Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
02-03-2022 16:04
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-en-20220112
General
-
Target
tmp.exe
-
Size
332KB
-
MD5
8bc5cae30e499dea0d78f85c309be304
-
SHA1
95b3af264ecfec7155002f8ee9bbc46c4946e84f
-
SHA256
ea928c88deed19528dead0fc786936f6ac102f94905ce1bff6df678b7c560726
-
SHA512
d6149bcc0747f00b53a429dbd1605433830d8f2f67d638eb5e4feb41cb43f5029f42ddeb23c369a5000d5b37896ee51cf6f79cbdc23f0848ce0a10d62901de99
Malware Config
Extracted
xloader
2.5
igwa
listingswithalex.com
funtabse.com
aydenwalling.com
prochal.net
superfoodsnederland.com
moldluck.com
dianekgordon.store
regionalhomescommercial.com
mysecuritymadesimple.com
malwaremastery.com
kodaikeiko.com
jrzg996.com
agricurve.net
songlingjiu.com
virginianundahfishingclub.com
friendschance.com
pastelpresents.com
answertitles.com
survival-hunter.com
nxfddl.com
traditionnevertrend.com
agrovessel.com
unicorm.digital
cucumboy.com
alemdogarimpo.com
laraful.com
hexwaa.com
hanu21st.com
knoycia.com
qishengxing.com
gopipurespices.com
fdkkrfidkdslsieofkld.info
elephantspublications.online
valeriebeijing.com
xn--42cg2czax6ptae6a.com
2shengman.com
sfcshavedice.com
ragworkhouse.com
stardomfrokch.xyz
exoticcenterfold.com
eventosartifice.com
test-order-noren.com
110bao.com
face-pro.online
freedomoff.com
futuresep.com
tremblock.com
chocolat-gillotte.com
speclove.com
ddflsl.com
goodnewsmbc.net
cloudtotaal.com
goapps-auth.com
ouch247max.com
sabra-sd.com
luxuryneverhurt.art
rxvendorpills.online
ludowinners.online
placemyorder.online
skyrim.company
monsterlecturer.com
controle-fiscal.com
phoenixinjurylawyer.online
nanoheadgames.com
toposales.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/940-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/940-67-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/568-76-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
iizlfx.exeiizlfx.exepid process 1416 iizlfx.exe 940 iizlfx.exe -
Loads dropped DLL 2 IoCs
Processes:
tmp.exeiizlfx.exepid process 1636 tmp.exe 1416 iizlfx.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
iizlfx.exeiizlfx.exesystray.exedescription pid process target process PID 1416 set thread context of 940 1416 iizlfx.exe iizlfx.exe PID 940 set thread context of 1384 940 iizlfx.exe Explorer.EXE PID 940 set thread context of 1384 940 iizlfx.exe Explorer.EXE PID 568 set thread context of 1384 568 systray.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
iizlfx.exesystray.exepid process 940 iizlfx.exe 940 iizlfx.exe 940 iizlfx.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe 568 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
iizlfx.exesystray.exepid process 940 iizlfx.exe 940 iizlfx.exe 940 iizlfx.exe 940 iizlfx.exe 568 systray.exe 568 systray.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
iizlfx.exesystray.exedescription pid process Token: SeDebugPrivilege 940 iizlfx.exe Token: SeDebugPrivilege 568 systray.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1384 Explorer.EXE 1384 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
tmp.exeiizlfx.exeExplorer.EXEsystray.exedescription pid process target process PID 1636 wrote to memory of 1416 1636 tmp.exe iizlfx.exe PID 1636 wrote to memory of 1416 1636 tmp.exe iizlfx.exe PID 1636 wrote to memory of 1416 1636 tmp.exe iizlfx.exe PID 1636 wrote to memory of 1416 1636 tmp.exe iizlfx.exe PID 1416 wrote to memory of 940 1416 iizlfx.exe iizlfx.exe PID 1416 wrote to memory of 940 1416 iizlfx.exe iizlfx.exe PID 1416 wrote to memory of 940 1416 iizlfx.exe iizlfx.exe PID 1416 wrote to memory of 940 1416 iizlfx.exe iizlfx.exe PID 1416 wrote to memory of 940 1416 iizlfx.exe iizlfx.exe PID 1416 wrote to memory of 940 1416 iizlfx.exe iizlfx.exe PID 1416 wrote to memory of 940 1416 iizlfx.exe iizlfx.exe PID 1384 wrote to