Analysis
-
max time kernel
110s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
10-01-2022 01:46
Static task
static1
General
-
Target
20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe
-
Size
571KB
-
MD5
a4ee7cb1e68013d791f94e5670c3a00f
-
SHA1
12859e7917be6bba3b92f8eb2f729d0eb29a2b98
-
SHA256
20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2
-
SHA512
9876e3b7ec23fcc67eac318970e91cd4ff398292bfad03bc516b337bc0c24029a5e495db1c24600dd08af7cf0a25968cb8a3c2ab34db18fa110cbe06a1b520b7
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3692-116-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/3692-117-0x000000000041D400-mapping.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exepid process 3436 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exedescription pid process target process PID 3436 set thread context of 3692 3436 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exepid process 3692 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe 3692 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exedescription pid process target process PID 3436 wrote to memory of 3692 3436 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe PID 3436 wrote to memory of 3692 3436 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe PID 3436 wrote to memory of 3692 3436 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe PID 3436 wrote to memory of 3692 3436 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe PID 3436 wrote to memory of 3692 3436 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe PID 3436 wrote to memory of 3692 3436 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe 20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe"C:\Users\Admin\AppData\Local\Temp\20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe"C:\Users\Admin\AppData\Local\Temp\20d42969a8a5acbec5b7c64956f11fd5a880eacbe80f58aff49c8b34fcfa04c2.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nswA059.tmp\bvyicpbijv.dllMD5
6f8ea39964c4873cde63518883c822e9
SHA14c048416104c8d35e3802c6b0a85c8cfa8fcfd94
SHA2562b66b57ec615181addd9a7131b78e1fd77a7fa1de17744bd7b8efaa83e77f4a7
SHA512c0bcb64ac17bbb48572e668a2ee7a038ee78547aa47af0ebcc767241cf92415e7fde3d2529a0e91b0e5f3c4873fefad6f85789867c42af0504ee878e281b667f
-
memory/3692-116-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3692-117-0x000000000041D400-mapping.dmp
-
memory/3692-118-0x0000000000B50000-0x0000000000E70000-memory.dmpFilesize
3.1MB