Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 11:21
Static task
static1
Behavioral task
behavioral1
Sample
0becd341e0585b0c5a278e62a9727a9a.exe
Resource
win7-en-20211208
General
-
Target
0becd341e0585b0c5a278e62a9727a9a.exe
-
Size
845KB
-
MD5
0becd341e0585b0c5a278e62a9727a9a
-
SHA1
71b8b08ab44bb93a2bacb3948a8dee5273f78488
-
SHA256
ee5dd80f9946c3b8221409e1aed242cd36a8188850718f89722b48404906275e
-
SHA512
9edfca50d1ebe082bd13ba32de078bca96a06c8bf18b56471f12adfd3a05830eb821f5ce26404d1e2bea48b3dda3b74b06ae3f4922de2c1842f17329173a1cb9
Malware Config
Extracted
xloader
2.5
nt3f
tricyclee.com
kxsw999.com
wisteria-pavilion.com
bellaclancy.com
promissioskincare.com
hzy001.xyz
checkouthomehd.com
soladere.com
point4sales.com
socalmafia.com
libertadysarmiento.online
nftthirty.com
digitalgoldcryptostock.net
tulekiloscaird.com
austinfishandchicken.com
wlxxch.com
mgav51.xyz
landbanking.global
saprove.com
babyfaces.skin
elainemaxwellcoaching.com
1388xc.com
juveniscloud.com
bsauksjon.com
the-waterkooler.com
comment-changer-sa-vie.com
psmcnd.top
rhodesleadingedge.com
mccuelawfirm.com
skinnscience.club
hype-clicks.com
liaojinc.xyz
okmakers.com
ramblertour.online
wickedhunterworld.com
fit-threads.com
cookidoo.website
magentabin.com
pynch1.com
best-paper-to-know-today.info
allmight.net
monicraftsprintables.com
avataroasis.com
10dian-4.com
cozastore.net
capitalcased.com
spacezanome.xyz
feiyangmi.com
11opus.com
getinteriorsolution.com
tidyhutstore.com
amazingpomskyfamily.com
tfcvintage.com
halfanape.com
rotakb.com
martinasfood.com
the-thanks.com
mithilmehta.com
em-photo.art
primerepro.com
lankasirinspa.com
gtbaibang.com
zealandiatobacco.com
deepikatransportpackers.com
eagle-meter.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1472-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
0becd341e0585b0c5a278e62a9727a9a.exedescription pid process target process PID 764 set thread context of 1472 764 0becd341e0585b0c5a278e62a9727a9a.exe 0becd341e0585b0c5a278e62a9727a9a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0becd341e0585b0c5a278e62a9727a9a.exepowershell.exepid process 1472 0becd341e0585b0c5a278e62a9727a9a.exe 1272 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1272 powershell.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
0becd341e0585b0c5a278e62a9727a9a.exedescription pid process target process PID 764 wrote to memory of 1272 764 0becd341e0585b0c5a278e62a9727a9a.exe powershell.exe PID 764 wrote to memory of 1272 764 0becd341e0585b0c5a278e62a9727a9a.exe powershell.exe PID 764 wrote to memory of 1272 764 0becd341e0585b0c5a278e62a9727a9a.exe powershell.exe PID 764 wrote to memory of 1272 764 0becd341e0585b0c5a278e62a9727a9a.exe powershell.exe PID 764 wrote to memory of 1388 764 0becd341e0585b0c5a278e62a9727a9a.exe schtasks.exe PID 764 wrote to memory of 1388 764 0becd341e0585b0c5a278e62a9727a9a.exe schtasks.exe PID 764 wrote to memory of 1388 764 0becd341e0585b0c5a278e62a9727a9a.exe schtasks.exe PID 764 wrote to memory of 1388 764 0becd341e0585b0c5a278e62a9727a9a.exe schtasks.exe PID 764 wrote to memory of 1472 764 0becd341e0585b0c5a278e62a9727a9a.exe 0becd341e0585b0c5a278e62a9727a9a.exe PID 764 wrote to memory of 1472 764 0becd341e0585b0c5a278e62a9727a9a.exe 0becd341e0585b0c5a278e62a9727a9a.exe PID 764 wrote to memory of 1472 764 0becd341e0585b0c5a278e62a9727a9a.exe 0becd341e0585b0c5a278e62a9727a9a.exe PID 764 wrote to memory of 1472 764 0becd341e0585b0c5a278e62a9727a9a.exe 0becd341e0585b0c5a278e62a9727a9a.exe PID 764 wrote to memory of 1472 764 0becd341e0585b0c5a278e62a9727a9a.exe 0becd341e0585b0c5a278e62a9727a9a.exe PID 764 wrote to memory of 1472 764 0becd341e0585b0c5a278e62a9727a9a.exe 0becd341e0585b0c5a278e62a9727a9a.exe PID 764 wrote to memory of 1472 764 0becd341e0585b0c5a278e62a9727a9a.exe 0becd341e0585b0c5a278e62a9727a9a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0becd341e0585b0c5a278e62a9727a9a.exe"C:\Users\Admin\AppData\Local\Temp\0becd341e0585b0c5a278e62a9727a9a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\szzAArbkCRJS.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\szzAArbkCRJS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB348.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\0becd341e0585b0c5a278e62a9727a9a.exe"C:\Users\Admin\AppData\Local\Temp\0becd341e0585b0c5a278e62a9727a9a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB348.tmpMD5
9a8a6c206e28beeb0dbf5619e1966729
SHA10c39ee7ae394fac37cfc287a163ee2be4e53b820
SHA2560e58ed3a4b60c772eab5b12daa73e5aa5fb88d24ab2697ef5750d246e97ddacc
SHA512397ac407e5e2bd0bdae3bd6a073a9daadfdc7828f98a1fa6c4de3e3a82ebe70779869bbbff5e16369f547a8852170b61049d11943f27c1a23fadc3c41f08868a
-
memory/764-56-0x0000000001FF0000-0x0000000001FFE000-memory.dmpFilesize
56KB
-
memory/764-55-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/764-53-0x0000000000260000-0x000000000033A000-memory.dmpFilesize
872KB
-
memory/764-57-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/764-58-0x00000000055E0000-0x000000000568A000-memory.dmpFilesize
680KB
-
memory/764-54-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/1272-64-0x0000000002450000-0x000000000309A000-memory.dmpFilesize
12.3MB
-
memory/1272-66-0x0000000002450000-0x000000000309A000-memory.dmpFilesize
12.3MB
-
memory/1272-67-0x0000000002450000-0x000000000309A000-memory.dmpFilesize
12.3MB
-
memory/1472-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1472-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1472-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1472-65-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB