 1360 Explorer.EXE vgazvqlxvc0.exe PID 1360 wrote to memory of 1652 1360 Explorer.EXE vgazvqlxvc0.exe PID 1360 wrote to memory of 1652 1360 Explorer.EXE vgazvqlxvc0.exe PID 1360 wrote to memory of 1652 1360 Explorer.EXE vgazvqlxvc0.exe PID 1836 wrote to memory of 1684 1836 wuapp.exe Firefox.exe PID 1836 wrote to memory of 1684 1836 wuapp.exe Firefox.exe PID 1836 wrote to memory of 1684 1836 wuapp.exe Firefox.exe PID 1836 wrote to memory of 1684 1836 wuapp.exe Firefox.exe PID 1652 wrote to memory of 1168 1652 vgazvqlxvc0.exe vgazvqlxvc0.exe PID 1652 wrote to memory of 1168 1652 vgazvqlxvc0.exe vgazvqlxvc0.exe PID 1652 wrote to memory of 1168 1652 vgazvqlxvc0.exe vgazvqlxvc0.exe PID 1652 wrote to memory of 1168 1652 vgazvqlxvc0.exe vgazvqlxvc0.exe PID 1652 wrote to memory of 1168 1652 vgazvqlxvc0.exe vgazvqlxvc0.exe PID 1652 wrote to memory of 1168 1652 vgazvqlxvc0.exe vgazvqlxvc0.exe PID 1652 wrote to memory of 1168 1652 vgazvqlxvc0.exe vgazvqlxvc0.exe PID 1836 wrote to memory of 1684 1836 wuapp.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe"C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe"C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exeMD5
cadf879ded4e6a753d7b172b77bce50d
SHA1ab4f8431c170d75040d8b2984f5e7eadeeeedab9
SHA25618e91cbaa2d04fa969e97e947ccd011d494f68eb6375b067f0342a7765fb3119
SHA512c685444886b555978228cd2fb47b0725b25443b8fcd19be70f804a5bf433ebc9a35291ea33edf6fcc9030fcd26a89009a3b223c39432a001842494b20bf5f5d7
-
C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exeMD5
cadf879ded4e6a753d7b172b77bce50d
SHA1ab4f8431c170d75040d8b2984f5e7eadeeeedab9
SHA25618e91cbaa2d04fa969e97e947ccd011d494f68eb6375b067f0342a7765fb3119
SHA512c685444886b555978228cd2fb47b0725b25443b8fcd19be70f804a5bf433ebc9a35291ea33edf6fcc9030fcd26a89009a3b223c39432a001842494b20bf5f5d7
-
C:\Program Files (x86)\Tqjvh\vgazvqlxvc0.exeMD5
cadf879ded4e6a753d7b172b77bce50d
SHA1ab4f8431c170d75040d8b2984f5e7eadeeeedab9
SHA25618e91cbaa2d04fa969e97e947ccd011d494f68eb6375b067f0342a7765fb3119
SHA512c685444886b555978228cd2fb47b0725b25443b8fcd19be70f804a5bf433ebc9a35291ea33edf6fcc9030fcd26a89009a3b223c39432a001842494b20bf5f5d7
-
C:\Users\Admin\AppData\Local\Temp\phz51u0bs5r87MD5
95bdcc6a7d42149f66a87e7270e65935
SHA11fd0f5f3c689cd3d9243991b54c2d32ebb3fa0c3
SHA2560238bf372c00fa7351fc3ee201126ca50d3ee7422243ded052dd9b2faa0d46b5
SHA5128abcaa06f6e6410ecb716e675ce5b8a09e24f30561cb4d4a40cc056d6bdc5de3eb61f5f64a9cefaa20f22045bf40ae11f13625b6c82d99e4389066c36f0734dc
-
\Users\Admin\AppData\Local\Temp\nsiB433.tmp\zntsolrgxs.dllMD5
fe76b0ef249aebd98f82d6437721c047
SHA1b1d40595e05da9c6f8627885b36177d4ecd54f21
SHA25639724fa50de7a8937dec84a3f00fe23c9dea895d312bdce8133db18f15ee1a81
SHA512abff3bc26f23c3c864bca8bb4ef1191278bb88bf5d604db949a822fc98525bcecdc21acceffbca1aae5557c8a13e9e15092837bc1c16b3ec2d03c6b3fc8fd725
-
\Users\Admin\AppData\Local\Temp\nstB53C.tmp\zntsolrgxs.dllMD5
fe76b0ef249aebd98f82d6437721c047
SHA1b1d40595e05da9c6f8627885b36177d4ecd54f21
SHA25639724fa50de7a8937dec84a3f00fe23c9dea895d312bdce8133db18f15ee1a81
SHA512abff3bc26f23c3c864bca8bb4ef1191278bb88bf5d604db949a822fc98525bcecdc21acceffbca1aae5557c8a13e9e15092837bc1c16b3ec2d03c6b3fc8fd725
-
memory/632-66-0x0000000000000000-mapping.dmp
-
memory/1132-54-0x0000000074B41000-0x0000000074B43000-memory.dmpFilesize
8KB
-
memory/1168-79-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/1168-77-0x000000000041D4E0-mapping.dmp
-
memory/1360-60-0x0000000007140000-0x00000000072B9000-memory.dmpFilesize
1.5MB
-
memory/1360-68-0x0000000004DC0000-0x0000000004E7C000-memory.dmpFilesize
752KB
-
memory/1636-61-0x00000000003E0000-0x00000000003F1000-memory.dmpFilesize
68KB
-
memory/1636-59-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1636-57-0x000000000041D4E0-mapping.dmp
-
memory/1636-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1652-70-0x0000000000000000-mapping.dmp
-
memory/1836-65-0x0000000002010000-0x0000000002313000-memory.dmpFilesize
3.0MB
-
memory/1836-67-0x00000000008D0000-0x0000000000960000-memory.dmpFilesize
576KB
-
memory/1836-64-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1836-63-0x0000000000C00000-0x0000000000C0B000-memory.dmpFilesize
44KB
-
memory/1836-62-0x0000000000000000-mapping.dmp