Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
24-11-2021 10:51
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7-en-20211104
General
-
Target
Purchase Order.exe
-
Size
516KB
-
MD5
1a84232e14194f3ac154f8711d6f683e
-
SHA1
c735848eb56e7fbfe229918de1e042c238edb1a8
-
SHA256
8e405b6451c62462b5df1a0490175f4b9712ee1b1ab25a52f7e3a1f736400439
-
SHA512
1f697fcd5c22ecb1aec21e569f8624666cded36cf357b65213ff93c3245c396652e48252d114b17d8442452a395fd695be78b9f8a23e67ff9b98ebc16f85db95
Malware Config
Extracted
xloader
2.5
ea0r
http://www.asiapubz-hk.com/ea0r/
lionheartcreativestudios.com
konzertmanagement.com
blackpanther.online
broychim-int.com
takut18.com
txstarsolar.com
herdsherpa.com
igorshestakov.com
shinesbox.com
reflectpkljlt.xyz
oiltoolshub.com
viralmoneychallenge.com
changingalphastrategies.com
mecitiris.com
rdadmin.online
miniambiente.com
kominarcine.com
pino-almond.com
heihit.xyz
junqi888.com
metalumber.com
sclvfu.com
macanostore.online
projecturs.com
ahcprp.com
gztyfnrj.com
lospacenos.com
tak-etranger.com
dingermail.com
skiin.club
ystops.com
tnboxes.com
ccafgz.com
info1337.xyz
platinum24.top
hothess.com
novelfinancewhite.xyz
theselectdifference.com
flufca.com
giftcodefreefirevns.com
kgv-lachswehr.com
report-alfarabilabs.com
skeetones.com
4bcinc.com
americamr.com
wewonacademy.com
evrazavto.store
true-fanbox.com
greencofiji.com
threecommaspartners.com
hgtradingcoltd.com
xihe1919.com
241mk.com
helplockedout.com
wefundprojects.com
neosecure.store
purenewsworldwide.com
luckylottovip999.com
lottidobler.com
proyectohaciendohistoria.com
raintm.com
theproducerformula.com
trademarkitforyourself.com
ottaweed.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2148-132-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2148-133-0x000000000041D410-mapping.dmp xloader behavioral2/memory/2148-141-0x0000000000F90000-0x00000000010DA000-memory.dmp xloader behavioral2/memory/396-162-0x0000000002740000-0x0000000002769000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order.exePurchase Order.exewscript.exedescription pid process target process PID 2700 set thread context of 2148 2700 Purchase Order.exe Purchase Order.exe PID 2148 set thread context of 3020 2148 Purchase Order.exe Explorer.EXE PID 396 set thread context of 3020 396 wscript.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
Purchase Order.exePurchase Order.exepowershell.exewscript.exepid process 2700 Purchase Order.exe 2700 Purchase Order.exe 2148 Purchase Order.exe 2148 Purchase Order.exe 808 powershell.exe 2148 Purchase Order.exe 2148 Purchase Order.exe 808 powershell.exe 808 powershell.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe 396 wscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase Order.exewscript.exepid process 2148 Purchase Order.exe 2148 Purchase Order.exe 2148 Purchase Order.exe 396 wscript.exe 396 wscript.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Purchase Order.exepowershell.exePurchase Order.exewscript.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2700 Purchase Order.exe Token: SeDebugPrivilege 808 powershell.exe Token: SeDebugPrivilege 2148 Purchase Order.exe Token: SeDebugPrivilege 396 wscript.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Purchase Order.exeExplorer.EXEwscript.exedescription pid process target process PID 2700 wrote to memory of 808 2700 Purchase Order.exe powershell.exe PID 2700 wrote to memory of 808 2700 Purchase Order.exe powershell.exe PID 2700 wrote to memory of 808 2700 Purchase Order.exe powershell.exe PID 2700 wrote to memory of 3308 2700 Purchase Order.exe schtasks.exe PID 2700 wrote to memory of 3308 2700 Purchase Order.exe schtasks.exe PID 2700 wrote to memory of 3308 2700 Purchase Order.exe schtasks.exe PID 2700 wrote to memory of 2148 2700 Purchase Order.exe Purchase Order.exe PID 2700 wrote to memory of 2148 2700 Purchase Order.exe Purchase Order.exe PID 2700 wrote to memory of 2148 2700 Purchase Order.exe Purchase Order.exe PID 2700 wrote to memory of 2148 2700 Purchase Order.exe Purchase Order.exe PID 2700 wrote to memory of 2148 2700 Purchase Order.exe Purchase Order.exe PID 2700 wrote to memory of 2148 2700 Purchase Order.exe Purchase Order.exe PID 3020 wrote to memory of 396 3020 Explorer.EXE wscript.exe PID 3020 wrote to memory of 396 3020 Explorer.EXE wscript.exe PID 3020 wrote to memory of 396 3020 Explorer.EXE wscript.exe PID 396 wrote to memory of 3396 396 wscript.exe cmd.exe PID 396 wrote to memory of 3396 396 wscript.exe cmd.exe PID 396 wrote to memory of 3396 396 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UcvvwVHjSby.