Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 11:32
Static task
static1
Behavioral task
behavioral1
Sample
ee0a3d31b64011310ae0a4fde697aa25.exe
Resource
win7-en-20211208
General
-
Target
ee0a3d31b64011310ae0a4fde697aa25.exe
-
Size
441KB
-
MD5
ee0a3d31b64011310ae0a4fde697aa25
-
SHA1
5d9fd5352b9e0f268cd495d2061e31c9fada2c53
-
SHA256
a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3
-
SHA512
2ee81b14384fded53344ce3501d30188b65d7ffa94ca54cb57ff5c291db9dc8334760ebc4735da3a0ecae3fa89bc40841064918aac738eee5b1b9943426ac8f4
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/952-57-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
ee0a3d31b64011310ae0a4fde697aa25.exepid process 304 ee0a3d31b64011310ae0a4fde697aa25.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ee0a3d31b64011310ae0a4fde697aa25.exedescription pid process target process PID 304 set thread context of 952 304 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ee0a3d31b64011310ae0a4fde697aa25.exepid process 952 ee0a3d31b64011310ae0a4fde697aa25.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
ee0a3d31b64011310ae0a4fde697aa25.exedescription pid process target process PID 304 wrote to memory of 952 304 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe PID 304 wrote to memory of 952 304 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe PID 304 wrote to memory of 952 304 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe PID 304 wrote to memory of 952 304 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe PID 304 wrote to memory of 952 304 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe PID 304 wrote to memory of 952 304 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe PID 304 wrote to memory of 952 304 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:304 -
C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:952
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsoECB2.tmp\ltnehpemyq.dllMD5
4438b2bb74143e0dc75d88ff3cf9c3c6
SHA19bf6b14d33509bfbf10d967812857728595a5d8e
SHA2565b870a41f4559e86d3f3d0cec40364a6bd8aa606d044ade4f7d488f714523751
SHA512fed4113ec2d28c9f9aa8c04524fa1f4d803189edcecda9743ae8550fa28e6ff92d1247466e2bf420622812cf238e8be4cf61eb5f9768f578c7de5a0101c285ef
-
memory/304-55-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/952-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/952-58-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB