Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
02-12-2021 16:29
Static task
static1
Behavioral task
behavioral1
Sample
PO_CG20210302346.js
Resource
win7-en-20211014
General
-
Target
PO_CG20210302346.js
-
Size
742KB
-
MD5
4d7d2a0d4fe470f6cf2a0a9fc519a5ff
-
SHA1
c8364f810e6c2bef6801c4b7196882dca05decb0
-
SHA256
7d024e7fbc39d9379d96332276f41b08670843de3803ea91b257efeadbf8f46c
-
SHA512
fb3c7bb3fdec6257a8c027e54662f4ac9eb9952647201f10a5942011810d9690bf6b970718bc38038093df9f1d8ab349b3b27cf6432ce69df1e383a7074977f5
Malware Config
Extracted
xloader
2.5
pzi0
http://www.buffstaff.com/pzi0/
laylmodest.com
woruke.club
metaverseslots.net
syscogent.net
aluxxenterprise.com
lm-solar.com
lightempirestore.com
witcheboutique.com
hometech-bosch.xyz
expert-netcad.com
poteconomist.com
mycousinsfriend.biz
shineveranda.com
collegedictionary.cloud
zqlidexx.com
businessesopportunity.com
2utalahs4.com
participatetn.info
dare2ownit.com
varser.com
gxo.digital
networkroftrl.xyz
renturways.com
theprooff.com
ncgf06.xyz
lighterior2.com
one-seo.xyz
benzprod.xyz
k6tkuwrnjake.biz
robinlynnolson.com
ioptest.com
modern-elementz.com
baetsupreme.net
lapetiteagencequimonte.com
xn--bellemre-60a.com
bringthegalaxy.com
shopnobra.com
maroondragon.com
pandemictickets.com
intelligentrereturns.net
quietshop.art
anarkalidress.com
wasserstoff-station.net
filmweltruhr.com
buck100.com
maxicashprommu.xyz
studiosilhouettes.com
lightningridgetradingpost.com
zhuanzhuan9987.top
mlelement.com
krystalsescapetravels.com
simplyabcbooks.com
greenhouse1995systems.com
altogetheradhd.com
servicedogumentary.com
cdcawpx.com
motometics.com
palisadesattahoe.com
paradgmpharma.com
microexpertise.com
venkycouture.online
maculardegenerationtsusanet.com
atlasbrandwear.com
karegcc.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/380-135-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/380-136-0x000000000041D480-mapping.dmp xloader behavioral2/memory/380-140-0x0000000000B00000-0x0000000000BAE000-memory.dmp xloader behavioral2/memory/1112-144-0x0000000000C20000-0x0000000000C49000-memory.dmp xloader -
Blocklisted process makes network request 18 IoCs
Processes:
wscript.exeflow pid process 11 3320 wscript.exe 16 3320 wscript.exe 23 3320 wscript.exe 24 3320 wscript.exe 29 3320 wscript.exe 30 3320 wscript.exe 33 3320 wscript.exe 35 3320 wscript.exe 38 3320 wscript.exe 42 3320 wscript.exe 49 3320 wscript.exe 53 3320 wscript.exe 55 3320 wscript.exe 60 3320 wscript.exe 63 3320 wscript.exe 68 3320 wscript.exe 71 3320 wscript.exe 75 3320 wscript.exe -
Executes dropped EXE 4 IoCs
Processes:
MJoeuu6lp4G7m5Q.exeMJoeuu6lp4G7m5Q.exeMJoeuu6lp4G7m5Q.exeMJoeuu6lp4G7m5Q.exepid process 500 MJoeuu6lp4G7m5Q.exe 1160 MJoeuu6lp4G7m5Q.exe 972 MJoeuu6lp4G7m5Q.exe 380 MJoeuu6lp4G7m5Q.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bXCJbnYyZT.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bXCJbnYyZT.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\bXCJbnYyZT.js\"" wscript.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
MJoeuu6lp4G7m5Q.exeMJoeuu6lp4G7m5Q.exeexplorer.exedescription pid process target process PID 500 set thread context of 380 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 380 set thread context of 3020 380 MJoeuu6lp4G7m5Q.exe Explorer.EXE PID 1112 set thread context of 3020 1112 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
