Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-10-2021 17:16
Static task
static1
Behavioral task
behavioral1
Sample
PI_.exe
Resource
win7-en-20211014
General
-
Target
PI_.exe
-
Size
296KB
-
MD5
3838c43e12f0c22ecf9a9a0c1deb1d30
-
SHA1
7b9d8e4a093672411f71f1cf6a7fe6803c61773c
-
SHA256
b980dfcce93e9140d8ce71151f2f385026b8cebc195b71055707e1468ad0131b
-
SHA512
f0f860a56500b449b29558dc6e8860ce4441cee2612cc22c7cb9aaf5106062e290e3b3313dd0eef55fe1678791992f0502dbda9d0350110b7f7591853445935c
Malware Config
Extracted
xloader
2.5
unzn
http://www.davanamays.com/unzn/
xiulf.com
highcountrymortar.com
523561.com
marketingagency.tools
ganmovie.net
nationaalcontactpunt.com
sirrbter.com
begizas.xyz
missimi-fashion.com
munixc.info
daas.support
spaceworbc.com
faithtruthresolve.com
gymkub.com
thegrayverse.xyz
artisanmakefurniture.com
029tryy.com
ijuubx.biz
iphone13promax.club
techuniversus.com
samrgov.xyz
grownupcurl.com
sj0755.net
beekeeperkit.com
richessesabondantes.com
xclgjgjh.net
webworkscork.com
vedepviet365.com
bretabeameven.com
cdzsmhw.com
clearperspective.biz
tigrg5g784sh.biz
bbezan011.xyz
mycar.store
mansooralobeidli.com
ascensionmemberszoom.com
unlimitedrehab.com
wozka.top
askylarkgoods.com
rj793.com
prosvalor.com
primetimeexpress.com
boixosnoisperu.com
mmasportgear.com
concertiranian.net
hyponymys.info
maila.one
yti0fyic.xyz
shashiprayag.com
speedprosmotorsports.com
westchestercountyjunkcars.com
patienceinmypocket.com
rausachbaoloc.com
plexregroup.com
outsydercs.com
foodandflour.com
lenacrypto.xyz
homeservicetoday.net
marthaperry.com
vmtcyd4q8.com
shamefulguys.com
loccssol.store
gnarledportra.xyz
042atk.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2256-116-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2256-117-0x000000000041D430-mapping.dmp xloader behavioral2/memory/2256-122-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1344-128-0x0000000001200000-0x0000000001229000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
PI_.exepid process 3288 PI_.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
PI_.exePI_.exesystray.exedescription pid process target process PID 3288 set thread context of 2256 3288 PI_.exe PI_.exe PID 2256 set thread context of 3036 2256 PI_.exe Explorer.EXE PID 2256 set thread context of 3036 2256 PI_.exe Explorer.EXE PID 1344 set thread context of 3036 1344 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
PI_.exesystray.exepid process 2256 PI_.exe 2256 PI_.exe 2256 PI_.exe 2256 PI_.exe 2256 PI_.exe 2256 PI_.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe 1344 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
PI_.exesystray.exepid process 2256 PI_.exe 2256 PI_.exe 2256 PI_.exe 2256 PI_.exe 1344 systray.exe 1344 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PI_.exesystray.exedescription pid process Token: SeDebugPrivilege 2256 PI_.exe Token: SeDebugPrivilege 1344 systray.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PI_.exeExplorer.EXEsystray.exedescription pid process target process PID 3288 wrote to memory of 2256 3288 PI_.exe PI_.exe PID 3288 wrote to memory of 2256 3288 PI_.exe PI_.exe PID 3288 wrote to memory of 2256 3288 PI_.exe PI_.exe PID 3288 wrote to memory of 2256 3288 PI_.exe PI_.exe PID 3288 wrote to memory of 2256 3288 PI_.exe PI_.exe PID 3288 wrote to memory of 2256 3288 PI_.exe PI_.exe PID 3036 wrote to memory of 1344 3036 Explorer.EXE systray.exe PID 3036 wrote to memory of 1344 3036 Explorer.EXE systray.exe PID 3036 wrote to memory of 1344 3036 Explorer.EXE systray.exe PID 1344 wrote to memory of 2988 1344 systray.exe cmd.exe PID 1344 wrote to memory of 2988 1344 systray.exe cmd.exe PID 1344 wrote to memory of 2988 1344 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI_.exe"C:\Users\Admin\AppData\Local\Temp\PI_.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI_.exe"C:\Users\Admin\AppData\Local\Temp\PI_.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PI_.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsyD851.tmp\qdubg.dllMD5
55a776d0472c31ed04059c11c38d7953
SHA1ffaf336496a3f5333eb50347d22f58aa167f6dfe
SHA25619ee07473845faf92de1dc004133078ed730a9ca95a577a0300e9b3a4384a448
SHA5122e221116a744682de53ca10eb9aed09d703ffd19e8140936be98900293eb74fcbb295bc32817b712a7c1ad6d3ea946374b96e0ad758b7c88dbfa15e25a5eb071
-
memory/1344-125-0x0000000000000000-mapping.dmp
-
memory/1344-130-0x0000000004F20000-0x0000000004FB0000-memory.dmpFilesize
576KB
-
memory/1344-129-0x0000000005030000-0x0000000005350000-memory.dmpFilesize
3.1MB
-
memory/1344-127-0x00000000013D0000-0x00000000013D6000-memory.dmpFilesize
24KB
-
memory/1344-128-0x0000000001200000-0x0000000001229000-memory.dmpFilesize
164KB
-
memory/2256-120-0x00000000009F0000-0x0000000000A01000-memory.dmpFilesize
68KB
-
memory/2256-123-0x0000000000E40000-0x0000000000E51000-memory.dmpFilesize
68KB
-
memory/2256-122-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2256-119-0x0000000000A10000-0x0000000000D30000-memory.dmpFilesize
3.1MB
-
memory/2256-117-0x000000000041D430-mapping.dmp
-
memory/2256-116-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2988-126-0x0000000000000000-mapping.dmp
-
memory/3036-124-0x0000000005430000-0x000000000550F000-memory.dmpFilesize
892KB
-
memory/3036-121-0x0000000005340000-0x000000000542A000-memory.dmpFilesize
936KB
-
memory/3036-131-0x0000000005510000-0x0000000005675000-memory.dmpFilesize
1.4MB