Analysis
-
max time kernel
112s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
21-01-2022 11:09
Static task
static1
Behavioral task
behavioral1
Sample
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe
Resource
win10v2004-en-20220112
General
-
Target
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe
-
Size
324KB
-
MD5
b1e0b1657595b806097a1529c2ae0620
-
SHA1
7cdd036a4769354e8a325c2231456187ee211cef
-
SHA256
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376
-
SHA512
f7c05ecd44b986eafc3e0ea9a9f1bdb785fee6e3538b25f79d567aebf666758be0a2583123d061a74cf8325d39a3422dd2390d405d5f215a6ebb5852e3a15243
Malware Config
Extracted
xloader
2.5
u6vb
blendedmatter.com
piquinmarketing.com
dubkirelax.online
optimumotoaksesuar.com
bendisle.com
islamicgeometricpatterns.net
cheesebox.online
lh-coaching.com
buildingmaterial.info
backwoods72.com
goodtreetee.com
zknqqpvsypx.mobi
phukienstreaming.com
turkistick.com
cbd-shop-portugal.com
imherllc.com
krallechols.quest
ttmmb.com
pornmodelsworld.com
weakyummy.space
profitablemechanic.com
arthahomehealth.com
xllbyte.top
enthrallingmagazine.com
letgoboss.com
twaroggrodkowski.com
2027bet365.com
viveecom.com
rachelzrileybeauty.com
jadablond.com
mypasscodekeycard.com
sectionpor.xyz
hypotheque.xyz
matryoshkatechspec.online
newspaper.tax
jm0513.com
barringtonmediaqroup.com
mot-associates.com
mahomeslistings.com
henrywrench.com
anita.digital
leyouxx.com
icetherapy.net
nft-premium.design
vulcanrussia23.xyz
cvbintangkaryacipta.com
ballerapeclub.digital
coralarray.com
quoteshtx.com
thebestgpstracker.com
onlinepricehk.com
mountainvillagecondos.com
thenudefactory.com
rubarombic.net
theroycom1.com
drinkabit.art
maymakita.com
pickvector.net
online-be.xyz
monkendodge.com
successsynergyemail.com
cuahangyodykimthanh.com
love-shoppy.com
gebaeudetechnik-burscheid.com
officejava.store
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1812-134-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Sets service image path in registry 2 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exepid process 4064 adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exedescription pid process target process PID 4064 set thread context of 1812 4064 adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exepid process 1812 adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe 1812 adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exedescription pid process target process PID 4064 wrote to memory of 1812 4064 adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe PID 4064 wrote to memory of 1812 4064 adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe PID 4064 wrote to memory of 1812 4064 adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe PID 4064 wrote to memory of 1812 4064 adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe PID 4064 wrote to memory of 1812 4064 adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe PID 4064 wrote to memory of 1812 4064 adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe"C:\Users\Admin\AppData\Local\Temp\adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe"C:\Users\Admin\AppData\Local\Temp\adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 74e4d7d721e4810dc291e6c5dd95279d /fHnhOTCGk2FIQ1skF4/hw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsz1651.tmp\kgdqnmtp.dllMD5
0ded8be0940c363d4b85da0aef7bf396
SHA13a010b525bea9fa70bfcb2c24ae2a7c1afa24540
SHA256a373282700b60a07e656c8aec000d77996d53e8591819099a812c9633f597af2
SHA512c0184ca441846e67e8c005494a33b37bed6a79d073125d21a70e89cddabdec5994f6430920eaf00125a6675103d999ebe2d1470bf99c969898262665071b2047
-
memory/1812-134-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB