Analysis
-
max time kernel
111s -
max time network
142s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 08:10
Static task
static1
General
-
Target
a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe
-
Size
441KB
-
MD5
ee0a3d31b64011310ae0a4fde697aa25
-
SHA1
5d9fd5352b9e0f268cd495d2061e31c9fada2c53
-
SHA256
a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3
-
SHA512
2ee81b14384fded53344ce3501d30188b65d7ffa94ca54cb57ff5c291db9dc8334760ebc4735da3a0ecae3fa89bc40841064918aac738eee5b1b9943426ac8f4
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4084-119-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exepid process 2668 a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exedescription pid process target process PID 2668 set thread context of 4084 2668 a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exepid process 4084 a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe 4084 a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exedescription pid process target process PID 2668 wrote to memory of 4084 2668 a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe PID 2668 wrote to memory of 4084 2668 a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe PID 2668 wrote to memory of 4084 2668 a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe PID 2668 wrote to memory of 4084 2668 a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe PID 2668 wrote to memory of 4084 2668 a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe PID 2668 wrote to memory of 4084 2668 a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe"C:\Users\Admin\AppData\Local\Temp\a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe"C:\Users\Admin\AppData\Local\Temp\a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsrD3ED.tmp\ltnehpemyq.dllMD5
4438b2bb74143e0dc75d88ff3cf9c3c6
SHA19bf6b14d33509bfbf10d967812857728595a5d8e
SHA2565b870a41f4559e86d3f3d0cec40364a6bd8aa606d044ade4f7d488f714523751
SHA512fed4113ec2d28c9f9aa8c04524fa1f4d803189edcecda9743ae8550fa28e6ff92d1247466e2bf420622812cf238e8be4cf61eb5f9768f578c7de5a0101c285ef
-
memory/4084-119-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4084-120-0x0000000000AB0000-0x0000000000DD0000-memory.dmpFilesize
3.1MB