Analysis
-
max time kernel
198s -
max time network
208s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
19-02-2022 08:46
Static task
static1
Behavioral task
behavioral1
Sample
CTMARRANGEMENT.exe
Resource
win7-en-20211208
General
-
Target
CTMARRANGEMENT.exe
-
Size
241KB
-
MD5
b2f8226c665cc2d96fce6e8e1dff44bb
-
SHA1
e4e99b9b85d1c957e684054cc44c4d4ab6816398
-
SHA256
b5d3ff4b7af5cdc828b2c6d23177a5c85e7aea720b01be458ed979ce16a48d02
-
SHA512
6ddd7dbb1359dff4461cf967cee483ecd5fc547a6b8ee7e3720d4eba53898ff57fcd8ad6630d334fe424dd430a5a8c68a7f09b8b3a0e46e40defceb8f95050a8
Malware Config
Extracted
xloader
2.5
u6vb
blendedmatter.com
piquinmarketing.com
dubkirelax.online
optimumotoaksesuar.com
bendisle.com
islamicgeometricpatterns.net
cheesebox.online
lh-coaching.com
buildingmaterial.info
backwoods72.com
goodtreetee.com
zknqqpvsypx.mobi
phukienstreaming.com
turkistick.com
cbd-shop-portugal.com
imherllc.com
krallechols.quest
ttmmb.com
pornmodelsworld.com
weakyummy.space
profitablemechanic.com
arthahomehealth.com
xllbyte.top
enthrallingmagazine.com
letgoboss.com
twaroggrodkowski.com
2027bet365.com
viveecom.com
rachelzrileybeauty.com
jadablond.com
mypasscodekeycard.com
sectionpor.xyz
hypotheque.xyz
matryoshkatechspec.online
newspaper.tax
jm0513.com
barringtonmediaqroup.com
mot-associates.com
mahomeslistings.com
henrywrench.com
anita.digital
leyouxx.com
icetherapy.net
nft-premium.design
vulcanrussia23.xyz
cvbintangkaryacipta.com
ballerapeclub.digital
coralarray.com
quoteshtx.com
thebestgpstracker.com
onlinepricehk.com
mountainvillagecondos.com
thenudefactory.com
rubarombic.net
theroycom1.com
drinkabit.art
maymakita.com
pickvector.net
online-be.xyz
monkendodge.com
successsynergyemail.com
cuahangyodykimthanh.com
love-shoppy.com
gebaeudetechnik-burscheid.com
officejava.store
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1780-131-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/460-140-0x0000000004B90000-0x0000000004BB9000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
CTMARRANGEMENT.exepid process 4088 CTMARRANGEMENT.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
CTMARRANGEMENT.exeCTMARRANGEMENT.exedescription pid process target process PID 4088 set thread context of 1780 4088 CTMARRANGEMENT.exe CTMARRANGEMENT.exe PID 1780 set thread context of 2308 1780 CTMARRANGEMENT.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Modifies data under HKEY_USERS 49 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899105287944470" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.154400" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.033715" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4112" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4228" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "5.006989" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
CTMARRANGEMENT.exechkdsk.exepid process 1780 CTMARRANGEMENT.exe 1780 CTMARRANGEMENT.exe 1780 CTMARRANGEMENT.exe 1780 CTMARRANGEMENT.exe 460 chkdsk.exe 460 chkdsk.exe 460 chkdsk.exe 460 chkdsk.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
CTMARRANGEMENT.exechkdsk.exepid process 1780 CTMARRANGEMENT.exe 1780 CTMARRANGEMENT.exe 1780 CTMARRANGEMENT.exe 460 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
CTMARRANGEMENT.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1780 CTMARRANGEMENT.exe Token: SeDebugPrivilege 460 chkdsk.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
CTMARRANGEMENT.exeExplorer.EXEchkdsk.exedescription pid process target process PID 4088 wrote to memory of 1780 4088 CTMARRANGEMENT.exe CTMARRANGEMENT.exe PID 4088 wrote to memory of 1780 4088 CTMARRANGEMENT.exe CTMARRANGEMENT.exe PID 4088 wrote to memory of 1780 4088 CTMARRANGEMENT.exe CTMARRANGEMENT.exe PID 4088 wrote to memory of 1780 4088 CTMARRANGEMENT.exe CTMARRANGEMENT.exe PID 4088 wrote to memory of 1780 4088 CTMARRANGEMENT.exe CTMARRANGEMENT.exe PID 4088 wrote to memory of 1780 4088 CTMARRANGEMENT.exe CTMARRANGEMENT.exe PID 2308 wrote to memory of 460 2308 Explorer.EXE chkdsk.exe PID 2308 wrote to memory of 460 2308 Explorer.EXE chkdsk.exe PID 2308 wrote to memory of 460 2308 Explorer.EXE chkdsk.exe PID 460 wrote to memory of 2452 460 chkdsk.exe cmd.exe PID 460 wrote to memory of 2452 460 chkdsk.exe cmd.exe PID 460 wrote to memory of 2452 460 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CTMARRANGEMENT.exe"C:\Users\Admin\AppData\Local\Temp\CTMARRANGEMENT.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\CTMARRANGEMENT.exe"C:\Users\Admin\AppData\Local\Temp\CTMARRANGEMENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\CTMARRANGEMENT.exe"3⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsjCE9B.tmp\motkbxlalna.dllMD5
8ef2346d93874e3817a0884d963244bf
SHA165ee37be6eef3f9b1be9011a5a6b502147270833
SHA256603e899639d21b1bf894843ceec38af6aa307f67564e2bffaf94891a0c0c27b9
SHA5129efbe25b97117e5b38a905fc38e9503b93cb5e62db9599a0c257242a5d64d38165842fce7ba4d85dba54a18468ef1cfcaa0cfb8776bcc3c0694b7914a6bf1dae
-
memory/460-139-0x0000000005660000-0x00000000059AA000-memory.dmpFilesize
3.3MB
-
memory/460-138-0x0000000000600000-0x000000000060A000-memory.dmpFilesize
40KB
-
memory/460-140-0x0000000004B90000-0x0000000004BB9000-memory.dmpFilesize
164KB
-
memory/1780-131-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1780-135-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/1780-134-0x0000000000AF0000-0x0000000000E3A000-memory.dmpFilesize
3.3MB
-
memory/1780-136-0x00000000005E0000-0x00000000005F1000-memory.dmpFilesize
68KB
-
memory/2308-137-0x0000000008FF0000-0x000000000910C000-memory.dmpFilesize
1.1MB
-
memory/4088-132-0x00000000009D0000-0x00000000009D2000-memory.dmpFilesize
8KB