Analysis
- max time kernel
150s - max time network
147s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
22/11/2021, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
New Order 000112221.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
- Target New Order 000112221.exe
- Size 349KB
- Sample211122-ngklgsach8
- SHA256 eae07efa1c1d3cf15b86b7d83258a0ec3bad96ec1bbdf0791b0b984a835387e2
- MD5 b828ce355eb4606a72e32af06baf848e
- SHA1 ef4268dcd817bab6175858ac97614857692b78ed
- SHA512 bdc0e2451f4638ad93482d52b94b253c9033efc7027a6bbe945ea088045db5795a60464035d061d2e2f618808a7fe91ee70de72fa7ddae474fea45e9efe2ac15
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
ng6c
C2
-
http://www.lasnochesdeluces.com/ng6c/
Decoy
-
ayeghkarialmahdi.com
-
xpatfone.com
-
doctorsilkroad.com
-
ivegotthat.com
-
letsguthappy.com
-
xrxgqf.website
-
northlakelogisticspark.com
-
iseewhatyourmean.space
-
animalsmeme.net
-
webuywholesalerhouses.com
-
946abp.net
-
fitnsfreak.com
-
beautyloungeacademyllc.com
-
chuyistudio.com
-
koiclean.com
-
oneupcobra.net
-
cleversights.com
-
viniciusshop.com
-
roonkingagency.online
-
pentooloffice.com
-
dapaotang0.xyz
-
dress-ads.com
-
malgorzata-lac.com
-
shoppingvipshopping.space
-
mar.cruises
-
motivational-hub.com
-
4217193.win
-
collegedalerealtor.com
-
keylinktosolutions.com
-
longlivesela.com
-
xso94.top
-
lalocandaonline.com
-
thebootyteasisterhood.com
-
varzeshbanovans.com
-
resonators-and.com
-
geodigraph.coop
-
retrosvoiture.com
-
qiuma.net
-
caringhearts.asia
-
mgav99.xyz
-
daliborkokic.com
-
wtfong.com
-
caprockiic.com
-
pgonline555.online
-
baxin.net
-
ezo-magik.store
-
renewueye.com
-
deepideaconsulting.com
-
timmyben.com
-
pavitrafabtech.com
-
ohsodolc.com
-
lemesdev.com
-
senseyestore.com
-
multivisaorepresentacao.com
-
ferasan.com
-
wholenessdiagram.com
-
smelltraining.club
-
lifestylearch.com
-
harryrowlandart.com
-
bigceme3.com
-
rittmarshausen.net
-
day-mutual.com
-
inkedbreadco.com
-
craftycatmull.com
Signatures
- Xloader Payload 4 IoCs
resource yara_rule behavioral2/memory/2880-119-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2880-120-0x000000000041D4A0-mapping.dmp xloader behavioral2/memory/3912-127-0x0000000002EF0000-0x0000000002F19000-memory.dmp xloader behavioral2/memory/1256-140-0x000000000041D4A0-mapping.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 748 p0j8szxlr8t.exe 1256 p0j8szxlr8t.exe - Loads dropped DLL 2 IoCs
pid Process 3572 New Order 000112221.exe 748 p0j8szxlr8t.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5JQXV47XB4BH = "C:\\Program Files (x86)\\H0bc\\p0j8szxlr8t.exe" cmstp.exe Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cmstp.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 3572 set thread context of 2880 3572 New Order 000112221.exe 68 PID 2880 set thread context of 3016 2880 New Order 000112221.exe 21 PID 3912 set thread context of 3016 3912 cmstp.exe 21 PID 748 set thread context of 1256 748 p0j8szxlr8t.exe 79 - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\H0bc\p0j8szxlr8t.exe cmstp.exe File opened for modification C:\Program Files (x86)\H0bc Explorer.EXE File created C:\Program Files (x86)\H0bc\p0j8szxlr8t.exe Explorer.EXE File opened for modification C:\Program Files (x86)\H0bc\p0j8szxlr8t.exe Explorer.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- NSIS installer 6 IoCs
