Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
01-12-2021 06:52
Static task
static1
Behavioral task
behavioral1
Sample
Statement 12-01-2021.com.exe
Resource
win7-en-20211014
General
-
Target
Statement 12-01-2021.com.exe
-
Size
552KB
-
MD5
d84165c69252af24ac6a92da452b4eb2
-
SHA1
5ca05c20d6240e1ab18c4204cfe3a8d85b5fede4
-
SHA256
99e122686461defed546b28e1b3461a92cc5a3e0fe46cac917f5e130d5941f1f
-
SHA512
ada97e517e7678ad971c73395d282d84c1b35493f7cd012ac226a08549757ec756d147ccc404620cd655804c24d1ed5f8e68390478fc3a5b6f134d326c78b3f5
Malware Config
Extracted
xloader
2.5
unzn
http://www.davanamays.com/unzn/
xiulf.com
highcountrymortar.com
523561.com
marketingagency.tools
ganmovie.net
nationaalcontactpunt.com
sirrbter.com
begizas.xyz
missimi-fashion.com
munixc.info
daas.support
spaceworbc.com
faithtruthresolve.com
gymkub.com
thegrayverse.xyz
artisanmakefurniture.com
029tryy.com
ijuubx.biz
iphone13promax.club
techuniversus.com
samrgov.xyz
grownupcurl.com
sj0755.net
beekeeperkit.com
richessesabondantes.com
xclgjgjh.net
webworkscork.com
vedepviet365.com
bretabeameven.com
cdzsmhw.com
clearperspective.biz
tigrg5g784sh.biz
bbezan011.xyz
mycar.store
mansooralobeidli.com
ascensionmemberszoom.com
unlimitedrehab.com
wozka.top
askylarkgoods.com
rj793.com
prosvalor.com
primetimeexpress.com
boixosnoisperu.com
mmasportgear.com
concertiranian.net
hyponymys.info
maila.one
yti0fyic.xyz
shashiprayag.com
speedprosmotorsports.com
westchestercountyjunkcars.com
patienceinmypocket.com
rausachbaoloc.com
plexregroup.com
outsydercs.com
foodandflour.com
lenacrypto.xyz
homeservicetoday.net
marthaperry.com
vmtcyd4q8.com
shamefulguys.com
loccssol.store
gnarledportra.xyz
042atk.xyz
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/360-57-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/360-58-0x000000000041D430-mapping.dmp xloader behavioral1/memory/360-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1464-70-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 288 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
Statement 12-01-2021.com.exepid process 848 Statement 12-01-2021.com.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Statement 12-01-2021.com.exeStatement 12-01-2021.com.exeipconfig.exedescription pid process target process PID 848 set thread context of 360 848 Statement 12-01-2021.com.exe Statement 12-01-2021.com.exe PID 360 set thread context of 1268 360 Statement 12-01-2021.com.exe Explorer.EXE PID 360 set thread context of 1268 360 Statement 12-01-2021.com.exe Explorer.EXE PID 1464 set thread context of 1268 1464 ipconfig.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1464 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Statement 12-01-2021.com.exeipconfig.exepid process 360 Statement 12-01-2021.com.exe 360 Statement 12-01-2021.com.exe 360 Statement 12-01-2021.com.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe 1464 ipconfig.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Statement 12-01-2021.com.exeipconfig.exepid process 360 Statement 12-01-2021.com.exe 360 Statement 12-01-2021.com.exe 360 Statement 12-01-2021.com.exe 360 Statement 12-01-2021.com.exe 1464 ipconfig.exe 1464 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Statement 12-01-2021.com.exeipconfig.exedescription pid process Token: SeDebugPrivilege 360 Statement 12-01-2021.com.exe Token: SeDebugPrivilege 1464 ipconfig.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Statement 12-01-2021.com.exeExplorer.EXEipconfig.exedescription pid process target process PID 848 wrote to memory of 360 848 Statement 12-01-2021.com.exe Statement 12-01-2021.com.exe PID 848 wrote to memory of 360 848 Statement 12-01-2021.com.exe Statement 12-01-2021.com.exe PID 848 wrote to memory of 360 848 Statement 12-01-2021.com.exe Statement 12-01-2021.com.exe PID 848 wrote to memory of 360 848 Statement 12-01-2021.com.exe Statement 12-01-2021.com.exe PID 848 wrote to memory of 360 848 Statement 12-01-2021.com.exe Statement 12-01-2021.com.exe PID 848 wrote to memory of 360 848 Statement 12-01-2021.com.exe Statement 12-01-2021.com.exe PID 848 wrote to memory of 360 848 Statement 12-01-2021.com.exe Statement 12-01-2021.com.exe PID 1268 wrote to memory of 1464 1268 Explorer.EXE ipconfig.exe PID 1268 wrote to memory of 1464 1268 Explorer.EXE ipconfig.exe PID 1268 wrote to memory of 1464 1268 Explorer.EXE ipconfig.exe PID 1268 wrote to memory of 1464 1268 Explorer.EXE ipconfig.exe PID 1464 wrote to memory of 288 1464 ipconfig.exe cmd.exe PID 1464 wrote to memory of 288 1464 ipconfig.exe cmd.exe PID 1464 wrote to memory of 288 1464 ipconfig.exe cmd.exe PID 1464 wrote to memory of 288 1464 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Statement 12-01-2021.com.exe"C:\Users\Admin\AppData\Local\Temp\Statement 12-01-2021.com.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Statement 12-01-2021.com.exe"C:\Users\Admin\AppData\Local\Temp\Statement 12-01-2021.com.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Statement 12-01-2021.com.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nst1298.tmp\flfxltt.dllMD5
41986140e388b8d37885dce52f32306f
SHA11e89e16a2f2d68f6d5af6519ce0e61d28c1f7c26
SHA2563d63725dd035a901cadb74b2f0a6942f91462bd79b72ccc2d8196a5e72885748
SHA512e0d2a09e92c4805b99864703df41bd7f71a1c40d0ad8b209e679b6029ee75a7a80d11472ffaf63d2ce3c8f353a515c56321f14cb17b36b6be431a9173f692971
-
memory/288-68-0x0000000000000000-mapping.dmp
-
memory/360-64-0x00000000005F0000-0x0000000000601000-memory.dmpFilesize
68KB
-
memory/360-58-0x000000000041D430-mapping.dmp
-
memory/360-60-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/360-61-0x00000000003D0000-0x00000000003E1000-memory.dmpFilesize
68KB
-
memory/360-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/360-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/848-55-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB
-
memory/1268-65-0x00000000071E0000-0x0000000007320000-memory.dmpFilesize
1.2MB
-
memory/1268-62-0x0000000006A60000-0x0000000006BF5000-memory.dmpFilesize
1.6MB
-
memory/1268-73-0x0000000008E80000-0x0000000008FA5000-memory.dmpFilesize
1.1MB
-
memory/1464-66-0x0000000000000000-mapping.dmp
-
memory/1464-69-0x00000000009E0000-0x00000000009EA000-memory.dmpFilesize
40KB
-
memory/1464-71-0x0000000002110000-0x0000000002413000-memory.dmpFilesize
3.0MB
-
memory/1464-70-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1464-72-0x0000000000910000-0x00000000009A0000-memory.dmpFilesize
576KB