memory of 568 1384 Explorer.EXE systray.exe PID 1384 wrote to memory of 568 1384 Explorer.EXE systray.exe PID 1384 wrote to memory of 568 1384 Explorer.EXE systray.exe PID 1384 wrote to memory of 568 1384 Explorer.EXE systray.exe PID 568 wrote to memory of 564 568 systray.exe cmd.exe PID 568 wrote to memory of 564 568 systray.exe cmd.exe PID 568 wrote to memory of 564 568 systray.exe cmd.exe PID 568 wrote to memory of 564 568 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iizlfx.exeC:\Users\Admin\AppData\Local\Temp\iizlfx.exe C:\Users\Admin\AppData\Local\Temp\ibfqtjhg3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\iizlfx.exeC:\Users\Admin\AppData\Local\Temp\iizlfx.exe C:\Users\Admin\AppData\Local\Temp\ibfqtjhg4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\iizlfx.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fc81nqibepxmw1MD5
296fcc90486bd93b1a6e0593241d1c7f
SHA134c54d85fe773bf6068752501e16a5c9227d5bee
SHA2562a7dd4eaee410720ffc22a511932a3b1a2b13319f77e0085548d63010e73e18e
SHA512c29c5a7141c84a88db4e890c207a8c5f36987539b68037c82f3256ea6ef6cd679ee643344c0f028cb42c93b4e70ddb965e557dc419be4a06c91752e3157c4464
-
C:\Users\Admin\AppData\Local\Temp\ibfqtjhgMD5
ad17464f77b0864dea1025b4ca517e28
SHA18c0d2d3aea1c36f8dff24ea2467317ad9773ff68
SHA256a5a41b0b6c1032840a1bc802b29461ef67486a3f36b9d964df10e884ecba825f
SHA512e57a70fc66e2eddba4cf097d97e91fd1de2358be96f89c50a36c155916bcbba2b45f4e02d25819a84780bef2735a9fc4d1682d3b1793f7487668ef293d78c331
-
C:\Users\Admin\AppData\Local\Temp\iizlfx.exeMD5
018adcd630666bff50914157771f6e43
SHA140e4d330149f8b86766eac860ce3cc06e01f51ac
SHA256039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f
SHA512c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f
-
C:\Users\Admin\AppData\Local\Temp\iizlfx.exeMD5
018adcd630666bff50914157771f6e43
SHA140e4d330149f8b86766eac860ce3cc06e01f51ac
SHA256039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f
SHA512c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f
-
C:\Users\Admin\AppData\Local\Temp\iizlfx.exeMD5
018adcd630666bff50914157771f6e43
SHA140e4d330149f8b86766eac860ce3cc06e01f51ac
SHA256039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f
SHA512c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f
-
\Users\Admin\AppData\Local\Temp\iizlfx.exeMD5
018adcd630666bff50914157771f6e43
SHA140e4d330149f8b86766eac860ce3cc06e01f51ac
SHA256039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f
SHA512c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f
-
\Users\Admin\AppData\Local\Temp\iizlfx.exeMD5
018adcd630666bff50914157771f6e43
SHA140e4d330149f8b86766eac860ce3cc06e01f51ac
SHA256039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f
SHA512c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f
-
memory/568-75-0x0000000000AD0000-0x0000000000AD5000-memory.dmpFilesize
20KB
-
memory/568-78-0x0000000000990000-0x0000000000A20000-memory.dmpFilesize
576KB
-
memory/568-77-0x0000000002070000-0x0000000002373000-memory.dmpFilesize
3.0MB
-
memory/568-76-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/940-67-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/940-69-0x0000000000200000-0x0000000000211000-memory.dmpFilesize
68KB
-
memory/940-73-0x0000000000250000-0x0000000000261000-memory.dmpFilesize
68KB
-
memory/940-72-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/940-68-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/940-66-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/940-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1384-70-0x0000000006CE0000-0x0000000006E71000-memory.dmpFilesize
1.6MB
-
memory/1384-74-0x0000000006E80000-0x0000000006FEB000-memory.dmpFilesize
1.4MB
-
memory/1384-79-0x0000000005090000-0x0000000005159000-memory.dmpFilesize
804KB
-
memory/1636-55-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB