Analysis
-
max time kernel
152s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
08-12-2021 10:16
Static task
static1
Behavioral task
behavioral1
Sample
Jayaswal Neco Industries - Products List & document.exe
Resource
win7-en-20211104
General
-
Target
Jayaswal Neco Industries - Products List & document.exe
-
Size
1.2MB
-
MD5
f3d120960ee7052af731cebcfc3b4d99
-
SHA1
16ae70774e448cbb368838c89feb4c173955ecc9
-
SHA256
d176de3884899e94f7c82f1ad0b21e9f305d3d5d7d753cc701a880e01d692cad
-
SHA512
de5014a7fed0ab9d860bd53e8606010e00c519cf73574bee6186e13a9d9f657747a590ec7486ae5b6bc1765d76a123704e280dfcb99f8f621d5dae6cda9355df
Malware Config
Extracted
xloader
2.5
46uq
http://www.liberia-infos.net/46uq/
beardeddentguy.com
envirobombs.com
mintbox.pro
xiangpusun.com
pyjama-france.com
mendocinocountylive.com
innovativepropsolutions.com
hpsaddlerock.com
qrmaindonesia.com
liphelp.com
archaeaenergy.info
18446744073709551615.com
littlecreekacresri.com
elderlycareacademy.com
drshivanieyecare.com
ashibumi.com
stevenalexandergolf.com
adoratv.net
visitnewrichmond.com
fxbvanpool.com
aarondecker.online
environmentalkivul.com
cardsncrepes.com
hopdongdientu-viettel.com
thebroughtguarantee.com
howtofindahotniche.com
1678600.win
pityana.com
akconsultoria.com
markazkreasindo.com
ronniecapitol.com
tailsontour.com
abros88.com
laboratoriodentaltj.com
fuckingmom86.xyz
5pz59.com
centralmadu.com
ispecwar.com
otetransportanddispatching.com
cartaovirtual.net
hsadmin.xyz
xn--12c2bed4dxay5cxdh1s.online
oki-net.com
scenekidfancams.com
preciousmugs.com
754711.com
helpigservices.com
blueharepress.com
xmshzs.com
lovelycharlestonhomes.com
wamhsh.com
burlesquercize.com
oppoexch.com
ditjai.tech
the-hausd-group.com
loosebland.website
syntheticloot.net
gzfusco.com
www-by.com
farraztravel.com
beheld3d.art
douyababy.space
elcuerpohumano.xyz
3soap.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/804-67-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/804-68-0x000000000041D4B0-mapping.dmp xloader behavioral1/memory/804-76-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1180-82-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Jayaswal Neco Industries - Products List & document.exeJayaswal Neco Industries - Products List & document.execontrol.exedescription pid process target process PID 592 set thread context of 804 592 Jayaswal Neco Industries - Products List & document.exe Jayaswal Neco Industries - Products List & document.exe PID 804 set thread context of 1412 804 Jayaswal Neco Industries - Products List & document.exe Explorer.EXE PID 804 set thread context of 1412 804 Jayaswal Neco Industries - Products List & document.exe Explorer.EXE PID 1180 set thread context of 1412 1180 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
Jayaswal Neco Industries - Products List & document.exeJayaswal Neco Industries - Products List & document.exepowershell.execontrol.exepid process 592 Jayaswal Neco Industries - Products List & document.exe 592 Jayaswal Neco Industries - Products List & document.exe 592 Jayaswal Neco Industries - Products List & document.exe 592 Jayaswal Neco Industries - Products List & document.exe 592 Jayaswal Neco Industries - Products List & document.exe 592 Jayaswal Neco Industries - Products List & document.exe 592 Jayaswal Neco Industries - Products List & document.exe 804 Jayaswal Neco Industries - Products List & document.exe 648 powershell.exe 804 Jayaswal Neco Industries - Products List & document.exe 804 Jayaswal Neco Industries - Products List & document.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe 1180 control.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Jayaswal Neco Industries - Products List & document.execontrol.exepid process 804 Jayaswal Neco Industries - Products List & document.exe 804 Jayaswal Neco Industries - Products List & document.exe 804 Jayaswal Neco Industries - Products List & document.exe 804 Jayaswal Neco Industries - Products List & document.exe 1180 control.exe 1180 control.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Jayaswal Neco Industries - Products List & document.exepowershell.exeJayaswal Neco Industries - Products List & document.execontrol.exedescription pid process Token: SeDebugPrivilege 592 Jayaswal Neco Industries - Products List & document.exe Token: SeDebugPrivilege 648 powershell.exe Token: SeDebugPrivilege 804 Jayaswal Neco Industries - Products List & document.exe Token: SeDebugPrivilege 1180 control.