Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22-02-2022 09:23
Static task
static1
Behavioral task
behavioral1
Sample
MV LILY SEA_xlsx.exe
Resource
win7-en-20211208
General
-
Target
MV LILY SEA_xlsx.exe
-
Size
294KB
-
MD5
6ec38c4638933adf4e6431c599572869
-
SHA1
7daceef37fd49f19393b9cc0c03b5bd0625b6eb4
-
SHA256
4693178ae42f25930859574bbaa0b9eb93a011b9233c43639c53689ecd47a15c
-
SHA512
08836096c927d30c9dc4207bbdb0468234f4c2e44eeb873ba755d8976ea578d041c708d97a97cff85cbf8ac27841cba9c1683b54b67e2da029ade8cb8e5d3257
Malware Config
Extracted
xloader
2.5
dtt3
edilononlineshop.com
cursosd.com
viellacharteredland.com
increasey0urenergylevels.codes
yjy-hotel.com
claym.xyz
reelsguide.com
gives-cardano.com
ashrafannuar.com
mammalians.com
rocketleaguedads.com
yubierp.com
minimi36.com
chn-chn.com
jagojp888.com
parsian-shetab.com
273351.com
mdtouhid.com
babedads.com
vallinam2.com
buro-tic.com
az-rent.net
shifaebio.xyz
circuitoalberghiero.com
xn--b1afb9b.xn--p1acf
canlioyundasin.online
sachainchirajaomega.com
scandinest.com
pluky.net
tpxcy.com
nbg.global
automountproducts.com
hghbj.com
beachsidecoatings.com
householdertips.com
coworkingspace.online
doujyou.com
tenloe053.xyz
udpbkp.biz
kondanginyuk.online
zipiter.com
christiankrog.com
reliantrecruitinggroup.com
acrylicus.com
cruelgirls.biz
oeinsulation.com
mapnft.xyz
leadersfort.com
foodroutine.com
mayerohio.info
systemofsolutions.com
gideonajibike.com
bigboobz.net
townofis.com
mhkxlgs.com
sussaautocare.com
quicktle.com
boutiquedangel.com
garrisonroadhouse.com
stiff-pols.art
cabalaconsultores.com
theweddinggame.net
themoneymagicians.com
overtonesa.com
janasflannels.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1636-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1496-70-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Executes dropped EXE 3 IoCs
Processes:
dtppertj.exedtppertj.exegdimjoxcfp0.exepid process 804 dtppertj.exe 1636 dtppertj.exe 1244 gdimjoxcfp0.exe -
Loads dropped DLL 6 IoCs
Processes:
MV LILY SEA_xlsx.exedtppertj.exeWerFault.exepid process 1672 MV LILY SEA_xlsx.exe 804 dtppertj.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
systray.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run systray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MHUPLPFPCNY = "C:\\Program Files (x86)\\Fzpqlgb\\gdimjoxcfp0.exe" systray.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
dtppertj.exedtppertj.exesystray.exedescription pid process target process PID 804 set thread context of 1636 804 dtppertj.exe dtppertj.exe PID 1636 set thread context of 1248 1636 dtppertj.exe Explorer.EXE PID 1496 set thread context of 1248 1496 systray.exe Explorer.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
systray.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe systray.exe File created C:\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 852 1244 WerFault.exe gdimjoxcfp0.exe -
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
dtppertj.exesystray.exeWerFault.exepid process 1636 dtppertj.exe 1636 dtppertj.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 852 WerFault.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
dtppertj.exesystray.exepid process 1636 dtppertj.exe 1636 dtppertj.exe 1636 dtppertj.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe 1496 systray.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
dtppertj.exesystray.exeWerFault.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1636 dtppertj.exe Token: SeDebugPrivilege 1496 systray.exe Token: SeDebugPrivilege 852 WerFault.exe Token: SeShutdownPrivilege 1248 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
