Analysis
- max time kernel
143s - max time network
146s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
18/11/2021, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
c39a71d53744e830f775ee130f8828db.exe
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
General
- Target c39a71d53744e830f775ee130f8828db.exe
- Size 332KB
- Sample211118-ydkgesadc4
- SHA256 189a9bb6ec5acaa4d8f7d889fcfe1bf393a4d10d55d0f297b77907f877c72791
- MD5 c39a71d53744e830f775ee130f8828db
- SHA1 fe25db33279694973af77722ff80c4da4da557b9
- SHA512 15db2b85801083ecb7f50dd935d58347465fb40ebcf3a8567e42fbd00ee9e7f62c91d393e684d7647e1ceecd6daa842d79084c4b4cec370fd000e698eb83fbdf
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
ga6b
C2
-
http://www.egyptian-museum.com/ga6b/
Decoy
-
diasporacospices.com
-
sd-shenghe.com
-
onlinewritingjobs.net
-
greenstreamgroup.store
-
garageair.agency
-
idh-bf.com
-
middenhavendambreskens.com
-
szkoleniawcag.online
-
wiremefeelings.com
-
ottosperformance.com
-
brothermush.com
-
weiserpath.com
-
baohiemtv24h.com
-
glassgalaxynft.com
-
spiritualmind.space
-
18130072012.com
-
3v0.space
-
smartgadgetscompare.com
-
corvusexpeditii.xyz
-
egcontabilidade.website
-
find0utnowfy.info
-
soulwinningministry.com
-
digitaldreamcloud.net
-
service-portal-kundendaten.com
-
theselectdifference.com
-
burodev.com
-
mustafacesuryildiz.com
-
grupodeinvestigacion.com
-
toyotadisurabaya.com
-
partnerbenifits.com
-
belledescontos.com
-
nobodybutgod.com
-
bumiths.com
-
acacave.com
-
septoctets.xyz
-
www73w.xyz
-
afghantattoos.com
-
interiorsbe.com
-
ara7z.com
-
qqcx666888.top
-
onra.top
-
sunfucker.net
-
suhuabo.com
-
tangerineinit.com
-
era636.com
-
lovenft.xyz
-
maviesurdvd.com
-
gullatz-consulting.com
-
duopasteleras.com
-
mystudentregistration.com
-
5559913.win
-
gritzcharlestonluxuryinn.store
-
themexicanbg.com
-
senshop.store
-
woodentoysforkids.store
-
globalgamelan.com
-
anjumanmuhibaneabbas.com
-
seattleinsurancebrokers.com
-
naiduteja049.info
-
traction.legal
-
twisteid.com
-
necesryaou.com
-
apan-group.com
-
infinityrope.store
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" c39a71d53744e830f775ee130f8828db.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/828-122-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/828-123-0x000000000041D4E0-mapping.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 1576 c39a71d53744e830f775ee130f8828db.exe 828 c39a71d53744e830f775ee130f8828db.exe - Loads dropped DLL 1 IoCs
pid Process 1576 c39a71d53744e830f775ee130f8828db.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1576 set thread context of 828 1576 c39a71d53744e830f775ee130f8828db.exe 69 - Drops file in Program Files directory 53 IoCs
description ioc Process File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\INTERN~1\ExtExport.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\WI54FB~1\setup_wm.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Google\Update\DISABL~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmprph.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmlaunch.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmplayer.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpconfig.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\WINDOW~2\wab.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\WINDOW~2\WinMail.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe c39a71d53744e830f775ee130f8828db.exe File opened for modification C:\PROGRA~2\WI54FB~1\wmpshare.exe c39a71d53744e830f775ee130f8828db.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com c39a71d53744e830f775ee130f8828db.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- NSIS installer 6 IoCs
resource yara_rule behavioral2/files/0x000500000001ab8c-119.dat nsis_installer_1 behavioral2/files/0x000500000001ab8c-119.dat nsis_installer_2 behavioral2/files/0x000500000001ab8c-120.dat nsis_installer_1 behavioral2/files/0x000500000001ab8c-120.dat nsis_installer_2 behavioral2/files/0x000500000001ab8c-124.dat nsis_installer_1 behavioral2/files/0x000500000001ab8c-124.dat nsis_installer_2 - Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" c39a71d53744e830f775ee130f8828db.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 828 c39a71d53744e830f775ee130f8828db.exe 828 c39a71d53744e830f775ee130f8828db.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3996 wrote to memory of 1576 3996 c39a71d53744e830f775ee130f8828db.exe 68 PID 3996 wrote to memory of 1576 3996 c39a71d53744e830f775ee130f8828db.exe 68 PID 3996 wrote to memory of 1576 3996 c39a71d53744e830f775ee130f8828db.exe 68 PID 1576 wrote to memory of 828 1576 c39a71d53744e830f775ee130f8828db.exe 69 PID 1576 wrote to memory of 828 1576 c39a71d53744e830f775ee130f8828db.exe 69 PID 1576 wrote to memory of 828 1576 c39a71d53744e830f775ee130f8828db.exe 69 PID 1576 wrote to memory of 828 1576 c39a71d53744e830f775ee130f8828db.exe 69 PID 1576 wrote to memory of 828 1576 c39a71d53744e830f775ee130f8828db.exe 69 PID 1576 wrote to memory of 828 1576 c39a71d53744e830f775ee130f8828db.exe 69
Processes
-
C:\Users\Admin\AppData\Local\Temp\c39a71d53744e830f775ee130f8828db.exe"C:\Users\Admin\AppData\Local\Temp\c39a71d53744e830f775ee130f8828db.exe"1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\3582-490\c39a71d53744e830f775ee130f8828db.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\c39a71d53744e830f775ee130f8828db.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\3582-490\c39a71d53744e830f775ee130f8828db.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\c39a71d53744e830f775ee130f8828db.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:828
-
-