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Jayaswal Neco Industries - Products List & document.exeExplorer.EXEdescription pid process target process PID 592 wrote to memory of 648 592 Jayaswal Neco Industries - Products List & document.exe powershell.exe PID 592 wrote to memory of 648 592 Jayaswal Neco Industries - Products List & document.exe powershell.exe PID 592 wrote to memory of 648 592 Jayaswal Neco Industries - Products List & document.exe powershell.exe PID 592 wrote to memory of 648 592 Jayaswal Neco Industries - Products List & document.exe powershell.exe PID 592 wrote to memory of 1824 592 Jayaswal Neco Industries - Products List & document.exe schtasks.exe PID 592 wrote to memory of 1824 592 Jayaswal Neco Industries - Products List & document.exe schtasks.exe PID 592 wrote to memory of 1824 592 Jayaswal Neco Industries - Products List & document.exe schtasks.exe PID 592 wrote to memory of 1824 592 Jayaswal Neco Industries - Products List & document.exe schtasks.exe PID 592 wrote to memory of 804 592 Jayaswal Neco Industries - Products List & document.exe Jayaswal Neco Industries - Products List & document.exe PID 592 wrote to memory of 804 592 Jayaswal Neco Industries - Products List & document.exe Jayaswal Neco Industries - Products List & document.exe PID 592 wrote to memory of 804 592 Jayaswal Neco Industries - Products List & document.exe Jayaswal Neco Industries - Products List & document.exe PID 592 wrote to memory of 804 592 Jayaswal Neco Industries - Products List & document.exe Jayaswal Neco Industries - Products List & document.exe PID 592 wrote to memory of 804 592 Jayaswal Neco Industries - Products List & document.exe Jayaswal Neco Industries - Products List & document.exe PID 592 wrote to memory of 804 592 Jayaswal Neco Industries - Products List & document.exe Jayaswal Neco Industries - Products List & document.exe PID 592 wrote to memory of 804 592 Jayaswal Neco Industries - Products List & document.exe Jayaswal Neco Industries - Products List & document.exe PID 1412 wrote to memory of 1180 1412 Explorer.EXE control.exe PID 1412 wrote to memory of 1180 1412 Explorer.EXE control.exe PID 1412 wrote to memory of 1180 1412 Explorer.EXE control.exe PID 1412 wrote to memory of 1180 1412 Explorer.EXE control.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Jayaswal Neco Industries - Products List & document.exe"C:\Users\Admin\AppData\Local\Temp\Jayaswal Neco Industries - Products List & document.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AmaSrePPk.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AmaSrePPk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB0B9.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Jayaswal Neco Industries - Products List & document.exe"C:\Users\Admin\AppData\Local\Temp\Jayaswal Neco Industries - Products List & document.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB0B9.tmpMD5
06583d9e4097e41c6ba3f068726cf146
SHA17aa35e62904663b5b5cc0e88bb671ef00de8a93a
SHA256f544963e77e09ad4043dbf9a2e99f91d9ae5260033bc9c8e2e5a72bc0372409b
SHA512b75d53b0de305a276d27cbe3b39e4a7059a01f28fc4bdfdbea700dc10d86f87678bf12399fde252e4334a198b55e81ef994e08d6489b7105ec97690892e1056e
-
memory/592-57-0x0000000075C51000-0x0000000075C53000-memory.dmpFilesize
8KB
-
memory/592-58-0x00000000049D0000-0x00000000049D1000-memory.dmpFilesize
4KB
-
memory/592-59-0x0000000000450000-0x0000000000457000-memory.dmpFilesize
28KB
-
memory/592-60-0x0000000005F40000-0x0000000006056000-memory.dmpFilesize
1.1MB
-
memory/592-55-0x0000000000E00000-0x0000000000E01000-memory.dmpFilesize
4KB
-
memory/648-70-0x00000000022E0000-0x0000000002F2A000-memory.dmpFilesize
12.3MB
-
memory/648-61-0x0000000000000000-mapping.dmp
-
memory/648-72-0x00000000022E0000-0x0000000002F2A000-memory.dmpFilesize
12.3MB
-
memory/648-71-0x00000000022E0000-0x0000000002F2A000-memory.dmpFilesize
12.3MB
-
memory/804-76-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/804-77-0x0000000000290000-0x00000000002A1000-memory.dmpFilesize
68KB
-
memory/804-67-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/804-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/804-65-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/804-73-0x0000000000830000-0x0000000000B33000-memory.dmpFilesize
3.0MB
-
memory/804-74-0x0000000000240000-0x0000000000251000-memory.dmpFilesize
68KB
-
memory/804-68-0x000000000041D4B0-mapping.dmp
-
memory/1180-79-0x0000000000000000-mapping.dmp
-
memory/1180-81-0x0000000000E00000-0x0000000000E1F000-memory.dmpFilesize
124KB
-
memory/1180-82-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1180-83-0x0000000000AE0000-0x0000000000DE3000-memory.dmpFilesize
3.0MB
-
memory/1180-84-0x0000000000980000-0x0000000000A10000-memory.dmpFilesize
576KB
-
memory/1412-75-0x0000000004EE0000-0x0000000004FFC000-memory.dmpFilesize
1.1MB
-
memory/1412-78-0x0000000004350000-0x000000000440B000-memory.dmpFilesize
748KB
-
memory/1412-85-0x00000000051F0000-0x00000000052B5000-memory.dmpFilesize
788KB
-
memory/1824-62-0x0000000000000000-mapping.dmp