Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-01-2022 14:35
Static task
static1
Behavioral task
behavioral1
Sample
f8f21b42.exe
Resource
win7-en-20211208
General
-
Target
f8f21b42.exe
-
Size
307KB
-
MD5
823e2111b364480598e2c0030cc945c8
-
SHA1
bdb030ca0f699ebcf3ada6d5fd2fc51d53fc9d76
-
SHA256
f8f21b428732d4136df057f3ef06f9fdc47b29de832838dcd030ef55e0c31891
-
SHA512
e7274a90df675b29ab59b8e5c74082411eec7296630814075b9d12a3c15415957289c5d9691c695bb354c2159e569dfa71470998e2c1bc617baa293e44943d05
Malware Config
Extracted
xloader
2.5
dtt3
edilononlineshop.com
cursosd.com
viellacharteredland.com
increasey0urenergylevels.codes
yjy-hotel.com
claym.xyz
reelsguide.com
gives-cardano.com
ashrafannuar.com
mammalians.com
rocketleaguedads.com
yubierp.com
minimi36.com
chn-chn.com
jagojp888.com
parsian-shetab.com
273351.com
mdtouhid.com
babedads.com
vallinam2.com
buro-tic.com
az-rent.net
shifaebio.xyz
circuitoalberghiero.com
xn--b1afb9b.xn--p1acf
canlioyundasin.online
sachainchirajaomega.com
scandinest.com
pluky.net
tpxcy.com
nbg.global
automountproducts.com
hghbj.com
beachsidecoatings.com
householdertips.com
coworkingspace.online
doujyou.com
tenloe053.xyz
udpbkp.biz
kondanginyuk.online
zipiter.com
christiankrog.com
reliantrecruitinggroup.com
acrylicus.com
cruelgirls.biz
oeinsulation.com
mapnft.xyz
leadersfort.com
foodroutine.com
mayerohio.info
systemofsolutions.com
gideonajibike.com
bigboobz.net
townofis.com
mhkxlgs.com
sussaautocare.com
quicktle.com
boutiquedangel.com
garrisonroadhouse.com
stiff-pols.art
cabalaconsultores.com
theweddinggame.net
themoneymagicians.com
overtonesa.com
janasflannels.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3624-116-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3624-119-0x00000000007C0000-0x0000000000957000-memory.dmp xloader behavioral2/memory/2824-122-0x0000000001030000-0x0000000001059000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
f8f21b42.exepid process 3380 f8f21b42.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
f8f21b42.exef8f21b42.exenetsh.exedescription pid process target process PID 3380 set thread context of 3624 3380 f8f21b42.exe f8f21b42.exe PID 3624 set thread context of 2612 3624 f8f21b42.exe Explorer.EXE PID 2824 set thread context of 2612 2824 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
f8f21b42.exenetsh.exepid process 3624 f8f21b42.exe 3624 f8f21b42.exe 3624 f8f21b42.exe 3624 f8f21b42.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe 2824 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2612 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
f8f21b42.exenetsh.exepid process 3624 f8f21b42.exe 3624 f8f21b42.exe 3624 f8f21b42.exe 2824 netsh.exe 2824 netsh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f8f21b42.exenetsh.exedescription pid process Token: SeDebugPrivilege 3624 f8f21b42.exe Token: SeDebugPrivilege 2824 netsh.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
f8f21b42.exeExplorer.EXEnetsh.exedescription pid process target process PID 3380 wrote to memory of 3624 3380 f8f21b42.exe f8f21b42.exe PID 3380 wrote to memory of 3624 3380 f8f21b42.exe f8f21b42.exe PID 3380 wrote to memory of 3624 3380 f8f21b42.exe f8f21b42.exe PID 3380 wrote to memory of 3624 3380 f8f21b42.exe f8f21b42.exe PID 3380 wrote to memory of 3624 3380 f8f21b42.exe f8f21b42.exe PID 3380 wrote to memory of 3624 3380 f8f21b42.exe f8f21b42.exe PID 2612 wrote to memory of 2824 2612 Explorer.EXE netsh.exe PID 2612 wrote to memory of 2824 2612 Explorer.EXE netsh.exe PID 2612 wrote to memory of 2824 2612 Explorer.EXE netsh.exe PID 2824 wrote to memory of 3076 2824 netsh.exe cmd.exe PID 2824 wrote to memory of 3076 2824 netsh.exe cmd.exe PID 2824 wrote to memory of 3076 2824 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8f21b42.exe"C:\Users\Admin\AppData\Local\Temp\f8f21b42.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f8f21b42.exe"C:\Users\Admin\AppData\Local\Temp\f8f21b42.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\f8f21b42.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nskAA5C.tmp\dayetge.dllMD5
6c367de967d08e5a56ddf0802f26204a
SHA1975d2926553af44b0372204508d9aef2d2c71402
SHA256651c5d0de741458bb8a3786016481ca6f4e8b44e6991eeecb92b7f8d202394ef
SHA512cbfa3446a7220c602a17f9ec147c2e4c5fdda568d7b6081ddf76834b4095154e640d8e2d86b5d2741e8024a6ced21817281f8f05d9831cc2921c340a08fac53f
-
memory/2612-120-0x0000000000EB0000-0x0000000000FA0000-memory.dmpFilesize
960KB
-
memory/2612-125-0x00000000069D0000-0x0000000006B0E000-memory.dmpFilesize
1.2MB
-
memory/2824-121-0x0000000001160000-0x000000000117E000-memory.dmpFilesize
120KB
-
memory/2824-122-0x0000000001030000-0x0000000001059000-memory.dmpFilesize
164KB
-
memory/2824-123-0x0000000003960000-0x0000000003C80000-memory.dmpFilesize
3.1MB
-
memory/2824-124-0x0000000003620000-0x00000000037B3000-memory.dmpFilesize
1.6MB
-
memory/3624-116-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3624-118-0x0000000000960000-0x0000000000C80000-memory.dmpFilesize
3.1MB
-
memory/3624-119-0x00000000007C0000-0x0000000000957000-memory.dmpFilesize
1.6MB