Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 11:32
Static task
static1
Behavioral task
behavioral1
Sample
ee0a3d31b64011310ae0a4fde697aa25.exe
Resource
win7-en-20211208
General
-
Target
ee0a3d31b64011310ae0a4fde697aa25.exe
-
Size
441KB
-
MD5
ee0a3d31b64011310ae0a4fde697aa25
-
SHA1
5d9fd5352b9e0f268cd495d2061e31c9fada2c53
-
SHA256
a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3
-
SHA512
2ee81b14384fded53344ce3501d30188b65d7ffa94ca54cb57ff5c291db9dc8334760ebc4735da3a0ecae3fa89bc40841064918aac738eee5b1b9943426ac8f4
Malware Config
Extracted
xloader
2.5
pnug
natureate.com
ita-pots.website
sucohansmushroom.com
produrielrosen.com
gosystemupdatenow.online
jiskra.art
janwiench.com
norfolkfoodhall.com
iloveaddictss.com
pogozip.com
buyinstapva.com
teardirectionfreedom.xyz
0205168.com
apaixonadosporpugs.online
jawscoinc.com
crafter.quest
wikipedianow.com
radiopuls.net
kendama-co.com
goodstudycanada.com
huzhoucs.com
asinment.com
fuchsundrudolph.com
arthurenathalia.com
globalcosmeticsstudios.com
brandrackley.com
freemanhub.one
utserver.online
fullspecter.com
wshowcase.com
airjordanshoes-retro.com
linguimatics.com
app-verlengen.icu
singpost.red
j4.claims
inoteapp.net
jrdautomotivellc.com
xn--beaupre-6xa.com
mypolicyportal.net
wdgjdhpg.com
anshulindla.com
m981070.com
vertentebike.com
claim-available.com
buyfudgybombs.com
adfnapoli.com
blackfuid.com
clambakedelivered.info
marketingworksonhold.com
xvyj.top
richardsonsfinest.com
gurimix.com
dorhop.com
mauigrowngreencoffee.net
juzytuu.xyz
pokorny.industries
floridapermitsolutions.com
right-on-target-store.com
ynaire.com
nextpar.com
disdrone.com
fruitfulvinebirth.com
africanfairytale.com
leisuresabah.com
safetyeats.asia
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1288-116-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
ee0a3d31b64011310ae0a4fde697aa25.exepid process 3336 ee0a3d31b64011310ae0a4fde697aa25.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ee0a3d31b64011310ae0a4fde697aa25.exedescription pid process target process PID 3336 set thread context of 1288 3336 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ee0a3d31b64011310ae0a4fde697aa25.exepid process 1288 ee0a3d31b64011310ae0a4fde697aa25.exe 1288 ee0a3d31b64011310ae0a4fde697aa25.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
ee0a3d31b64011310ae0a4fde697aa25.exedescription pid process target process PID 3336 wrote to memory of 1288 3336 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe PID 3336 wrote to memory of 1288 3336 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe PID 3336 wrote to memory of 1288 3336 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe PID 3336 wrote to memory of 1288 3336 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe PID 3336 wrote to memory of 1288 3336 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe PID 3336 wrote to memory of 1288 3336 ee0a3d31b64011310ae0a4fde697aa25.exe ee0a3d31b64011310ae0a4fde697aa25.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsj2614.tmp\ltnehpemyq.dllMD5
4438b2bb74143e0dc75d88ff3cf9c3c6
SHA19bf6b14d33509bfbf10d967812857728595a5d8e
SHA2565b870a41f4559e86d3f3d0cec40364a6bd8aa606d044ade4f7d488f714523751
SHA512fed4113ec2d28c9f9aa8c04524fa1f4d803189edcecda9743ae8550fa28e6ff92d1247466e2bf420622812cf238e8be4cf61eb5f9768f578c7de5a0101c285ef
-
memory/1288-116-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1288-117-0x0000000000A20000-0x0000000000D40000-memory.dmpFilesize
3.1MB