Analysis
-
max time kernel
153s -
max time network
157s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
30-01-2022 07:17
Static task
static1
Behavioral task
behavioral1
Sample
TT_SWIFT_Export Order_noref S10SMG00318021.exe
Resource
win7-en-20211208
General
-
Target
TT_SWIFT_Export Order_noref S10SMG00318021.exe
-
Size
653KB
-
MD5
fff91c58119d3cd7f68457e8565f7116
-
SHA1
4201eb7214bd3658889739e4856412b8063e0405
-
SHA256
f8c0d385ece89cd926b2c74680c036f9927414955e7ff4ed12b576470b8c1745
-
SHA512
c05cf9e0ed2aad4c08b394d97fc1257d273aa8dd51a45487ba51ff5973ab7b2227aba7ea1e1e8e9daf7416aaea418b06edfa29ff93665f6d3cc5b1a392dbed92
Malware Config
Extracted
xloader
2.5
46uq
beardeddentguy.com
envirobombs.com
mintbox.pro
xiangpusun.com
pyjama-france.com
mendocinocountylive.com
innovativepropsolutions.com
hpsaddlerock.com
qrmaindonesia.com
liphelp.com
archaeaenergy.info
18446744073709551615.com
littlecreekacresri.com
elderlycareacademy.com
drshivanieyecare.com
ashibumi.com
stevenalexandergolf.com
adoratv.net
visitnewrichmond.com
fxbvanpool.com
aarondecker.online
environmentalkivul.com
cardsncrepes.com
hopdongdientu-viettel.com
thebroughtguarantee.com
howtofindahotniche.com
1678600.win
pityana.com
akconsultoria.com
markazkreasindo.com
ronniecapitol.com
tailsontour.com
abros88.com
laboratoriodentaltj.com
fuckingmom86.xyz
5pz59.com
centralmadu.com
ispecwar.com
otetransportanddispatching.com
cartaovirtual.net
hsadmin.xyz
xn--12c2bed4dxay5cxdh1s.online
oki-net.com
scenekidfancams.com
preciousmugs.com
754711.com
helpigservices.com
blueharepress.com
xmshzs.com
lovelycharlestonhomes.com
wamhsh.com
burlesquercize.com
oppoexch.com
ditjai.tech
the-hausd-group.com
loosebland.website
syntheticloot.net
gzfusco.com
www-by.com
farraztravel.com
beheld3d.art
douyababy.space
elcuerpohumano.xyz
3soap.com
liberia-infos.net
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2352-137-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2352-143-0x00000000011F0000-0x000000000138C000-memory.dmp xloader behavioral2/memory/2132-149-0x00000000008C0000-0x00000000008E9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exeTT_SWIFT_Export Order_noref S10SMG00318021.exesvchost.exedescription pid process target process PID 1552 set thread context of 2352 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 2352 set thread context of 2968 2352 TT_SWIFT_Export Order_noref S10SMG00318021.exe Explorer.EXE PID 2132 set thread context of 2968 2132 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exeTT_SWIFT_Export Order_noref S10SMG00318021.exepowershell.exepowershell.exesvchost.exepid process 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2352 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2352 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2352 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2352 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2688 powershell.exe 2696 powershell.exe 2696 powershell.exe 2688 powershell.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2696 powershell.exe 2688 powershell.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe 2132 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2968 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exesvchost.exepid process 2352 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2352 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2352 TT_SWIFT_Export Order_noref S10SMG00318021.exe 2132 svchost.exe 2132 svchost.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exepowershell.exepowershell.exeTT_SWIFT_Export Order_noref S10SMG00318021.exesvchost.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe Token: SeDebugPrivilege 2696 powershell.exe Token: SeDebugPrivilege 2688 powershell.exe Token: SeDebugPrivilege 2352 TT_SWIFT_Export Order_noref S10SMG00318021.exe Token: SeDebugPrivilege 2132 svchost.exe Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE Token: SeShutdownPrivilege 2968 Explorer.EXE Token: SeCreatePagefilePrivilege 2968 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
TT_SWIFT_Export Order_noref S10SMG00318021.exeExplorer.EXEdescription pid process target process PID 1552 wrote to memory of 2696 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1552 wrote to memory of 2696 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1552 wrote to memory of 2696 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1552 wrote to memory of 2688 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1552 wrote to memory of 2688 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1552 wrote to memory of 2688 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe powershell.exe PID 1552 wrote to memory of 1840 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe schtasks.exe PID 1552 wrote to memory of 1840 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe schtasks.exe PID 1552 wrote to memory of 1840 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe schtasks.exe PID 1552 wrote to memory of 2352 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1552 wrote to memory of 2352 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1552 wrote to memory of 2352 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1552 wrote to memory of 2352 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1552 wrote to memory of 2352 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 1552 wrote to memory of 2352 1552 TT_SWIFT_Export Order_noref S10SMG00318021.exe TT_SWIFT_Export Order_noref S10SMG00318021.exe PID 2968 wrote to memory of 2132 2968 Explorer.EXE svchost.exe PID 2968 wrote to memory of 2132 2968 Explorer.EXE svchost.exe PID 2968 wrote to memory of 2132 2968 Explorer.EXE svchost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AnsPejV.