Analysis
- max time kernel
151s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
19/02/2022, 23:47
Static task
static1
Behavioral task
behavioral1
Sample
68521747.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 68521747.exe
- Size 292KB
- Sample220219-3ste4aefa8
- SHA256 db097eebc2cb1af575eeb0e7278d466276ddd626cfa0bb5f0b77741679870959
- MD5 7e1c671cb921a5a53f7b13695889a10f
- SHA1 94007268dc30fd25c465de624ae8e65197740032
- SHA512 fdcdc25ee8f5682bd3f519a9cf56c68bebfde7332a312ad05e112418507a95ccd932c4e0b1d2279f5d800765ecec3374b96443278e640927ce4f6241404fb0dd
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
uar3
Decoy
-
sgadvocats.com
-
mjscannabus.com
-
hilldaley.com
-
ksdollhouse.com
-
hotgiftboutique.com
-
purebloodsmeet.com
-
relaunched.info
-
cap-glove.com
-
productcollection.store
-
fulikyy.xyz
-
remoteaviationjobs.com
-
bestcleancrystal.com
-
virtualorganizationpartner.com
-
bookgocar.com
-
hattuafhv.quest
-
makonigroup.com
-
officecom-myaccount.com
-
malgorzata-lac.com
-
e-learningeducators.com
-
hygilaur.com
-
kgv-lachswehr.com
-
salazarcomunicacion.com
-
robopython.com
-
corporateequity.online
-
complianceservicegroup.com
-
aperza-ex.com
-
webflowusa.com
-
asesoriasfinancieras.xyz
-
missolivesbranches.com
-
numiquest.com
-
criskconsultancy.com
-
gotemup.com
-
themaptalk.com
-
lakebalboahalf.com
-
cateringfrenchcroissant.com
-
paddocklakerealestate.com
-
lojaquerosurprezza.store
-
courtneywhitearmusic.com
-
geovannimaquinadevendas.online
-
pricklypairjazz.com
-
engagedigi.com
-
conduitforthespirit.com
-
anaheimaletrail.com
-
wholesalemall.store
-
alertsbecu.com
-
gestion-kayfra.com
-
youcanstores.com
-
qsuo.net
-
formadv.info
-
dihesia.xyz
-
carrreir.com
-
twenteeminuteswithtee.com
-
realliferenewal.com
-
officialprokodsukses.icu
-
stanfordgrouploscabos.com
-
maxicashpromir.xyz
-
zysqshjs.com
-
trc-clicks.com
-
chsclbd.com
-
amdproduce.net
-
republicoflies.com
-
beaux-parents.com
-
lucrativeapp.com
-
milbombas.com
-
alexanderplaywear.com
Signatures
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/1620-134-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1620-138-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2568-143-0x0000000002E00000-0x0000000002E29000-memory.dmp xloader - Executes dropped EXE 2 IoCs
pid Process 3164 fxpymvoa.exe 1620 fxpymvoa.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3164 set thread context of 1620 3164 fxpymvoa.exe 59 PID 1620 set thread context of 2428 1620 fxpymvoa.exe 37 PID 2568 set thread context of 2428 2568 control.exe 37 - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 46 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3700" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.143954" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3704" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3672" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1620 fxpymvoa.exe 1620 fxpymvoa.exe 1620 fxpymvoa.exe 1620 fxpymvoa.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe 2568 control.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2428 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1620 fxpymvoa.exe 1620 fxpymvoa.exe 1620 fxpymvoa.exe 2568 control.exe 2568 control.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1620 fxpymvoa.exe Token: SeDebugPrivilege 2568 control.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe Token: SeSecurityPrivilege 3064 TiWorker.exe Token: SeBackupPrivilege 3064 TiWorker.exe Token: SeRestorePrivilege 3064 TiWorker.exe - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3264 wrote to memory of 3164 3264 68521747.exe 57 PID 3264 wrote to memory of 3164 3264 68521747.exe 57 PID 3264 wrote to memory of 3164 3264 68521747.exe 57 PID 3164 wrote to memory of 1620 3164 fxpymvoa.exe 59 PID 3164 wrote to memory of 1620 3164 fxpymvoa.exe 59 PID 3164 wrote to memory of 1620 3164 fxpymvoa.exe 59 PID 3164 wrote to memory of 1620 3164 fxpymvoa.exe 59 PID 3164 wrote to memory of 1620 3164 fxpymvoa.exe 59 PID 3164 wrote to memory of 1620 3164 fxpymvoa.exe 59 PID 2428 wrote to memory of 2568 2428 Explorer.EXE 60 PID 2428 wrote to memory of 2568 2428 Explorer.EXE 60 PID 2428 wrote to memory of 2568 2428 Explorer.EXE 60 PID 2568 wrote to memory of 3472 2568 control.exe 61 PID 2568 wrote to memory of 3472 2568 control.exe 61 PID 2568 wrote to memory of 3472 2568 control.exe 61
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\68521747.exe"C:\Users\Admin\AppData\Local\Temp\68521747.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\fxpymvoa.exeC:\Users\Admin\AppData\Local\Temp\fxpymvoa.exe C:\Users\Admin\AppData\Local\Temp\ceppv3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\fxpymvoa.exeC:\Users\Admin\AppData\Local\Temp\fxpymvoa.exe C:\Users\Admin\AppData\Local\Temp\ceppv4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1620
-
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\fxpymvoa.exe"3⤵PID:3472
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2296
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Modifies data under HKEY_USERS
PID:1544
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3064