MV LILY SEA_xlsx.exedtppertj.exeExplorer.EXEsystray.exegdimjoxcfp0.exedescription pid process target process PID 1672 wrote to memory of 804 1672 MV LILY SEA_xlsx.exe dtppertj.exe PID 1672 wrote to memory of 804 1672 MV LILY SEA_xlsx.exe dtppertj.exe PID 1672 wrote to memory of 804 1672 MV LILY SEA_xlsx.exe dtppertj.exe PID 1672 wrote to memory of 804 1672 MV LILY SEA_xlsx.exe dtppertj.exe PID 804 wrote to memory of 1636 804 dtppertj.exe dtppertj.exe PID 804 wrote to memory of 1636 804 dtppertj.exe dtppertj.exe PID 804 wrote to memory of 1636 804 dtppertj.exe dtppertj.exe PID 804 wrote to memory of 1636 804 dtppertj.exe dtppertj.exe PID 804 wrote to memory of 1636 804 dtppertj.exe dtppertj.exe PID 804 wrote to memory of 1636 804 dtppertj.exe dtppertj.exe PID 804 wrote to memory of 1636 804 dtppertj.exe dtppertj.exe PID 1248 wrote to memory of 1496 1248 Explorer.EXE systray.exe PID 1248 wrote to memory of 1496 1248 Explorer.EXE systray.exe PID 1248 wrote to memory of 1496 1248 Explorer.EXE systray.exe PID 1248 wrote to memory of 1496 1248 Explorer.EXE systray.exe PID 1496 wrote to memory of 1500 1496 systray.exe cmd.exe PID 1496 wrote to memory of 1500 1496 systray.exe cmd.exe PID 1496 wrote to memory of 1500 1496 systray.exe cmd.exe PID 1496 wrote to memory of 1500 1496 systray.exe cmd.exe PID 1496 wrote to memory of 1964 1496 systray.exe Firefox.exe PID 1496 wrote to memory of 1964 1496 systray.exe Firefox.exe PID 1496 wrote to memory of 1964 1496 systray.exe Firefox.exe PID 1496 wrote to memory of 1964 1496 systray.exe Firefox.exe PID 1248 wrote to memory of 1244 1248 Explorer.EXE gdimjoxcfp0.exe PID 1248 wrote to memory of 1244 1248 Explorer.EXE gdimjoxcfp0.exe PID 1248 wrote to memory of 1244 1248 Explorer.EXE gdimjoxcfp0.exe PID 1248 wrote to memory of 1244 1248 Explorer.EXE gdimjoxcfp0.exe PID 1244 wrote to memory of 852 1244 gdimjoxcfp0.exe WerFault.exe PID 1244 wrote to memory of 852 1244 gdimjoxcfp0.exe WerFault.exe PID 1244 wrote to memory of 852 1244 gdimjoxcfp0.exe WerFault.exe PID 1244 wrote to memory of 852 1244 gdimjoxcfp0.exe WerFault.exe PID 1496 wrote to memory of 1964 1496 systray.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MV LILY SEA_xlsx.exe"C:\Users\Admin\AppData\Local\Temp\MV LILY SEA_xlsx.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dtppertj.exeC:\Users\Admin\AppData\Local\Temp\dtppertj.exe C:\Users\Admin\AppData\Local\Temp\gjajpuko3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dtppertj.exeC:\Users\Admin\AppData\Local\Temp\dtppertj.exe C:\Users\Admin\AppData\Local\Temp\gjajpuko4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\dtppertj.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe"C:\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 1883⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exeMD5
5d708187202ff76979fa629b1699ea90
SHA1115946ec185770a7ef6f2fd5c166a226ba43e938
SHA2560055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27
SHA5125a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b
-
C:\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exeMD5
5d708187202ff76979fa629b1699ea90
SHA1115946ec185770a7ef6f2fd5c166a226ba43e938
SHA2560055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27
SHA5125a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b
-
C:\Users\Admin\AppData\Local\Temp\dtppertj.exeMD5
5d708187202ff76979fa629b1699ea90
SHA1115946ec185770a7ef6f2fd5c166a226ba43e938
SHA2560055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27
SHA5125a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b
-
C:\Users\Admin\AppData\Local\Temp\dtppertj.exeMD5
5d708187202ff76979fa629b1699ea90