MJoeuu6lp4G7m5Q.exeMJoeuu6lp4G7m5Q.exeexplorer.exepid process 500 MJoeuu6lp4G7m5Q.exe 500 MJoeuu6lp4G7m5Q.exe 500 MJoeuu6lp4G7m5Q.exe 500 MJoeuu6lp4G7m5Q.exe 380 MJoeuu6lp4G7m5Q.exe 380 MJoeuu6lp4G7m5Q.exe 380 MJoeuu6lp4G7m5Q.exe 380 MJoeuu6lp4G7m5Q.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe 1112 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
MJoeuu6lp4G7m5Q.exeexplorer.exepid process 380 MJoeuu6lp4G7m5Q.exe 380 MJoeuu6lp4G7m5Q.exe 380 MJoeuu6lp4G7m5Q.exe 1112 explorer.exe 1112 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
MJoeuu6lp4G7m5Q.exeMJoeuu6lp4G7m5Q.exeexplorer.exedescription pid process Token: SeDebugPrivilege 500 MJoeuu6lp4G7m5Q.exe Token: SeDebugPrivilege 380 MJoeuu6lp4G7m5Q.exe Token: SeDebugPrivilege 1112 explorer.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
wscript.exeMJoeuu6lp4G7m5Q.exeExplorer.EXEexplorer.exedescription pid process target process PID 2716 wrote to memory of 3320 2716 wscript.exe wscript.exe PID 2716 wrote to memory of 3320 2716 wscript.exe wscript.exe PID 2716 wrote to memory of 500 2716 wscript.exe MJoeuu6lp4G7m5Q.exe PID 2716 wrote to memory of 500 2716 wscript.exe MJoeuu6lp4G7m5Q.exe PID 2716 wrote to memory of 500 2716 wscript.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 1160 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 1160 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 1160 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 972 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 972 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 972 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 380 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 380 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 380 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 380 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 380 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 500 wrote to memory of 380 500 MJoeuu6lp4G7m5Q.exe MJoeuu6lp4G7m5Q.exe PID 3020 wrote to memory of 1112 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 1112 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 1112 3020 Explorer.EXE explorer.exe PID 1112 wrote to memory of 2208 1112 explorer.exe cmd.exe PID 1112 wrote to memory of 2208 1112 explorer.exe cmd.exe PID 1112 wrote to memory of 2208 1112 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PO_CG20210302346.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\bXCJbnYyZT.js"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exe"C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exe"C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exe"C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exe"C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exeMD5
81f24b219e4b7c29122243a7745e0d70
SHA1162087ad805242265b42bb046696b39d1cd76f50
SHA2563fa318a8ae6e6582155aa6dd984168f77a7f81b43f578c974fa3c4f5c7668da8
SHA512315480c4d4a96c9b4c7d7bc80b96cd09ce5a5ad8a9a5edd2c435eca171a13278825d80d6c6de1d575388540ac2ef5820d1f0645221d6adc8702396a56662b5bb
-
C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exeMD5
81f24b219e4b7c29122243a7745e0d70
