Analysis
-
max time kernel
119s -
max time network
134s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-01-2022 11:33
Static task
static1
Behavioral task
behavioral1
Sample
e652e263f71c1c50220920a46c9b420e.exe
Resource
win7-en-20211208
General
-
Target
e652e263f71c1c50220920a46c9b420e.exe
-
Size
555KB
-
MD5
e652e263f71c1c50220920a46c9b420e
-
SHA1
08379f562329d48fe67b0f4e7ee4ad37a0b97924
-
SHA256
cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6
-
SHA512
8a622158d7d2114b4ff80e73058755582d6b641b347f867499a1c2163d9e9dbab5071fd44d975cda74ac4b35542f2bc9fdc8cb68551296c75251e395ce3f8309
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/672-56-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
e652e263f71c1c50220920a46c9b420e.exepid process 1624 e652e263f71c1c50220920a46c9b420e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e652e263f71c1c50220920a46c9b420e.exedescription pid process target process PID 1624 set thread context of 672 1624 e652e263f71c1c50220920a46c9b420e.exe e652e263f71c1c50220920a46c9b420e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
e652e263f71c1c50220920a46c9b420e.exepid process 672 e652e263f71c1c50220920a46c9b420e.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
e652e263f71c1c50220920a46c9b420e.exedescription pid process target process PID 1624 wrote to memory of 672 1624 e652e263f71c1c50220920a46c9b420e.exe e652e263f71c1c50220920a46c9b420e.exe PID 1624 wrote to memory of 672 1624 e652e263f71c1c50220920a46c9b420e.exe e652e263f71c1c50220920a46c9b420e.exe PID 1624 wrote to memory of 672 1624 e652e263f71c1c50220920a46c9b420e.exe e652e263f71c1c50220920a46c9b420e.exe PID 1624 wrote to memory of 672 1624 e652e263f71c1c50220920a46c9b420e.exe e652e263f71c1c50220920a46c9b420e.exe PID 1624 wrote to memory of 672 1624 e652e263f71c1c50220920a46c9b420e.exe e652e263f71c1c50220920a46c9b420e.exe PID 1624 wrote to memory of 672 1624 e652e263f71c1c50220920a46c9b420e.exe e652e263f71c1c50220920a46c9b420e.exe PID 1624 wrote to memory of 672 1624 e652e263f71c1c50220920a46c9b420e.exe e652e263f71c1c50220920a46c9b420e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e652e263f71c1c50220920a46c9b420e.exe"C:\Users\Admin\AppData\Local\Temp\e652e263f71c1c50220920a46c9b420e.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e652e263f71c1c50220920a46c9b420e.exe"C:\Users\Admin\AppData\Local\Temp\e652e263f71c1c50220920a46c9b420e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsyEEC4.tmp\lsjtl.dllMD5
aeba88fedc5242964243789b0452de7c
SHA15467c97a667d0751eb59b59408ff74ff649cb42e
SHA2566a0a8136977732a180d9e9b85a82567167d2a0443461305b53211ea511bb48fe
SHA5128e09421857a14f5ccf73e57a8d6cd79b85d89eade295a1bf82fa819834f03fcaa2c729a047b0f27dcc1cae743d6687b7c3080fc6f531f55fbc81928568c924d7
-
memory/672-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/672-57-0x0000000000830000-0x0000000000B33000-memory.dmpFilesize
3.0MB
-
memory/1624-54-0x0000000076C61000-0x0000000076C63000-memory.dmpFilesize
8KB