SHA1115946ec185770a7ef6f2fd5c166a226ba43e938
SHA2560055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27
SHA5125a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b
-
C:\Users\Admin\AppData\Local\Temp\dtppertj.exeMD5
5d708187202ff76979fa629b1699ea90
SHA1115946ec185770a7ef6f2fd5c166a226ba43e938
SHA2560055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27
SHA5125a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b
-
C:\Users\Admin\AppData\Local\Temp\gjajpukoMD5
ae3d43c640983d2fc0eb4146c712832d
SHA15ea8807d63c462a9aaa56d75e83a92415424789c
SHA256f95f89002e8a5c0a365c34e8bc5d44999cf395b8a5a148c28a4a3ddea147d77a
SHA512668501d2ee8382fee0039c6056d251bfd3a7ec23b8689a8dd98ea7a21cfec354e0131ddc9a8ca1b70819672c50e24d721dcebee0437064b42d58a9c55d9a81bb
-
C:\Users\Admin\AppData\Local\Temp\jx3ysnwt15tyrf7aMD5
7ab27baca052a3c9073b91a47837b5f4
SHA19a65e1d87ae66b250bb7a996a1e2417c766cb5e0
SHA256bebdbe0b879c05c334e50f0450a2b4442194871fe4472e618fd9b6d8937107d2
SHA51206b30e6fb1fa9c91c6631405d7c33ac4a94e3dbedde78d630ebe1a516847c187655abdd9a9b9d036d9358f94a8c6ac3831761d099f106213f154be1fbeada889
-
\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exeMD5
5d708187202ff76979fa629b1699ea90
SHA1115946ec185770a7ef6f2fd5c166a226ba43e938
SHA2560055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27
SHA5125a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b
-
\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exeMD5
5d708187202ff76979fa629b1699ea90
SHA1115946ec185770a7ef6f2fd5c166a226ba43e938
SHA2560055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27
SHA5125a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b
-
\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exeMD5
5d708187202ff76979fa629b1699ea90
SHA1115946ec185770a7ef6f2fd5c166a226ba43e938
SHA2560055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27
SHA5125a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b
-
\Program Files (x86)\Fzpqlgb\gdimjoxcfp0.exeMD5
5d708187202ff76979fa629b1699ea90
SHA1115946ec185770a7ef6f2fd5c166a226ba43e938
SHA2560055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27
SHA5125a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b
-
\Users\Admin\AppData\Local\Temp\dtppertj.exeMD5
5d708187202ff76979fa629b1699ea90
SHA1115946ec185770a7ef6f2fd5c166a226ba43e938
SHA2560055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27
SHA5125a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b
-
\Users\Admin\AppData\Local\Temp\dtppertj.exeMD5
5d708187202ff76979fa629b1699ea90
SHA1115946ec185770a7ef6f2fd5c166a226ba43e938
SHA2560055ed75bb58cdb1de19124bb69084da9e29ec5a1578390e85f73170fac44a27
SHA5125a5b4641063ee4e0fbe32b1ed1f52166796f0fc31ee41b1c30e69f1cf0d3b5300033adc7dedea51c5fa24ba302fac51d5344c93316873295171139473782d39b
-
memory/852-84-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1248-73-0x0000000009230000-0x00000000093AF000-memory.dmpFilesize
1.5MB
-
memory/1248-68-0x00000000073D0000-0x00000000074BC000-memory.dmpFilesize
944KB
-
memory/1496-71-0x0000000001F50000-0x0000000002253000-memory.dmpFilesize
3.0MB
-
memory/1496-72-0x0000000001D50000-0x0000000001DE0000-memory.dmpFilesize
576KB
-
memory/1496-70-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1496-69-0x0000000000550000-0x0000000000555000-memory.dmpFilesize
20KB
-
memory/1636-67-0x0000000000140000-0x0000000000151000-memory.dmpFilesize
68KB
-
memory/1636-66-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/1636-65-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/1636-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1672-54-0x0000000075341000-0x0000000075343000-memory.dmpFilesize
8KB