SHA1162087ad805242265b42bb046696b39d1cd76f50
SHA2563fa318a8ae6e6582155aa6dd984168f77a7f81b43f578c974fa3c4f5c7668da8
SHA512315480c4d4a96c9b4c7d7bc80b96cd09ce5a5ad8a9a5edd2c435eca171a13278825d80d6c6de1d575388540ac2ef5820d1f0645221d6adc8702396a56662b5bb
-
C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exeMD5
81f24b219e4b7c29122243a7745e0d70
SHA1162087ad805242265b42bb046696b39d1cd76f50
SHA2563fa318a8ae6e6582155aa6dd984168f77a7f81b43f578c974fa3c4f5c7668da8
SHA512315480c4d4a96c9b4c7d7bc80b96cd09ce5a5ad8a9a5edd2c435eca171a13278825d80d6c6de1d575388540ac2ef5820d1f0645221d6adc8702396a56662b5bb
-
C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exeMD5
81f24b219e4b7c29122243a7745e0d70
SHA1162087ad805242265b42bb046696b39d1cd76f50
SHA2563fa318a8ae6e6582155aa6dd984168f77a7f81b43f578c974fa3c4f5c7668da8
SHA512315480c4d4a96c9b4c7d7bc80b96cd09ce5a5ad8a9a5edd2c435eca171a13278825d80d6c6de1d575388540ac2ef5820d1f0645221d6adc8702396a56662b5bb
-
C:\Users\Admin\AppData\Local\Temp\MJoeuu6lp4G7m5Q.exeMD5
81f24b219e4b7c29122243a7745e0d70
SHA1162087ad805242265b42bb046696b39d1cd76f50
SHA2563fa318a8ae6e6582155aa6dd984168f77a7f81b43f578c974fa3c4f5c7668da8
SHA512315480c4d4a96c9b4c7d7bc80b96cd09ce5a5ad8a9a5edd2c435eca171a13278825d80d6c6de1d575388540ac2ef5820d1f0645221d6adc8702396a56662b5bb
-
C:\Users\Admin\AppData\Roaming\bXCJbnYyZT.jsMD5
9d628656a16fa431c6290136bec8395a
SHA1abbc3359d13f5af4bb00b12e28f903bbfc2327f3
SHA2567f8bc9fa4c2948c50e91f6606ca0140a29d726ad9ead11eccf92d6ac13cc19c4
SHA51238f612d1211a1b15ad2f14f0ef2a19b7b8b04520aff9ae6b43133a4a87f81182a5b625302956a8fe193f7bbb43f6a89ac75280025399a1df404d04f271adcc72
-
memory/380-140-0x0000000000B00000-0x0000000000BAE000-memory.dmpFilesize
696KB
-
memory/380-135-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/380-138-0x0000000001090000-0x00000000013B0000-memory.dmpFilesize
3.1MB
-
memory/380-136-0x000000000041D480-mapping.dmp
-
memory/500-131-0x0000000006750000-0x0000000006751000-memory.dmpFilesize
4KB
-
memory/500-127-0x00000000059B0000-0x00000000059B1000-memory.dmpFilesize
4KB
-
memory/500-126-0x00000000059E0000-0x00000000059E1000-memory.dmpFilesize
4KB
-
memory/500-132-0x00000000067F0000-0x0000000006848000-memory.dmpFilesize
352KB
-
memory/500-125-0x0000000005EE0000-0x0000000005EE1000-memory.dmpFilesize
4KB
-
memory/500-123-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/500-129-0x00000000059A0000-0x00000000059A8000-memory.dmpFilesize
32KB
-
memory/500-128-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/500-120-0x0000000000000000-mapping.dmp
-
memory/500-130-0x00000000063E0000-0x00000000063E1000-memory.dmpFilesize
4KB
-
memory/1112-142-0x0000000000000000-mapping.dmp
-
memory/1112-144-0x0000000000C20000-0x0000000000C49000-memory.dmpFilesize
164KB
-
memory/1112-143-0x0000000000E60000-0x000000000129F000-memory.dmpFilesize
4.2MB
-
memory/1112-145-0x00000000051B0000-0x00000000054D0000-memory.dmpFilesize
3.1MB
-
memory/1112-147-0x0000000004E70000-0x0000000004F00000-memory.dmpFilesize
576KB
-
memory/2208-146-0x0000000000000000-mapping.dmp
-
memory/3020-141-0x0000000005F40000-0x00000000060B0000-memory.dmpFilesize
1.4MB
-
memory/3020-148-0x0000000006430000-0x000000000658C000-memory.dmpFilesize
1.4MB
-
memory/3320-118-0x0000000000000000-mapping.dmp