Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
30-01-2022 07:17
Static task
static1
Behavioral task
behavioral1
Sample
TT_SWIFT_Export Order_noref S10SMG00318021.exe
Resource
win7-en-20211208
General
-
Target
TT_SWIFT_Export Order_noref S10SMG00318021.exe
-
Size
653KB
-
MD5
fff91c58119d3cd7f68457e8565f7116
-
SHA1
4201eb7214bd3658889739e4856412b8063e0405
-
SHA256
f8c0d385ece89cd926b2c74680c036f9927414955e7ff4ed12b576470b8c1745
-
SHA512
c05cf9e0ed2aad4c08b394d97fc1257d273aa8dd51a45487ba51ff5973ab7b2227aba7ea1e1e8e9daf7416aaea418b06edfa29ff93665f6d3cc5b1a392dbed92
Malware Config
Extracted
xloader
2.5
46uq
beardeddentguy.com
envirobombs.com
mintbox.pro
xiangpusun.com
pyjama-france.com
mendocinocountylive.com
innovativepropsolutions.com
hpsaddlerock.com
qrmaindonesia.com
liphelp.com
archaeaenergy.info
18446744073709551615.com
littlecreekacresri.com
elderlycareacademy.com
drshivanieyecare.com
ashibumi.com
stevenalexandergolf.com
adoratv.net
visitnewrichmond.com
fxbvanpool.com
aarondecker.online
environmentalkivul.com
cardsncrepes.com
hopdongdientu-viettel.com
thebroughtguarantee.com
howtofindahotniche.com
1678600.win
pityana.com
akconsultoria.com
markazkreasindo.com
ronniecapitol.com
tailsontour.com
abros88.com
laboratoriodentaltj.com
fuckingmom86.xyz
5pz59.com
centralmadu.com
ispecwar.com
otetransportanddispatching.com
cartaovirtual.net
hsadmin.xyz
xn--12c2bed4dxay5cxdh1s.online
oki-net.com
scenekidfancams.com
preciousmugs.com
754711.com
helpigservices.com
blueharepress.com
xmshzs.com
lovelycharlestonhomes.com
wamhsh.com
burlesquercize.com
oppoexch.com
ditjai.tech
the-hausd-group.com
loosebland.website
syntheticloot.net
gzfusco.com
www-by.com
farraztravel.com
beheld3d.art
douyababy.space
elcuerpohumano.xyz
3soap.com
liberia-infos.net
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2032-70-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1152-76-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exeTT_SWIFT_Export Order_noref S10SMG00318021.exesystray.exedescription pid process target process PID 740 set thread context of 2032 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 2032 set thread context of 1396 2032 TT_SWIFT_Export Order_noref S10SMG00318021.exe Explorer.EXE PID 1152 set thread context of 1396 1152 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exeTT_SWIFT_Export Order_noref S10SMG00318021.exesystray.exepowershell.exepowershell.exepid process 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2032 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2032 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1152 systray.exe 1152 systray.exe 968 powershell.exe 1480 powershell.exe 1152 systray.exe 1152 systray.exe 1152 systray.exe 1152 systray.exe 1152 systray.exe 1152 systray.exe 1152 systray.exe 1152 systray.exe 1152 systray.exe 1152 systray.exe 1152 systray.exe 1152 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exesystray.exepid process 2032 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2032 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2032 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1152 systray.exe 1152 systray.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exeTT_SWIFT_Export Order_noref S10SMG00318021.exesystray.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe Token: SeDebugPrivilege 2032 TT_SWIFT_Export Order_noref S10SMG00318021.exe Token: SeDebugPrivilege 1152 systray.exe Token: SeDebugPrivilege 968 powershell.exe Token: SeDebugPrivilege 1480 powershell.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1396 Explorer.EXE 1396 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exeExplorer.EXEdescription pid process target process PID 740 wrote to memory of 968 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 740 wrote to memory of 968 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 740 wrote to memory of 968 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 740 wrote to memory of 968 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 740 wrote to memory of 1480 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 740 wrote to memory of 1480 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 740 wrote to memory of 1480 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 740 wrote to memory of 1480 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 740 wrote to memory of 1436 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe schtasks.exe PID 740 wrote to memory of 1436 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe schtasks.exe PID 740 wrote to memory of 1436 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe schtasks.exe PID 740 wrote to memory of 1436 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe schtasks.exe PID 740 wrote to memory of 2032 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 740 wrote to memory of 2032 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 740 wrote to memory of 2032 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 740 wrote to memory of 2032 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 740 wrote to memory of 2032 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 740 wrote to memory of 2032 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 740 wrote to memory of 2032 740 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1396 wrote to memory of 1152 1396 Explorer.EXE systray.exe PID 1396 wrote to memory of 1152 1396 Explorer.EXE systray.exe PID 1396 wrote to memory of 1152 1396 Explorer.EXE systray.exe PID 1396 wrote to memory of 1152 1396 Explorer.EXE systray.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AnsPejV.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnsPejV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF4F9.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF4F9.tmpMD5
9100340e0caaab52bc5a9f472d9101de
SHA1b2c234bde76f9953da3957b125d28cfb1a52d76e
SHA25664bf2cc7fe703e079b81f93444171fa1660be240766a77d22f7948d27e0cad0d
SHA512cfd09e8a5986a31df862f6086bf327faeb158f4f41c37ec54be8b9a82819a726224bcc3570e48a71ef8cf155c9d1bebaf99c7be868cb61f91ddf25edd4caefe7
-
memory/740-55-0x00000000008A0000-0x0000000000948000-memory.dmpFilesize
672KB
-
memory/740-56-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/740-57-0x00000000763B1000-0x00000000763B3000-memory.dmpFilesize
8KB
-
memory/740-58-0x00000000005C0000-0x00000000005CE000-memory.dmpFilesize
56KB
-
memory/740-59-0x0000000004F05000-0x0000000004F16000-memory.dmpFilesize
68KB
-
memory/740-60-0x00000000049E0000-0x0000000004A42000-memory.dmpFilesize
392KB
-
memory/968-80-0x0000000002440000-0x000000000308A000-memory.dmpFilesize
12.3MB
-
memory/968-78-0x0000000002440000-0x000000000308A000-memory.dmpFilesize
12.3MB
-
memory/1152-76-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/1152-75-0x0000000000D50000-0x0000000000D55000-memory.dmpFilesize
20KB
-
memory/1152-77-0x0000000002160000-0x0000000002463000-memory.dmpFilesize
3.0MB
-
memory/1152-82-0x0000000000970000-0x0000000000A00000-memory.dmpFilesize
576KB
-
memory/1396-74-0x00000000064E0000-0x0000000006637000-memory.dmpFilesize
1.3MB
-
memory/1396-83-0x0000000004010000-0x00000000040B3000-memory.dmpFilesize
652KB
-
memory/1480-79-0x0000000002450000-0x000000000309A000-memory.dmpFilesize
12.3MB
-
memory/1480-81-0x0000000002450000-0x000000000309A000-memory.dmpFilesize
12.3MB
-
memory/2032-72-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/2032-73-0x0000000000320000-0x0000000000331000-memory.dmpFilesize
68KB
-
memory/2032-70-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2032-69-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2032-68-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB