Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
25-11-2021 16:48
Static task
static1
Behavioral task
behavioral1
Sample
STATEMENT Oct-Nov 25-11-2021.com.exe
Resource
win7-en-20211014
General
-
Target
STATEMENT Oct-Nov 25-11-2021.com.exe
-
Size
301KB
-
MD5
02e738dd13974ab64a472f6aa2f065a8
-
SHA1
6134aee9ceffce4d6ed1777739493def77b62533
-
SHA256
9acf8fb51cab55a01a74cb84ca9958862b29b8909408e87412700e63a4f578ae
-
SHA512
90ce5711d1f3abd07398c38706f5dc48da02676a86331115b5c7724fd98b1b41606f3d80763d3c03663c1c1bf7864609d65eae183b73f5df2db8e73a49bccf09
Malware Config
Extracted
xloader
2.5
unzn
http://www.davanamays.com/unzn/
xiulf.com
highcountrymortar.com
523561.com
marketingagency.tools
ganmovie.net
nationaalcontactpunt.com
sirrbter.com
begizas.xyz
missimi-fashion.com
munixc.info
daas.support
spaceworbc.com
faithtruthresolve.com
gymkub.com
thegrayverse.xyz
artisanmakefurniture.com
029tryy.com
ijuubx.biz
iphone13promax.club
techuniversus.com
samrgov.xyz
grownupcurl.com
sj0755.net
beekeeperkit.com
richessesabondantes.com
xclgjgjh.net
webworkscork.com
vedepviet365.com
bretabeameven.com
cdzsmhw.com
clearperspective.biz
tigrg5g784sh.biz
bbezan011.xyz
mycar.store
mansooralobeidli.com
ascensionmemberszoom.com
unlimitedrehab.com
wozka.top
askylarkgoods.com
rj793.com
prosvalor.com
primetimeexpress.com
boixosnoisperu.com
mmasportgear.com
concertiranian.net
hyponymys.info
maila.one
yti0fyic.xyz
shashiprayag.com
speedprosmotorsports.com
westchestercountyjunkcars.com
patienceinmypocket.com
rausachbaoloc.com
plexregroup.com
outsydercs.com
foodandflour.com
lenacrypto.xyz
homeservicetoday.net
marthaperry.com
vmtcyd4q8.com
shamefulguys.com
loccssol.store
gnarledportra.xyz
042atk.xyz
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/576-57-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/576-58-0x000000000041D430-mapping.dmp xloader behavioral1/memory/576-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/816-68-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1000 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
STATEMENT Oct-Nov 25-11-2021.com.exepid process 520 STATEMENT Oct-Nov 25-11-2021.com.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
STATEMENT Oct-Nov 25-11-2021.com.exeSTATEMENT Oct-Nov 25-11-2021.com.exesvchost.exedescription pid process target process PID 520 set thread context of 576 520 STATEMENT Oct-Nov 25-11-2021.com.exe STATEMENT Oct-Nov 25-11-2021.com.exe PID 576 set thread context of 1200 576 STATEMENT Oct-Nov 25-11-2021.com.exe Explorer.EXE PID 576 set thread context of 1200 576 STATEMENT Oct-Nov 25-11-2021.com.exe Explorer.EXE PID 816 set thread context of 1200 816 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
STATEMENT Oct-Nov 25-11-2021.com.exesvchost.exepid process 576 STATEMENT Oct-Nov 25-11-2021.com.exe 576 STATEMENT Oct-Nov 25-11-2021.com.exe 576 STATEMENT Oct-Nov 25-11-2021.com.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe 816 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
STATEMENT Oct-Nov 25-11-2021.com.exesvchost.exepid process 576 STATEMENT Oct-Nov 25-11-2021.com.exe 576 STATEMENT Oct-Nov 25-11-2021.com.exe 576 STATEMENT Oct-Nov 25-11-2021.com.exe 576 STATEMENT Oct-Nov 25-11-2021.com.exe 816 svchost.exe 816 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
STATEMENT Oct-Nov 25-11-2021.com.exesvchost.exedescription pid process Token: SeDebugPrivilege 576 STATEMENT Oct-Nov 25-11-2021.com.exe Token: SeDebugPrivilege 816 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
STATEMENT Oct-Nov 25-11-2021.com.exeExplorer.EXEsvchost.exedescription pid process target process PID 520 wrote to memory of 576 520 STATEMENT Oct-Nov 25-11-2021.com.exe STATEMENT Oct-Nov 25-11-2021.com.exe PID 520 wrote to memory of 576 520 STATEMENT Oct-Nov 25-11-2021.com.exe STATEMENT Oct-Nov 25-11-2021.com.exe PID 520 wrote to memory of 576 520 STATEMENT Oct-Nov 25-11-2021.com.exe STATEMENT Oct-Nov 25-11-2021.com.exe PID 520 wrote to memory of 576 520 STATEMENT Oct-Nov 25-11-2021.com.exe STATEMENT Oct-Nov 25-11-2021.com.exe PID 520 wrote to memory of 576 520 STATEMENT Oct-Nov 25-11-2021.com.exe STATEMENT Oct-Nov 25-11-2021.com.exe PID 520 wrote to memory of 576 520 STATEMENT Oct-Nov 25-11-2021.com.exe STATEMENT Oct-Nov 25-11-2021.com.exe PID 520 wrote to memory of 576 520 STATEMENT Oct-Nov 25-11-2021.com.exe STATEMENT Oct-Nov 25-11-2021.com.exe PID 1200 wrote to memory of 816 1200 Explorer.EXE svchost.exe PID 1200 wrote to memory of 816 1200 Explorer.EXE svchost.exe PID 1200 wrote to memory of 816 1200 Explorer.EXE svchost.exe PID 1200 wrote to memory of 816 1200 Explorer.EXE svchost.exe PID 816 wrote to memory of 1000 816 svchost.exe cmd.exe PID 816 wrote to memory of 1000 816 svchost.exe cmd.exe PID 816 wrote to memory of 1000 816 svchost.exe cmd.exe PID 816 wrote to memory of 1000 816 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\STATEMENT Oct-Nov 25-11-2021.com.exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT Oct-Nov 25-11-2021.com.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\STATEMENT Oct-Nov 25-11-2021.com.exe"C:\Users\Admin\AppData\Local\Temp\STATEMENT Oct-Nov 25-11-2021.com.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\STATEMENT Oct-Nov 25-11-2021.com.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsoF587.tmp\ncpszgn.dllMD5
c3678c74295ff18273f177d3058bcc9d
SHA1619a2fbfb1f1512e96af74733345e5539786e789
SHA256d6cb2032b903d1820cc840659d655877cba6d1e6746ebf366696aed3d9dc0c65
SHA5123542b7dfeea67460f52fd40f212831ebc33a7831b3b05770ce619c0e25f030129028e5e96c3291fc578d39075107e7ef8bf5883ea79a38c69a0edee9df72056c
-
memory/520-55-0x0000000075191000-0x0000000075193000-memory.dmpFilesize
8KB
-
memory/576-64-0x00000000005A0000-0x00000000005B1000-memory.dmpFilesize
68KB
-
memory/576-61-0x00000000003D0000-0x00000000003E1000-memory.dmpFilesize
68KB
-
memory/576-60-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3.0MB
-
memory/576-58-0x000000000041D430-mapping.dmp
-
memory/576-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/576-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/816-71-0x00000000005E0000-0x0000000000670000-memory.dmpFilesize
576KB
-
memory/816-66-0x0000000000000000-mapping.dmp
-
memory/816-67-0x0000000000220000-0x0000000000228000-memory.dmpFilesize
32KB
-
memory/816-68-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/816-69-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1000-70-0x0000000000000000-mapping.dmp
-
memory/1200-62-0x0000000007340000-0x0000000007486000-memory.dmpFilesize
1.3MB
-
memory/1200-65-0x0000000005F70000-0x000000000604E000-memory.dmpFilesize
888KB
-
memory/1200-72-0x0000000007490000-0x00000000075F1000-memory.dmpFilesize
1.4MB