Analysis
-
max time kernel
121s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
26-01-2022 13:38
Static task
static1
General
-
Target
ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe
-
Size
810KB
-
MD5
dc06649db7eafdb332b7d8f2adb2ebdd
-
SHA1
a1179b64bcc678631108c8b16ec297838e8499fb
-
SHA256
ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3
-
SHA512
7d1da393a50faf546cbc023183618254e82362bdaf88e88b21793b4c5279642f1418e1dfa0c4949c654aea38f2e8a91f6b6acc1b07dc0be7fcc25b939679ae50
Malware Config
Extracted
xloader
2.5
nt3f
tricyclee.com
kxsw999.com
wisteria-pavilion.com
bellaclancy.com
promissioskincare.com
hzy001.xyz
checkouthomehd.com
soladere.com
point4sales.com
socalmafia.com
libertadysarmiento.online
nftthirty.com
digitalgoldcryptostock.net
tulekiloscaird.com
austinfishandchicken.com
wlxxch.com
mgav51.xyz
landbanking.global
saprove.com
babyfaces.skin
elainemaxwellcoaching.com
1388xc.com
juveniscloud.com
bsauksjon.com
the-waterkooler.com
comment-changer-sa-vie.com
psmcnd.top
rhodesleadingedge.com
mccuelawfirm.com
skinnscience.club
hype-clicks.com
liaojinc.xyz
okmakers.com
ramblertour.online
wickedhunterworld.com
fit-threads.com
cookidoo.website
magentabin.com
pynch1.com
best-paper-to-know-today.info
allmight.net
monicraftsprintables.com
avataroasis.com
10dian-4.com
cozastore.net
capitalcased.com
spacezanome.xyz
feiyangmi.com
11opus.com
getinteriorsolution.com
tidyhutstore.com
amazingpomskyfamily.com
tfcvintage.com
halfanape.com
rotakb.com
martinasfood.com
the-thanks.com
mithilmehta.com
em-photo.art
primerepro.com
lankasirinspa.com
gtbaibang.com
zealandiatobacco.com
deepikatransportpackers.com
eagle-meter.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/708-127-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exedescription pid process target process PID 2708 set thread context of 708 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exeae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exepid process 496 powershell.exe 708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe 708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe 496 powershell.exe 496 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 496 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exedescription pid process target process PID 2708 wrote to memory of 496 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe powershell.exe PID 2708 wrote to memory of 496 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe powershell.exe PID 2708 wrote to memory of 496 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe powershell.exe PID 2708 wrote to memory of 1776 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe schtasks.exe PID 2708 wrote to memory of 1776 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe schtasks.exe PID 2708 wrote to memory of 1776 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe schtasks.exe PID 2708 wrote to memory of 708 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe PID 2708 wrote to memory of 708 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe PID 2708 wrote to memory of 708 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe PID 2708 wrote to memory of 708 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe PID 2708 wrote to memory of 708 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe PID 2708 wrote to memory of 708 2708 ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe"C:\Users\Admin\AppData\Local\Temp\ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FdsdzRAs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FdsdzRAs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8BC1.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe"C:\Users\Admin\AppData\Local\Temp\ae0d62b6b0dd86dd84bd8b67de7dc40130139b8a3be6e5f4c5acea86142a5da3.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp8BC1.tmpMD5
6f952e4a11eaf3b93eff0f2e155b62e5
SHA13b7c68f662d4d789befd4257a662f544f3250c13
SHA25617825d3c5ea76280b288aab5646693af777ec1b53c2121be58c961ed99d09927
SHA51231a95f1941a47cb37cf1b56cbf2907c5b6f4f1284872c36c3007a9121a71f9af33f8709c53230c755f34a530fc44b0e7c6fd5f9ec5a80f936e519a2464e2f4f6
-
memory/496-138-0x0000000007C40000-0x0000000007CB6000-memory.dmpFilesize
472KB
-
memory/496-148-0x0000000008A90000-0x0000000008AAE000-memory.dmpFilesize
120KB
-
memory/496-132-0x0000000006C60000-0x0000000006CC6000-memory.dmpFilesize
408KB
-
memory/496-354-0x0000000008DA0000-0x0000000008DA8000-memory.dmpFilesize
32KB
-
memory/496-133-0x0000000006EB0000-0x0000000006F16000-memory.dmpFilesize
408KB
-
memory/496-349-0x0000000008DB0000-0x0000000008DCA000-memory.dmpFilesize
104KB
-
memory/496-156-0x0000000009020000-0x00000000090B4000-memory.dmpFilesize
592KB
-
memory/496-155-0x0000000000F53000-0x0000000000F54000-memory.dmpFilesize
4KB
-
memory/496-126-0x0000000000EC0000-0x0000000000EF6000-memory.dmpFilesize
216KB
-
memory/496-154-0x000000007E940000-0x000000007E941000-memory.dmpFilesize
4KB
-
memory/496-128-0x0000000007160000-0x0000000007788000-memory.dmpFilesize
6.2MB
-
memory/496-153-0x0000000008ED0000-0x0000000008F75000-memory.dmpFilesize
660KB
-
memory/496-130-0x0000000000F52000-0x0000000000F53000-memory.dmpFilesize
4KB
-
memory/496-131-0x0000000001300000-0x0000000001322000-memory.dmpFilesize
136KB
-
memory/496-147-0x0000000008AB0000-0x0000000008AE3000-memory.dmpFilesize
204KB
-
memory/496-137-0x0000000007E30000-0x0000000007E7B000-memory.dmpFilesize
300KB
-
memory/496-129-0x0000000000F50000-0x0000000000F51000-memory.dmpFilesize
4KB
-
memory/496-135-0x0000000007790000-0x0000000007AE0000-memory.dmpFilesize
3.3MB
-
memory/496-136-0x0000000006CF0000-0x0000000006D0C000-memory.dmpFilesize
112KB
-
memory/708-134-0x0000000001A40000-0x0000000001D60000-memory.dmpFilesize
3.1MB
-
memory/708-127-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2708-120-0x0000000005A30000-0x0000000005A3C000-memory.dmpFilesize
48KB
-
memory/2708-115-0x0000000000ED0000-0x0000000000FA2000-memory.dmpFilesize
840KB
-
memory/2708-118-0x0000000005890000-0x0000000005D8E000-memory.dmpFilesize
5.0MB
-
memory/2708-117-0x0000000005890000-0x0000000005922000-memory.dmpFilesize
584KB
-
memory/2708-116-0x0000000005D90000-0x000000000628E000-memory.dmpFilesize
5.0MB
-
memory/2708-122-0x00000000081C0000-0x0000000008222000-memory.dmpFilesize
392KB
-
memory/2708-121-0x0000000008120000-0x00000000081BC000-memory.dmpFilesize
624KB
-
memory/2708-119-0x0000000005960000-0x000000000596A000-memory.dmpFilesize
40KB