Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
04-11-2021 13:13
Static task
static1
Behavioral task
behavioral1
Sample
ZT2468.exe
Resource
win7-en-20210920
General
-
Target
ZT2468.exe
-
Size
288KB
-
MD5
fab8e59e983d01fc0693c15309576f7a
-
SHA1
7237e7d63f241d7785e638edf05a71064574659c
-
SHA256
272447b597810afe392f24b2fbcab08cd76224f54251e009742ed350595fe54d
-
SHA512
0eb51bc407abb70cabe32081b9e073505a761048e399a69a7857775974454b29d7fe46f46b12296f58e33e0feca5488adf399979b7ff9ead9e1e3ea24cd75120
Malware Config
Extracted
xloader
2.5
u5eh
http://www.retonamoss.com/u5eh/
tryafaq.com
bobcathntshop.com
oglead.com
026skz.xyz
brasbux.com
adna17.com
noveltyrofjiy.xyz
realestatecompanys.com
leman-web.com
df5686.com
jonathonhawkins.com
juliedominyfloralartistry.com
classyeventsco.com
aquaticatt.com
iotworld.xyz
hoc8.com
disposablediapers.store
peregovorim.online
advancebits.club
getaburialplan.com
tiger-trails.com
dnbaba.com
492981.com
eclipse-electrical-euless.com
cassandracchase.com
healthrightmeds.club
permkray.club
tawazoun-dz.com
extrabladet.com
offmanage.com
peoplexplants.com
mumkungiyim.com
personal-email-office-mgt.com
bjmysa.com
hopshomes.com
cnj-power.com
trendproduct.tech
chauffeuredaustralia.online
176ssjp0033.xyz
52juns.com
rewriringcanada.com
seabourneboats.com
sevensummittrek.com
retalent.agency
lz4ios.cloud
mindandbodyalignment.com
bedrijfmail-trk.com
bashmoney.net
xc3654.com
infiteltech.com
sh-hywz.com
huataiqche.com
grannyh.com
devinwithani.com
kingstons.info
fakedocshyundaigiveaway.com
bigsyncmusic.info
predstavnuk.com
frontiervalley8.com
timdpr.com
smartgymadmin.com
brsgeniusschool.com
tuckertractorworks.com
espchange.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/876-56-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/876-57-0x000000000041D3E0-mapping.dmp xloader behavioral1/memory/876-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1404-68-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 304 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
ZT2468.exepid process 1168 ZT2468.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ZT2468.exeZT2468.execontrol.exedescription pid process target process PID 1168 set thread context of 876 1168 ZT2468.exe ZT2468.exe PID 876 set thread context of 1364 876 ZT2468.exe Explorer.EXE PID 876 set thread context of 1364 876 ZT2468.exe Explorer.EXE PID 1404 set thread context of 1364 1404 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
ZT2468.execontrol.exepid process 876 ZT2468.exe 876 ZT2468.exe 876 ZT2468.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe 1404 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ZT2468.execontrol.exepid process 876 ZT2468.exe 876 ZT2468.exe 876 ZT2468.exe 876 ZT2468.exe 1404 control.exe 1404 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ZT2468.execontrol.exedescription pid process Token: SeDebugPrivilege 876 ZT2468.exe Token: SeDebugPrivilege 1404 control.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE 1364 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1364 Explorer.EXE 1364 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ZT2468.exeZT2468.execontrol.exedescription pid process target process PID 1168 wrote to memory of 876 1168 ZT2468.exe ZT2468.exe PID 1168 wrote to memory of 876 1168 ZT2468.exe ZT2468.exe PID 1168 wrote to memory of 876 1168 ZT2468.exe ZT2468.exe PID 1168 wrote to memory of 876 1168 ZT2468.exe ZT2468.exe PID 1168 wrote to memory of 876 1168 ZT2468.exe ZT2468.exe PID 1168 wrote to memory of 876 1168 ZT2468.exe ZT2468.exe PID 1168 wrote to memory of 876 1168 ZT2468.exe ZT2468.exe PID 876 wrote to memory of 1404 876 ZT2468.exe control.exe PID 876 wrote to memory of 1404 876 ZT2468.exe control.exe PID 876 wrote to memory of 1404 876 ZT2468.exe control.exe PID 876 wrote to memory of 1404 876 ZT2468.exe control.exe PID 1404 wrote to memory of 304 1404 control.exe cmd.exe PID 1404 wrote to memory of 304 1404 control.exe cmd.exe PID 1404 wrote to memory of 304 1404 control.exe cmd.exe PID 1404 wrote to memory of 304 1404 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\ZT2468.exe"C:\Users\Admin\AppData\Local\Temp\ZT2468.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ZT2468.exe"C:\Users\Admin\AppData\Local\Temp\ZT2468.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ZT2468.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsyD921.tmp\jarjiypg.dllMD5
6f34375ab63f8e726809b4ba0fbac265
SHA14ae027f2810893240dddbb08d50e81565d578035
SHA25607001303d1031888767e46c324fb943967b1e3298f65f5a1c5053a344f2467aa
SHA5120995a19e2582657dfb1e56ce53b280d3a817a154a6057a99b6b3329fa18203db3d5b8b97f76d5ab65822368d36c08d9c243183cd37c62648245d82e60f416791
-
memory/304-70-0x0000000000000000-mapping.dmp
-
memory/876-63-0x0000000000690000-0x00000000006A1000-memory.dmpFilesize
68KB
-
memory/876-57-0x000000000041D3E0-mapping.dmp
-
memory/876-60-0x00000000002D0000-0x00000000002E1000-memory.dmpFilesize
68KB
-
memory/876-59-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/876-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/876-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1168-54-0x0000000076B61000-0x0000000076B63000-memory.dmpFilesize
8KB
-
memory/1364-64-0x0000000006440000-0x000000000658F000-memory.dmpFilesize
1.3MB
-
memory/1364-61-0x0000000003FB0000-0x0000000004067000-memory.dmpFilesize
732KB
-
memory/1364-72-0x0000000008B40000-0x0000000008C73000-memory.dmpFilesize
1.2MB
-
memory/1404-65-0x0000000000000000-mapping.dmp
-
memory/1404-68-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1404-67-0x0000000000C00000-0x0000000000C1F000-memory.dmpFilesize
124KB
-
memory/1404-69-0x0000000002020000-0x0000000002323000-memory.dmpFilesize
3.0MB
-
memory/1404-71-0x0000000000490000-0x0000000000520000-memory.dmpFilesize
576KB