Resubmissions
14-03-2022 13:53
220314-q7ffkagbb2 1014-03-2022 13:10
220314-qev1jshfal 1014-03-2022 13:10
220314-qejmhsffd9 114-03-2022 13:09
220314-qeba5sffd4 114-03-2022 13:09
220314-qdstsshegp 125-02-2022 17:41
220225-v9edhaabek 1025-02-2022 17:33
220225-v49x8aabcr 1025-02-2022 17:26
220225-vz7masggh9 1025-02-2022 17:01
220225-vjlpwsggd5 10Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
25-02-2022 17:01
Static task
static1
Behavioral task
behavioral1
Sample
INV21029.exe
Resource
win7-20220223-en
General
-
Target
INV21029.exe
-
Size
577KB
-
MD5
740dd9c14dea0b98df6ad434abfe789e
-
SHA1
cbec4d898e68c12fb7dcaddb17d0aca16e8e0e7b
-
SHA256
35295675b2fbd8ff9900336325e3324270f083705fd0cf51f4ef28763430cdd6
-
SHA512
66041e42091e83889a6da93c4242a01a0a3122774dc2db8baf909fb0ec6b0d6e847183ac92a24f2ca99f99de7dd4abddddda4a908887f354e3a333202bc0a66e
Malware Config
Extracted
xloader
2.5
ahc8
192451.com
wwwripostes.net
sirikhalsalaw.com
bitterbaybay.com
stella-scrubs.com
almanecermezcal.com
goodgood.online
translate-now.online
sincerefilm.com
quadrantforensics.com
johnfrenchart.com
plick-click.com
alnileen.com
tghi.xyz
172711.com
maymakita.com
punnyaseva.com
ukash-online.com
sho-yururi-blog.com
hebergement-solidaire.com
civicinfluencers.net
gzhf8888.com
kuleallstar.com
palisadeslodgecondos.com
holyhirschsprungs.com
azalearoseuk.com
jaggllc.com
italianrofrow.xyz
ioewur.xyz
3a5hlv.icu
kitcycle.com
estate.xyz
ankaraescortvip.xyz
richclubsite2001.xyz
kastore.website
515pleasantvalleyway.com
sittlermd.com
mytemple.group
tiny-wagen.com
sharaleesvintageflames.com
mentalesteem.com
sport-newss.online
fbve.space
lovingtruebloodindallas.com
eaglehospitality.biz
roofrepairnow.info
mcrosfts-updata.digital
cimpactinc.com
greatnotleyeast.com
lovely-tics.com
douglas-enterprise.com
dayannalima.online
ksodl.com
rainbowlampro.com
theinteriorsfurniture.com
eidmueller.email
cg020.online
gta6fuzhu.com
cinemaocity.com
hopeitivity.com
savageequipment.biz
groceriesbazaar.com
hempgotas.com
casino-pharaon-play.xyz
ralfrassendnk-login.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/740-134-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3372-142-0x0000000002A00000-0x0000000002A29000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
reqbqonire.exereqbqonire.exepid process 4060 reqbqonire.exe 740 reqbqonire.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
reqbqonire.exereqbqonire.execontrol.exedescription pid process target process PID 4060 set thread context of 740 4060 reqbqonire.exe reqbqonire.exe PID 740 set thread context of 2516 740 reqbqonire.exe Explorer.EXE PID 3372 set thread context of 2516 3372 control.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
reqbqonire.execontrol.exepid process 740 reqbqonire.exe 740 reqbqonire.exe 740 reqbqonire.exe 740 reqbqonire.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe 3372 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2516 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
reqbqonire.execontrol.exepid process 740 reqbqonire.exe 740 reqbqonire.exe 740 reqbqonire.exe 3372 control.exe 3372 control.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
reqbqonire.execontrol.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 740 reqbqonire.exe Token: SeDebugPrivilege 3372 control.exe Token: SeShutdownPrivilege 2516 Explorer.EXE Token: SeCreatePagefilePrivilege 2516 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
INV21029.exereqbqonire.exeExplorer.EXEcontrol.exedescription pid process target process PID 3284 wrote to memory of 4060 3284 INV21029.exe reqbqonire.exe PID 3284 wrote to memory of 4060 3284 INV21029.exe reqbqonire.exe PID 3284 wrote to memory of 4060 3284 INV21029.exe reqbqonire.exe PID 4060 wrote to memory of 740 4060 reqbqonire.exe reqbqonire.exe PID 4060 wrote to memory of 740 4060 reqbqonire.exe reqbqonire.exe PID 4060 wrote to memory of 740 4060 reqbqonire.exe reqbqonire.exe PID 4060 wrote to memory of 740 4060 reqbqonire.exe reqbqonire.exe PID 4060 wrote to memory of 740 4060 reqbqonire.exe reqbqonire.exe PID 4060 wrote to memory of 740 4060 reqbqonire.exe reqbqonire.exe PID 2516 wrote to memory of 3372 2516 Explorer.EXE control.exe PID 2516 wrote to memory of 3372 2516 Explorer.EXE control.exe PID 2516 wrote to memory of 3372 2516 Explorer.EXE control.exe PID 3372 wrote to memory of 2632 3372 control.exe cmd.exe PID 3372 wrote to memory of 2632 3372 control.exe cmd.exe PID 3372 wrote to memory of 2632 3372 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\INV21029.exe"C:\Users\Admin\AppData\Local\Temp\INV21029.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeC:\Users\Admin\AppData\Local\Temp\reqbqonire.exe C:\Users\Admin\AppData\Local\Temp\truuumm3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeC:\Users\Admin\AppData\Local\Temp\reqbqonire.exe C:\Users\Admin\AppData\Local\Temp\truuumm4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1djuqculeikkmhtz2x2MD5
199f72b6103b1ad570f3a810d06c332a
SHA143b9341301394deec3c674cf98fc3c6cc629ee2b
SHA256a61bbd1659ba2338fe6e4df411d709834285b54991c403ba07bc9459af5320fc
SHA5120ce6be58193b0bcdccd003218597ce8f6bd0de35563c32d28c2e111903445f12ece5fa0a536dd2b79153b9c265c10a6ec17f8ef67b11edb95d155c0f502adeb5
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
C:\Users\Admin\AppData\Local\Temp\truuummMD5
0a99632c69bc8d3fe6231d0a50bff785
SHA1ad875f4428f17d0474be5ee8667158bd14d10f22
SHA2560a11eae20268581b0ad9c67defaf1a4dc4bf183ede922eca10c5da698eec8078
SHA51293905216a40975163edfcc94cf3c55c40a27e4cf7143d028ef6c5caead6ceaaa1504bd4c5a05d043d61be3df08991ea7e1e8c98cdfafd9d8744ccacdc5d7de2f
-
memory/740-136-0x00000000009D0000-0x0000000000D1A000-memory.dmpFilesize
3.3MB
-
memory/740-134-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/740-138-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/740-139-0x0000000000E60000-0x0000000000E71000-memory.dmpFilesize
68KB
-
memory/2516-140-0x00000000086E0000-0x00000000087F4000-memory.dmpFilesize
1.1MB
-
memory/2516-145-0x0000000008B00000-0x0000000008C90000-memory.dmpFilesize
1.6MB
-
memory/3372-141-0x00000000007B0000-0x00000000007D7000-memory.dmpFilesize
156KB
-
memory/3372-143-0x00000000048F0000-0x0000000004C3A000-memory.dmpFilesize
3.3MB
-
memory/3372-142-0x0000000002A00000-0x0000000002A29000-memory.dmpFilesize
164KB
-
memory/3372-144-0x0000000004720000-0x00000000047B0000-memory.dmpFilesize
576KB