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AnsPejV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9244.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"C:\Users\Admin\AppData\Local\Temp\TT_SWIFT_Export Order_noref S10SMG00318021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
1c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
e4d6f3b6a6cbfce4b882fd7539ab0611
SHA1dd95a84c520f229b2b5810bed0406026c596bd82
SHA256c31ae635233f8a554f49c89671c7bcdb5edbaba319011d6e54ddcc7672097000
SHA512c818966b8183b0c6862af040b6e4cea1108cdb82cca941ff4b5f56b2d9b8c8b586498aa5626dfc58bc77c6c92d3ea80c55d0fe8250467b20f218a1a5590fab01
-
C:\Users\Admin\AppData\Local\Temp\tmp9244.tmpMD5
291b8ef34d3dae7ae42604ffe9a580d9
SHA104f4c7f8fa83aafddfc4d8b52096c2adff1f96d6
SHA25632ea6893bcabc635ab3ac4384fb8d1970e03af31a8602aec02ab8da8e2b2785d
SHA51216a91b34b205ce52db128fd76b9c92b6f653e9ff46108a8c2a8eeb59c3adaea9792d07211c7387f663cc1eef2763e94e563687cab188b4a2dd3cef3f9e9b52b9
-
memory/1552-125-0x0000000006CB0000-0x00000000071AE000-memory.dmpFilesize
5.0MB
-
memory/1552-117-0x0000000005B20000-0x0000000005BB2000-memory.dmpFilesize
584KB
-
memory/1552-120-0x0000000006170000-0x000000000617E000-memory.dmpFilesize
56KB
-
memory/1552-121-0x00000000064C0000-0x000000000650B000-memory.dmpFilesize
300KB
-
memory/1552-122-0x0000000005A63000-0x0000000005A65000-memory.dmpFilesize
8KB
-
memory/1552-123-0x0000000001700000-0x000000000179C000-memory.dmpFilesize
624KB
-
memory/1552-124-0x00000000031D0000-0x0000000003232000-memory.dmpFilesize
392KB
-
memory/1552-116-0x0000000005A60000-0x0000000005A61000-memory.dmpFilesize
4KB
-
memory/1552-118-0x0000000005C70000-0x0000000005D1A000-memory.dmpFilesize
680KB
-
memory/1552-119-0x0000000005E10000-0x0000000006160000-memory.dmpFilesize
3.3MB
-
memory/1552-115-0x0000000000FE0000-0x0000000001088000-memory.dmpFilesize
672KB
-
memory/2132-184-0x0000000003190000-0x0000000003320000-memory.dmpFilesize
1.6MB
-
memory/2132-148-0x0000000000950000-0x000000000095C000-memory.dmpFilesize
48KB
-
memory/2132-150-0x0000000003320000-0x0000000003640000-memory.dmpFilesize
3.1MB
-
memory/2132-149-0x00000000008C0000-0x00000000008E9000-memory.dmpFilesize
164KB
-
memory/2352-142-0x0000000001390000-0x00000000016B0000-memory.dmpFilesize
3.1MB
-
memory/2352-137-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2352-143-0x00000000011F0000-0x000000000138C000-memory.dmpFilesize
1.6MB
-
memory/2688-169-0x0000000008A40000-0x0000000008A5E000-memory.dmpFilesize
120KB
-
memory/2688-133-0x00000000010D2000-0x00000000010D3000-memory.dmpFilesize
4KB
-
memory/2688-132-0x00000000010D0000-0x00000000010D1000-memory.dmpFilesize
4KB
-
memory/2688-579-0x0000000008E70000-0x0000000008E78000-memory.dmpFilesize
32KB
-
memory/2688-145-0x00000000074E0000-0x0000000007830000-memory.dmpFilesize
3.3MB
-
memory/2688-147-0x0000000006D40000-0x0000000006D8B000-memory.dmpFilesize
300KB
-
memory/2688-183-0x00000000010D3000-0x00000000010D4000-memory.dmpFilesize
4KB
-
memory/2688-180-0x0000000008BB0000-0x0000000008C55000-memory.dmpFilesize
660KB
-
memory/2688-136-0x0000000006DB0000-0x00000000073D8000-memory.dmpFilesize
6.2MB
-
memory/2688-178-0x000000007E960000-0x000000007E961000-memory.dmpFilesize
4KB
-
memory/2688-151-0x0000000007BC0000-0x0000000007C36000-memory.dmpFilesize
472KB
-
memory/2696-139-0x0000000007470000-0x0000000007492000-memory.dmpFilesize
136KB
-
memory/2696-146-0x0000000007CE0000-0x0000000007CFC000-memory.dmpFilesize
112KB
-
memory/2696-134-0x0000000006E92000-0x0000000006E93000-memory.dmpFilesize
4KB
-
memory/2696-179-0x000000007FA50000-0x000000007FA51000-memory.dmpFilesize
4KB
-
memory/2696-141-0x0000000007B70000-0x0000000007BD6000-memory.dmpFilesize
408KB
-
memory/2696-181-0x0000000009890000-0x0000000009924000-memory.dmpFilesize
592KB
-
memory/2696-182-0x0000000006E93000-0x0000000006E94000-memory.dmpFilesize
4KB
-
memory/2696-168-0x0000000009390000-0x00000000093C3000-memory.dmpFilesize
204KB
-
memory/2696-131-0x0000000006E90000-0x0000000006E91000-memory.dmpFilesize
4KB
-
memory/2696-130-0x00000000049D0000-0x0000000004A06000-memory.dmpFilesize
216KB
-
memory/2696-570-0x0000000009790000-0x00000000097AA000-memory.dmpFilesize
104KB
-
memory/2696-140-0x0000000007D50000-0x0000000007DB6000-memory.dmpFilesize
408KB
-
memory/2968-144-0x0000000007140000-0x00000000072AF000-memory.dmpFilesize
1.4MB
-
memory/2968-185-0x0000000001450000-0x00000000014ED000-memory.dmpFilesize
628KB