Analysis
- max time kernel
158s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
18/02/2022, 09:30
Static task
static1
Behavioral task
behavioral1
Sample
ghhjdhsssaj.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target ghhjdhsssaj.exe
- Size 308KB
- Sample220218-lgg49acda2
- SHA256 0e620198a4a7ea1ae42f2a6a9b0e8c40ce320fc2f52710d86f4158272ebb248f
- MD5 6d8c4dfb5ff11f7296b89f8866870c0d
- SHA1 a9e114439175f57f4e77de9eb40890b41737b4e0
- SHA512 8bb0b42dd241b719feacb25a0c3222a79179d01494a05d6b2b8f035b62f48d5fb02139451e50c9cc1d1cdde783521457cccc9717e85bb3a23c761a1503da4534
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
tod8
Decoy
-
shabizy5.com
-
sattaking-delhiborder01.xyz
-
venetianmountains.com
-
vertogaastad.quest
-
zimalek.com
-
olympiacrownhotel.com
-
dubbostorage.online
-
mosescorrea.com
-
japanroofing.com
-
mashareq.store
-
gdetcz.com
-
slimmersite.com
-
aplintec.com
-
878971.com
-
charlottesbestroofcompany.com
-
into-mena.com
-
newlysupply.com
-
bianncapace.com
-
netrew.com
-
anhecapital.com
-
newtion.net
-
thelakemorleyhaunting.info
-
homicdecor.com
-
best-paper-to-know-today.info
-
bcw.today
-
cji-architect.com
-
perfecto21.com
-
misteroperfume.com
-
wlxxch.com
-
xn--maldya-qva.com
-
sandrasmit.club
-
ashabstracts.com
-
cbdshoot.com
-
qrin.top
-
1018shrader.com
-
gratisratio.com
-
alendigital.xyz
-
monroetruckingco.com
-
noahpresnell.com
-
czyssk.com
-
ultrahouseimob.com
-
tormentaritmica.com
-
exiqya.xyz
-
chodoque.net
-
shappilyeverafter.net
-
sacremots.com
-
necessary-tools.com
-
mathswithmike.online
-
gv-china.com
-
thenewivhubboston.com
-
pfo055lnb.xyz
-
fliprbook.club
-
tsourapricot.com
-
galactica-shop.com
-
sperrmuell-berlin-abholung.com
-
goldenaxe.club
-
lonestarbonehealth.com
-
potsleep.com
-
juliansdelectableedibles.com
-
wideaou.com
-
spaceworbc.com
-
cryptobittoday.com
-
dif-directory.xyz
-
lunchbreakincome.com
-
bulacee.com
Signatures
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/1788-135-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1788-138-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3000-144-0x0000000002E50000-0x0000000002E79000-memory.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 1548 doflj.exe 1788 doflj.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1548 set thread context of 1788 1548 doflj.exe 65 PID 1788 set thread context of 2516 1788 doflj.exe 33 PID 3000 set thread context of 2516 3000 wlanext.exe 33 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 51 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132898266355216553" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4308" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "7.759386" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4096" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.123559" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "16.654161" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 1788 doflj.exe 1788 doflj.exe 1788 doflj.exe 1788 doflj.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe 3000 wlanext.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2516 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1788 doflj.exe 1788 doflj.exe 1788 doflj.exe 3000 wlanext.exe 3000 wlanext.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1788 doflj.exe Token: SeDebugPrivilege 3000 wlanext.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe Token: SeSecurityPrivilege 3092 TiWorker.exe Token: SeBackupPrivilege 3092 TiWorker.exe Token: SeRestorePrivilege 3092 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3444 wrote to memory of 1548 3444 ghhjdhsssaj.exe 61 PID 3444 wrote to memory of 1548 3444 ghhjdhsssaj.exe 61 PID 3444 wrote to memory of 1548 3444 ghhjdhsssaj.exe 61 PID 1548 wrote to memory of 1788 1548 doflj.exe 65 PID 1548 wrote to memory of 1788 1548 doflj.exe 65 PID 1548 wrote to memory of 1788 1548 doflj.exe 65 PID 1548 wrote to memory of 1788 1548 doflj.exe 65 PID 1548 wrote to memory of 1788 1548 doflj.exe 65 PID 1548 wrote to memory of 1788 1548 doflj.exe 65 PID 2516 wrote to memory of 3000 2516 Explorer.EXE 66 PID 2516 wrote to memory of 3000 2516 Explorer.EXE 66 PID 2516 wrote to memory of 3000 2516 Explorer.EXE 66 PID 3000 wrote to memory of 352 3000 wlanext.exe 69 PID 3000 wrote to memory of 352 3000 wlanext.exe 69 PID 3000 wrote to memory of 352 3000 wlanext.exe 69
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\ghhjdhsssaj.exe"C:\Users\Admin\AppData\Local\Temp\ghhjdhsssaj.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\doflj.exeC:\Users\Admin\AppData\Local\Temp\doflj.exe C:\Users\Admin\AppData\Local\Temp\qarknv3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\doflj.exeC:\Users\Admin\AppData\Local\Temp\doflj.exe C:\Users\Admin\AppData\Local\Temp\qarknv4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\doflj.exe"3⤵PID:352
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:3984
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3036
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3092