Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
25-11-2021 16:29
Static task
static1
Behavioral task
behavioral1
Sample
TT_SWIFT_Export Order_noref S10SMG00318021.exe
Resource
win7-en-20211104
General
-
Target
TT_SWIFT_Export Order_noref S10SMG00318021.exe
-
Size
653KB
-
MD5
fff91c58119d3cd7f68457e8565f7116
-
SHA1
4201eb7214bd3658889739e4856412b8063e0405
-
SHA256
f8c0d385ece89cd926b2c74680c036f9927414955e7ff4ed12b576470b8c1745
-
SHA512
c05cf9e0ed2aad4c08b394d97fc1257d273aa8dd51a45487ba51ff5973ab7b2227aba7ea1e1e8e9daf7416aaea418b06edfa29ff93665f6d3cc5b1a392dbed92
Malware Config
Extracted
xloader
2.5
46uq
http://www.liberia-infos.net/46uq/
beardeddentguy.com
envirobombs.com
mintbox.pro
xiangpusun.com
pyjama-france.com
mendocinocountylive.com
innovativepropsolutions.com
hpsaddlerock.com
qrmaindonesia.com
liphelp.com
archaeaenergy.info
18446744073709551615.com
littlecreekacresri.com
elderlycareacademy.com
drshivanieyecare.com
ashibumi.com
stevenalexandergolf.com
adoratv.net
visitnewrichmond.com
fxbvanpool.com
aarondecker.online
environmentalkivul.com
cardsncrepes.com
hopdongdientu-viettel.com
thebroughtguarantee.com
howtofindahotniche.com
1678600.win
pityana.com
akconsultoria.com
markazkreasindo.com
ronniecapitol.com
tailsontour.com
abros88.com
laboratoriodentaltj.com
fuckingmom86.xyz
5pz59.com
centralmadu.com
ispecwar.com
otetransportanddispatching.com
cartaovirtual.net
hsadmin.xyz
xn--12c2bed4dxay5cxdh1s.online
oki-net.com
scenekidfancams.com
preciousmugs.com
754711.com
helpigservices.com
blueharepress.com
xmshzs.com
lovelycharlestonhomes.com
wamhsh.com
burlesquercize.com
oppoexch.com
ditjai.tech
the-hausd-group.com
loosebland.website
syntheticloot.net
gzfusco.com
www-by.com
farraztravel.com
beheld3d.art
douyababy.space
elcuerpohumano.xyz
3soap.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1484-70-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1484-71-0x000000000041D4B0-mapping.dmp xloader behavioral1/memory/1072-84-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exeTT_SWIFT_Export Order_noref S10SMG00318021.execmd.exedescription pid process target process PID 1632 set thread context of 1484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1484 set thread context of 1412 1484 TT_SWIFT_Export Order_noref S10SMG00318021.exe Explorer.EXE PID 1072 set thread context of 1412 1072 cmd.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exepowershell.exepowershell.exeTT_SWIFT_Export Order_noref S10SMG00318021.execmd.exepid process 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe 484 powershell.exe 1816 powershell.exe 1484 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1484 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe 1072 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.execmd.exepid process 1484 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1484 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1484 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1072 cmd.exe 1072 cmd.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exepowershell.exepowershell.exeTT_SWIFT_Export Order_noref S10SMG00318021.execmd.exedescription pid process Token: SeDebugPrivilege 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe Token: SeDebugPrivilege 484 powershell.exe Token: SeDebugPrivilege 1816 powershell.exe Token: SeDebugPrivilege 1484 TT_SWIFT_Export Order_noref S10SMG00318021.exe Token: SeDebugPrivilege 1072 cmd.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exeExplorer.EXEdescription pid process target process PID 1632 wrote to memory of 1816 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1632 wrote to memory of 1816 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1632 wrote to memory of 1816 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1632 wrote to memory of 1816 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1632 wrote to memory of 484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1632 wrote to memory of 484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1632 wrote to memory of 484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1632 