Analysis
-
max time kernel
137s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
28-10-2021 17:16
Static task
static1
Behavioral task
behavioral1
Sample
PI_.exe
Resource
win7-en-20211014
General
-
Target
PI_.exe
-
Size
296KB
-
MD5
3838c43e12f0c22ecf9a9a0c1deb1d30
-
SHA1
7b9d8e4a093672411f71f1cf6a7fe6803c61773c
-
SHA256
b980dfcce93e9140d8ce71151f2f385026b8cebc195b71055707e1468ad0131b
-
SHA512
f0f860a56500b449b29558dc6e8860ce4441cee2612cc22c7cb9aaf5106062e290e3b3313dd0eef55fe1678791992f0502dbda9d0350110b7f7591853445935c
Malware Config
Extracted
xloader
2.5
unzn
http://www.davanamays.com/unzn/
xiulf.com
highcountrymortar.com
523561.com
marketingagency.tools
ganmovie.net
nationaalcontactpunt.com
sirrbter.com
begizas.xyz
missimi-fashion.com
munixc.info
daas.support
spaceworbc.com
faithtruthresolve.com
gymkub.com
thegrayverse.xyz
artisanmakefurniture.com
029tryy.com
ijuubx.biz
iphone13promax.club
techuniversus.com
samrgov.xyz
grownupcurl.com
sj0755.net
beekeeperkit.com
richessesabondantes.com
xclgjgjh.net
webworkscork.com
vedepviet365.com
bretabeameven.com
cdzsmhw.com
clearperspective.biz
tigrg5g784sh.biz
bbezan011.xyz
mycar.store
mansooralobeidli.com
ascensionmemberszoom.com
unlimitedrehab.com
wozka.top
askylarkgoods.com
rj793.com
prosvalor.com
primetimeexpress.com
boixosnoisperu.com
mmasportgear.com
concertiranian.net
hyponymys.info
maila.one
yti0fyic.xyz
shashiprayag.com
speedprosmotorsports.com
westchestercountyjunkcars.com
patienceinmypocket.com
rausachbaoloc.com
plexregroup.com
outsydercs.com
foodandflour.com
lenacrypto.xyz
homeservicetoday.net
marthaperry.com
vmtcyd4q8.com
shamefulguys.com
loccssol.store
gnarledportra.xyz
042atk.xyz
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/788-57-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/788-58-0x000000000041D430-mapping.dmp xloader behavioral1/memory/788-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
PI_.exepid process 1656 PI_.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PI_.exePI_.exedescription pid process target process PID 1656 set thread context of 788 1656 PI_.exe PI_.exe PID 788 set thread context of 1304 788 PI_.exe Explorer.EXE PID 788 set thread context of 1304 788 PI_.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
PI_.exepid process 788 PI_.exe 788 PI_.exe 788 PI_.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1304 Explorer.EXE -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
PI_.exepid process 788 PI_.exe 788 PI_.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PI_.exedescription pid process Token: SeDebugPrivilege 788 PI_.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
PI_.exedescription pid process target process PID 1656 wrote to memory of 788 1656 PI_.exe PI_.exe PID 1656 wrote to memory of 788 1656 PI_.exe PI_.exe PID 1656 wrote to memory of 788 1656 PI_.exe PI_.exe PID 1656 wrote to memory of 788 1656 PI_.exe PI_.exe PID 1656 wrote to memory of 788 1656 PI_.exe PI_.exe PID 1656 wrote to memory of 788 1656 PI_.exe PI_.exe PID 1656 wrote to memory of 788 1656 PI_.exe PI_.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\PI_.exe"C:\Users\Admin\AppData\Local\Temp\PI_.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI_.exe"C:\Users\Admin\AppData\Local\Temp\PI_.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsyC073.tmp\qdubg.dllMD5
55a776d0472c31ed04059c11c38d7953
SHA1ffaf336496a3f5333eb50347d22f58aa167f6dfe
SHA25619ee07473845faf92de1dc004133078ed730a9ca95a577a0300e9b3a4384a448
SHA5122e221116a744682de53ca10eb9aed09d703ffd19e8140936be98900293eb74fcbb295bc32817b712a7c1ad6d3ea946374b96e0ad758b7c88dbfa15e25a5eb071
-
memory/788-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/788-58-0x000000000041D430-mapping.dmp
-
memory/788-61-0x0000000000340000-0x0000000000351000-memory.dmpFilesize
68KB
-
memory/788-60-0x00000000008E0000-0x0000000000BE3000-memory.dmpFilesize
3.0MB
-
memory/788-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/788-64-0x0000000000390000-0x00000000003A1000-memory.dmpFilesize
68KB
-
memory/1304-62-0x00000000062F0000-0x00000000063E2000-memory.dmpFilesize
968KB
-
memory/1304-65-0x0000000007570000-0x0000000007711000-memory.dmpFilesize
1.6MB
-
memory/1656-55-0x0000000075B71000-0x0000000075B73000-memory.dmpFilesize
8KB