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UcvvwVHjSby" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6A01.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp6A01.tmpMD5
3aedc2f077a7d279d197e74a888e9da8
SHA14cbe0aa876c591ac832347ebcb390ab66c78361e
SHA25605b499696238bdb27dc52b392296acba0fee0ebce2c8dfd764cb079c470e29e9
SHA512cb8040427ea30a406f47574688412c706e0c82c32fbffab073ce4b4c774c77a22c814bded168a6ed0611d87d203d8cc3d61f4b5f9e7a11de88725aba3a772d8c
-
memory/396-387-0x00000000044A0000-0x0000000004530000-memory.dmpFilesize
576KB
-
memory/396-182-0x0000000004640000-0x0000000004960000-memory.dmpFilesize
3.1MB
-
memory/396-162-0x0000000002740000-0x0000000002769000-memory.dmpFilesize
164KB
-
memory/396-161-0x0000000000350000-0x0000000000377000-memory.dmpFilesize
156KB
-
memory/396-150-0x0000000000000000-mapping.dmp
-
memory/808-126-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/808-163-0x0000000008FA0000-0x0000000008FA1000-memory.dmpFilesize
4KB
-
memory/808-124-0x0000000000000000-mapping.dmp
-
memory/808-184-0x0000000000FA3000-0x0000000000FA4000-memory.dmpFilesize
4KB
-
memory/808-171-0x00000000094F0000-0x00000000094F1000-memory.dmpFilesize
4KB
-
memory/808-127-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/808-169-0x0000000009390000-0x0000000009391000-memory.dmpFilesize
4KB
-
memory/808-129-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/808-130-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/808-131-0x00000000072B0000-0x00000000072B1000-memory.dmpFilesize
4KB
-
memory/808-164-0x000000007E2F0000-0x000000007E2F1000-memory.dmpFilesize
4KB
-
memory/808-144-0x0000000008340000-0x0000000008341000-memory.dmpFilesize
4KB
-
memory/808-134-0x0000000007160000-0x0000000007161000-memory.dmpFilesize
4KB
-
memory/808-136-0x0000000007950000-0x0000000007951000-memory.dmpFilesize
4KB
-
memory/808-137-0x0000000007200000-0x0000000007201000-memory.dmpFilesize
4KB
-
memory/808-138-0x0000000007AF0000-0x0000000007AF1000-memory.dmpFilesize
4KB
-
memory/808-139-0x0000000000FA2000-0x0000000000FA3000-memory.dmpFilesize
4KB
-
memory/808-154-0x0000000008FC0000-0x0000000008FF3000-memory.dmpFilesize
204KB
-
memory/808-146-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/808-145-0x00000000081F0000-0x00000000081F1000-memory.dmpFilesize
4KB
-
memory/808-143-0x0000000007920000-0x0000000007921000-memory.dmpFilesize
4KB
-
memory/2148-132-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2148-141-0x0000000000F90000-0x00000000010DA000-memory.dmpFilesize
1.3MB
-
memory/2148-140-0x00000000014D0000-0x00000000017F0000-memory.dmpFilesize
3.1MB
-
memory/2148-133-0x000000000041D410-mapping.dmp
-
memory/2700-123-0x0000000008FB0000-0x000000000901B000-memory.dmpFilesize
428KB
-
memory/2700-120-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/2700-121-0x0000000008AE0000-0x0000000008AE4000-memory.dmpFilesize
16KB
-
memory/2700-119-0x0000000005660000-0x0000000005B5E000-memory.dmpFilesize
5.0MB
-
memory/2700-122-0x0000000008E10000-0x0000000008E11000-memory.dmpFilesize
4KB
-
memory/2700-115-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/2700-118-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/2700-117-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/3020-142-0x00000000061D0000-0x0000000006375000-memory.dmpFilesize
1.6MB
-
memory/3020-388-0x0000000005E40000-0x0000000005F92000-memory.dmpFilesize
1.3MB
-
memory/3308-125-0x0000000000000000-mapping.dmp
-
memory/3396-170-0x0000000000000000-mapping.dmp