wrote to memory of 484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1632 wrote to memory of 968 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe schtasks.exe PID 1632 wrote to memory of 968 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe schtasks.exe PID 1632 wrote to memory of 968 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe schtasks.exe PID 1632 wrote to memory of 968 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe schtasks.exe PID 1632 wrote to memory of 1484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1632 wrote to memory of 1484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1632 wrote to memory of 1484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1632 wrote to memory of 1484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1632 wrote to memory of 1484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1632 wrote to memory of 1484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1632 wrote to memory of 1484 1632 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1412 wrote to memory of 1072 1412 Explorer.EXE cmd.exe PID 1412 wrote to memory of 1072 1412 Explorer.EXE cmd.exe PID 1412 wrote to memory of 1072 1412 Explorer.EXE cmd.exe PID 1412 wrote to memory of 1072 1412 Explorer.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AnsPejV.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnsPejV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp84C9.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp84C9.tmpMD5
9ca3af208ca87d7332dd44cffdc0dcc8
SHA19181a9035e05c509aad4cabcd47fc30a2b219704
SHA2567bb316f4749f6ce315cbcbb1a75bd71343c619ee1647ed4716ec5f6042bb3eb4
SHA512bc9f364bec796ce5bc3dd97bf4bbd35f313db56ee61c1ae333d7f0d3c7f9047a09b5c69a06de998bc6a4f2d2c2e05192d441cb9b24f80b977d3c0d624aed4397
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msMD5
0704956a976fbabf6f2def1d15bd1149
SHA1183845f8e1ab740e22fa7aa1718508ccf9732981
SHA2561db5e6fc5efa54fb1a23e1769c40f8069e267868efe5a707590ba0a679f333b5
SHA5120977432a8def100643b858040df78f3dd4fac46eb2cd5bd3bf2bfdddb4a1b875e12ba239b337c3c5a2189d6445ff176704b10ababde62ab6b2bffd0dc4fe8c5e
-
memory/484-80-0x0000000002490000-0x00000000030DA000-memory.dmpFilesize
12.3MB
-
memory/484-78-0x0000000002490000-0x00000000030DA000-memory.dmpFilesize
12.3MB
-
memory/484-74-0x0000000002490000-0x00000000030DA000-memory.dmpFilesize
12.3MB
-
memory/484-63-0x0000000000000000-mapping.dmp
-
memory/968-64-0x0000000000000000-mapping.dmp
-
memory/1072-85-0x0000000001EF0000-0x00000000021F3000-memory.dmpFilesize
3.0MB
-
memory/1072-86-0x0000000001D20000-0x0000000001DB0000-memory.dmpFilesize
576KB
-
memory/1072-82-0x0000000000000000-mapping.dmp
-
memory/1072-83-0x000000004AAC0000-0x000000004AB0C000-memory.dmpFilesize
304KB
-
memory/1072-84-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1412-87-0x0000000008F10000-0x000000000909E000-memory.dmpFilesize
1.6MB
-
memory/1412-76-0x0000000006610000-0x0000000006762000-memory.dmpFilesize
1.3MB
-
memory/1484-75-0x00000000003A0000-0x00000000003B1000-memory.dmpFilesize
68KB
-
memory/1484-71-0x000000000041D4B0-mapping.dmp
-
memory/1484-70-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1484-69-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1484-68-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1484-81-0x0000000000A00000-0x0000000000D03000-memory.dmpFilesize
3.0MB
-
memory/1632-59-0x00000000006D0000-0x00000000006D8000-memory.dmpFilesize
32KB
-
memory/1632-57-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/1632-55-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1632-58-0x0000000004EC5000-0x0000000004ED6000-memory.dmpFilesize
68KB
-
memory/1632-60-0x0000000004E30000-0x0000000004E8A000-memory.dmpFilesize
360KB
-
memory/1816-62-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB
-
memory/1816-79-0x0000000002202000-0x0000000002204000-memory.dmpFilesize
8KB
-
memory/1816-77-0x0000000002201000-0x0000000002202000-memory.dmpFilesize
4KB
-
memory/1816-72-0x0000000002200000-0x0000000002201000-memory.dmpFilesize
4KB
-
memory/1816-61-0x0000000000000000-mapping.dmp