Analysis
-
max time kernel
158s -
max time network
163s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-01-2022 23:59
Static task
static1
Behavioral task
behavioral1
Sample
SKM-0614483-pdf.exe
Resource
win7-en-20211208
General
-
Target
SKM-0614483-pdf.exe
-
Size
303KB
-
MD5
71899e3fb25c4c006de92ee2d13471c4
-
SHA1
181e3f00b56afdf6a51a90011fee175dc80e94d5
-
SHA256
2838dffa365f3f4d1b7b4c766cea66dc2be629fe7991c112894a40acae72e601
-
SHA512
287b884a2f261b04f3959efaaffd7efb0019b063dc7a62a610c84268f8ed7735af28277eea2451c67d653fcc08086a945a07e1ed0016f216feadd60b79df2214
Malware Config
Extracted
xloader
2.5
uar3
sgadvocats.com
mjscannabus.com
hilldaley.com
ksdollhouse.com
hotgiftboutique.com
purebloodsmeet.com
relaunched.info
cap-glove.com
productcollection.store
fulikyy.xyz
remoteaviationjobs.com
bestcleancrystal.com
virtualorganizationpartner.com
bookgocar.com
hattuafhv.quest
makonigroup.com
officecom-myaccount.com
malgorzata-lac.com
e-learningeducators.com
hygilaur.com
kgv-lachswehr.com
salazarcomunicacion.com
robopython.com
corporateequity.online
complianceservicegroup.com
aperza-ex.com
webflowusa.com
asesoriasfinancieras.xyz
missolivesbranches.com
numiquest.com
criskconsultancy.com
gotemup.com
themaptalk.com
lakebalboahalf.com
cateringfrenchcroissant.com
paddocklakerealestate.com
lojaquerosurprezza.store
courtneywhitearmusic.com
geovannimaquinadevendas.online
pricklypairjazz.com
engagedigi.com
conduitforthespirit.com
anaheimaletrail.com
wholesalemall.store
alertsbecu.com
gestion-kayfra.com
youcanstores.com
qsuo.net
formadv.info
dihesia.xyz
carrreir.com
twenteeminuteswithtee.com
realliferenewal.com
officialprokodsukses.icu
stanfordgrouploscabos.com
maxicashpromir.xyz
zysqshjs.com
trc-clicks.com
chsclbd.com
amdproduce.net
republicoflies.com
beaux-parents.com
lucrativeapp.com
milbombas.com
alexanderplaywear.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1172-57-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1172-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/980-67-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 272 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
SKM-0614483-pdf.exepid process 1564 SKM-0614483-pdf.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SKM-0614483-pdf.exeSKM-0614483-pdf.execolorcpl.exedescription pid process target process PID 1564 set thread context of 1172 1564 SKM-0614483-pdf.exe SKM-0614483-pdf.exe PID 1172 set thread context of 1220 1172 SKM-0614483-pdf.exe Explorer.EXE PID 1172 set thread context of 1220 1172 SKM-0614483-pdf.exe Explorer.EXE PID 980 set thread context of 1220 980 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
SKM-0614483-pdf.execolorcpl.exepid process 1172 SKM-0614483-pdf.exe 1172 SKM-0614483-pdf.exe 1172 SKM-0614483-pdf.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe 980 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
SKM-0614483-pdf.execolorcpl.exepid process 1172 SKM-0614483-pdf.exe 1172 SKM-0614483-pdf.exe 1172 SKM-0614483-pdf.exe 1172 SKM-0614483-pdf.exe 980 colorcpl.exe 980 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SKM-0614483-pdf.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1172 SKM-0614483-pdf.exe Token: SeDebugPrivilege 980 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
SKM-0614483-pdf.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1564 wrote to memory of 1172 1564 SKM-0614483-pdf.exe SKM-0614483-pdf.exe PID 1564 wrote to memory of 1172 1564 SKM-0614483-pdf.exe SKM-0614483-pdf.exe PID 1564 wrote to memory of 1172 1564 SKM-0614483-pdf.exe SKM-0614483-pdf.exe PID 1564 wrote to memory of 1172 1564 SKM-0614483-pdf.exe SKM-0614483-pdf.exe PID 1564 wrote to memory of 1172 1564 SKM-0614483-pdf.exe SKM-0614483-pdf.exe PID 1564 wrote to memory of 1172 1564 SKM-0614483-pdf.exe SKM-0614483-pdf.exe PID 1564 wrote to memory of 1172 1564 SKM-0614483-pdf.exe SKM-0614483-pdf.exe PID 1220 wrote to memory of 980 1220 Explorer.EXE colorcpl.exe PID 1220 wrote to memory of 980 1220 Explorer.EXE colorcpl.exe PID 1220 wrote to memory of 980 1220 Explorer.EXE colorcpl.exe PID 1220 wrote to memory of 980 1220 Explorer.EXE colorcpl.exe PID 980 wrote to memory of 272 980 colorcpl.exe cmd.exe PID 980 wrote to memory of 272 980 colorcpl.exe cmd.exe PID 980 wrote to memory of 272 980 colorcpl.exe cmd.exe PID 980 wrote to memory of 272 980 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKM-0614483-pdf.exe"C:\Users\Admin\AppData\Local\Temp\SKM-0614483-pdf.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SKM-0614483-pdf.exe"C:\Users\Admin\AppData\Local\Temp\SKM-0614483-pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SKM-0614483-pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsoF182.tmp\ldvaswswcl.dllMD5
411c4d7b3e01e5c24b3513d544dbd037
SHA15a2cd1b89fe855798a07cfdc3b275a95c1661f8f
SHA2562f7226553a30b70c6a343b5e036fbfb82949c42d9371294456239bbfed878e84
SHA512348f048b6c132ad2463efcfb290490b643b0b7ffaedd0f23778fcefe306db2354039bfc1734ad5e8126bafddd952c9b7c7a1fffac39737cec49ff638e0f54950
-
memory/980-66-0x0000000000AF0000-0x0000000000B08000-memory.dmpFilesize
96KB
-
memory/980-69-0x00000000008F0000-0x0000000000980000-memory.dmpFilesize
576KB
-
memory/980-68-0x00000000020A0000-0x00000000023A3000-memory.dmpFilesize
3.0MB
-
memory/980-67-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1172-59-0x00000000008A0000-0x0000000000BA3000-memory.dmpFilesize
3.0MB
-
memory/1172-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1172-63-0x0000000000390000-0x00000000003A1000-memory.dmpFilesize
68KB
-
memory/1172-60-0x0000000000340000-0x0000000000351000-memory.dmpFilesize
68KB
-
memory/1172-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1220-64-0x0000000005020000-0x0000000005157000-memory.dmpFilesize
1.2MB
-
memory/1220-61-0x0000000004D60000-0x0000000004EAD000-memory.dmpFilesize
1.3MB
-
memory/1220-70-0x0000000004AD0000-0x0000000004BBC000-memory.dmpFilesize
944KB
-
memory/1564-55-0x00000000756C1000-0x00000000756C3000-memory.dmpFilesize
8KB