resource yara_rule behavioral2/files/0x000400000001abd0-135.dat nsis_installer_1 behavioral2/files/0x000400000001abd0-135.dat nsis_installer_2 behavioral2/files/0x000400000001abd0-136.dat nsis_installer_1 behavioral2/files/0x000400000001abd0-136.dat nsis_installer_2 behavioral2/files/0x000400000001abd0-141.dat nsis_installer_1 behavioral2/files/0x000400000001abd0-141.dat nsis_installer_2 -
description ioc Process Key created \Registry\User\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cmstp.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 2880 New Order 000112221.exe 2880 New Order 000112221.exe 2880 New Order 000112221.exe 2880 New Order 000112221.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 1256 p0j8szxlr8t.exe 1256 p0j8szxlr8t.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3016 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 2880 New Order 000112221.exe 2880 New Order 000112221.exe 2880 New Order 000112221.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe 3912 cmstp.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2880 New Order 000112221.exe Token: SeDebugPrivilege 3912 cmstp.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeDebugPrivilege 1256 p0j8szxlr8t.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 3572 wrote to memory of 2880 3572 New Order 000112221.exe 68 PID 3572 wrote to memory of 2880 3572 New Order 000112221.exe 68 PID 3572 wrote to memory of 2880 3572 New Order 000112221.exe 68 PID 3572 wrote to memory of 2880 3572 New Order 000112221.exe 68 PID 3572 wrote to memory of 2880 3572 New Order 000112221.exe 68 PID 3572 wrote to memory of 2880 3572 New Order 000112221.exe 68 PID 3016 wrote to memory of 3912 3016 Explorer.EXE 69 PID 3016 wrote to memory of 3912 3016 Explorer.EXE 69 PID 3016 wrote to memory of 3912 3016 Explorer.EXE 69 PID 3912 wrote to memory of 4028 3912 cmstp.exe 70 PID 3912 wrote to memory of 4028 3912 cmstp.exe 70 PID 3912 wrote to memory of 4028 3912 cmstp.exe 70 PID 3912 wrote to memory of 3928 3912 cmstp.exe 75 PID 3912 wrote to memory of 3928 3912 cmstp.exe 75 PID 3912 wrote to memory of 3928 3912 cmstp.exe 75 PID 3912 wrote to memory of 500 3912 cmstp.exe 77 PID 3912 wrote to memory of 500 3912 cmstp.exe 77 PID 3016 wrote to memory of 748 3016 Explorer.EXE 78 PID 3016 wrote to memory of 748 3016 Explorer.EXE 78 PID 3016 wrote to memory of 748 3016 Explorer.EXE 78 PID 748 wrote to memory of 1256 748 p0j8szxlr8t.exe 79 PID 748 wrote to memory of 1256 748 p0j8szxlr8t.exe 79 PID 748 wrote to memory of 1256 748 p0j8szxlr8t.exe 79 PID 748 wrote to memory of 1256 748 p0j8szxlr8t.exe 79 PID 748 wrote to memory of 1256 748 p0j8szxlr8t.exe 79 PID 748 wrote to memory of 1256 748 p0j8szxlr8t.exe 79 PID 3912 wrote to memory of 500 3912 cmstp.exe 77
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\New Order 000112221.exe"C:\Users\Admin\AppData\Local\Temp\New Order 000112221.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\New Order 000112221.exe"C:\Users\Admin\AppData\Local\Temp\New Order 000112221.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\New Order 000112221.exe"3⤵PID:4028
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3928
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:500
-
-
-
C:\Program Files (x86)\H0bc\p0j8szxlr8t.exe"C:\Program Files (x86)\H0bc\p0j8szxlr8t.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Program Files (x86)\H0bc\p0j8szxlr8t.exe"C:\Program Files (x86)\H0bc\p0j8szxlr8t.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256
-
-