Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
21-01-2022 11:09
Static task
static1
Behavioral task
behavioral1
Sample
cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe
Resource
win10v2004-en-20220112
General
-
Target
cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe
-
Size
555KB
-
MD5
e652e263f71c1c50220920a46c9b420e
-
SHA1
08379f562329d48fe67b0f4e7ee4ad37a0b97924
-
SHA256
cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6
-
SHA512
8a622158d7d2114b4ff80e73058755582d6b641b347f867499a1c2163d9e9dbab5071fd44d975cda74ac4b35542f2bc9fdc8cb68551296c75251e395ce3f8309
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2856-131-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Sets service image path in registry 2 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exepid process 1508 cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exedescription pid process target process PID 1508 set thread context of 2856 1508 cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 41 IoCs
Processes:
WaaSMedicAgent.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exepid process 2856 cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe 2856 cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exedescription pid process target process PID 1508 wrote to memory of 2856 1508 cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe PID 1508 wrote to memory of 2856 1508 cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe PID 1508 wrote to memory of 2856 1508 cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe PID 1508 wrote to memory of 2856 1508 cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe PID 1508 wrote to memory of 2856 1508 cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe PID 1508 wrote to memory of 2856 1508 cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe"C:\Users\Admin\AppData\Local\Temp\cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe"C:\Users\Admin\AppData\Local\Temp\cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2856
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 574d201a7eeaecd17057220df3bf9969 RWGapqQJXUmI82HiKDCt2g.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3392
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵PID:1512
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsgB35C.tmp\lsjtl.dllMD5
aeba88fedc5242964243789b0452de7c
SHA15467c97a667d0751eb59b59408ff74ff649cb42e
SHA2566a0a8136977732a180d9e9b85a82567167d2a0443461305b53211ea511bb48fe
SHA5128e09421857a14f5ccf73e57a8d6cd79b85d89eade295a1bf82fa819834f03fcaa2c729a047b0f27dcc1cae743d6687b7c3080fc6f531f55fbc81928568c924d7
-
memory/2856-131-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB