Resubmissions
14-03-2022 13:53
220314-q7ffkagbb2 1014-03-2022 13:10
220314-qev1jshfal 1014-03-2022 13:10
220314-qejmhsffd9 114-03-2022 13:09
220314-qeba5sffd4 114-03-2022 13:09
220314-qdstsshegp 125-02-2022 17:41
220225-v9edhaabek 1025-02-2022 17:33
220225-v49x8aabcr 1025-02-2022 17:26
220225-vz7masggh9 1025-02-2022 17:01
220225-vjlpwsggd5 10Analysis
-
max time kernel
102s -
max time network
106s -
platform
windows10_x64 -
resource
win10-20220310-en -
submitted
14-03-2022 13:10
Static task
static1
General
-
Target
INV21029.exe
-
Size
577KB
-
MD5
740dd9c14dea0b98df6ad434abfe789e
-
SHA1
cbec4d898e68c12fb7dcaddb17d0aca16e8e0e7b
-
SHA256
35295675b2fbd8ff9900336325e3324270f083705fd0cf51f4ef28763430cdd6
-
SHA512
66041e42091e83889a6da93c4242a01a0a3122774dc2db8baf909fb0ec6b0d6e847183ac92a24f2ca99f99de7dd4abddddda4a908887f354e3a333202bc0a66e
Malware Config
Extracted
xloader
2.5
ahc8
192451.com
wwwripostes.net
sirikhalsalaw.com
bitterbaybay.com
stella-scrubs.com
almanecermezcal.com
goodgood.online
translate-now.online
sincerefilm.com
quadrantforensics.com
johnfrenchart.com
plick-click.com
alnileen.com
tghi.xyz
172711.com
maymakita.com
punnyaseva.com
ukash-online.com
sho-yururi-blog.com
hebergement-solidaire.com
civicinfluencers.net
gzhf8888.com
kuleallstar.com
palisadeslodgecondos.com
holyhirschsprungs.com
azalearoseuk.com
jaggllc.com
italianrofrow.xyz
ioewur.xyz
3a5hlv.icu
kitcycle.com
estate.xyz
ankaraescortvip.xyz
richclubsite2001.xyz
kastore.website
515pleasantvalleyway.com
sittlermd.com
mytemple.group
tiny-wagen.com
sharaleesvintageflames.com
mentalesteem.com
sport-newss.online
fbve.space
lovingtruebloodindallas.com
eaglehospitality.biz
roofrepairnow.info
mcrosfts-updata.digital
cimpactinc.com
greatnotleyeast.com
lovely-tics.com
douglas-enterprise.com
dayannalima.online
ksodl.com
rainbowlampro.com
theinteriorsfurniture.com
eidmueller.email
cg020.online
gta6fuzhu.com
cinemaocity.com
hopeitivity.com
savageequipment.biz
groceriesbazaar.com
hempgotas.com
casino-pharaon-play.xyz
ralfrassendnk-login.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/3364-122-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/3364-127-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/3056-131-0x0000000000CC0000-0x0000000000CE9000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
reqbqonire.exereqbqonire.exepid process 1828 reqbqonire.exe 3364 reqbqonire.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
reqbqonire.exereqbqonire.execmstp.exedescription pid process target process PID 1828 set thread context of 3364 1828 reqbqonire.exe reqbqonire.exe PID 3364 set thread context of 2876 3364 reqbqonire.exe Explorer.EXE PID 3056 set thread context of 2876 3056 cmstp.exe Explorer.EXE -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
taskmgr.exereqbqonire.execmstp.exepid process 2092 taskmgr.exe 2092 taskmgr.exe 3364 reqbqonire.exe 3364 reqbqonire.exe 3364 reqbqonire.exe 3364 reqbqonire.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 3056 cmstp.exe 2092 taskmgr.exe 2092 taskmgr.exe 3056 cmstp.exe 3056 cmstp.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 3056 cmstp.exe 3056 cmstp.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 3056 cmstp.exe 3056 cmstp.exe 2092 taskmgr.exe 2092 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2876 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
reqbqonire.execmstp.exepid process 3364 reqbqonire.exe 3364 reqbqonire.exe 3364 reqbqonire.exe 3056 cmstp.exe 3056 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
taskmgr.exereqbqonire.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2092 taskmgr.exe Token: SeSystemProfilePrivilege 2092 taskmgr.exe Token: SeCreateGlobalPrivilege 2092 taskmgr.exe Token: SeDebugPrivilege 3364 reqbqonire.exe Token: SeDebugPrivilege 3056 cmstp.exe Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE Token: SeShutdownPrivilege 2876 Explorer.EXE Token: SeCreatePagefilePrivilege 2876 Explorer.EXE -
Suspicious use of FindShellTrayWindow 35 IoCs
Processes:
taskmgr.exeExplorer.EXEpid process 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2876 Explorer.EXE 2092 taskmgr.exe 2092 taskmgr.exe 2876 Explorer.EXE 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exeExplorer.EXEpid process 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2092 taskmgr.exe 2092 taskmgr.exe 2876 Explorer.EXE 2092 taskmgr.exe 2092 taskmgr.exe 2876 Explorer.EXE 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2876 Explorer.EXE 2876 Explorer.EXE 2092 taskmgr.exe 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE 2876 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
INV21029.exereqbqonire.exeExplorer.EXEcmstp.exedescription pid process target process PID 1240 wrote to memory of 1828 1240 INV21029.exe reqbqonire.exe PID 1240 wrote to memory of 1828 1240 INV21029.exe reqbqonire.exe PID 1240 wrote to memory of 1828 1240 INV21029.exe reqbqonire.exe PID 1828 wrote to memory of 3364 1828 reqbqonire.exe reqbqonire.exe PID 1828 wrote to memory of 3364 1828 reqbqonire.exe reqbqonire.exe PID 1828 wrote to memory of 3364 1828 reqbqonire.exe reqbqonire.exe PID 1828 wrote to memory of 3364 1828 reqbqonire.exe reqbqonire.exe PID 1828 wrote to memory of 3364 1828 reqbqonire.exe reqbqonire.exe PID 1828 wrote to memory of 3364 1828 reqbqonire.exe reqbqonire.exe PID 2876 wrote to memory of 3056 2876 Explorer.EXE cmstp.exe PID 2876 wrote to memory of 3056 2876 Explorer.EXE cmstp.exe PID 2876 wrote to memory of 3056 2876 Explorer.EXE cmstp.exe PID 3056 wrote to memory of 1272 3056 cmstp.exe cmd.exe PID 3056 wrote to memory of 1272 3056 cmstp.exe cmd.exe PID 3056 wrote to memory of 1272 3056 cmstp.exe cmd.exe PID 2876 wrote to memory of 204 2876 Explorer.EXE chrome.exe PID 2876 wrote to memory of 204 2876 Explorer.EXE chrome.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\INV21029.exe"C:\Users\Admin\AppData\Local\Temp\INV21029.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeC:\Users\Admin\AppData\Local\Temp\reqbqonire.exe C:\Users\Admin\AppData\Local\Temp\truuumm3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeC:\Users\Admin\AppData\Local\Temp\reqbqonire.exe C:\Users\Admin\AppData\Local\Temp\truuumm4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3364 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2092 -
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\reqbqonire.exe"3⤵PID:1272
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵PID:204
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1djuqculeikkmhtz2x2MD5
199f72b6103b1ad570f3a810d06c332a
SHA143b9341301394deec3c674cf98fc3c6cc629ee2b
SHA256a61bbd1659ba2338fe6e4df411d709834285b54991c403ba07bc9459af5320fc
SHA5120ce6be58193b0bcdccd003218597ce8f6bd0de35563c32d28c2e111903445f12ece5fa0a536dd2b79153b9c265c10a6ec17f8ef67b11edb95d155c0f502adeb5
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
C:\Users\Admin\AppData\Local\Temp\reqbqonire.exeMD5
b83e207b80ad38dccaf5b38b9a64cf97
SHA1a28cba27c256021902f8150d47ced82565bb8558
SHA25697658ad1a093a80ac9f16949b1971079bbdddc8cdd3515bb681b821203794741
SHA512190ee397a064ca8caf6e0625a79ab764d7bae84007790b2157804f9ae2f16454d430c17402b4d7df76ce5cdea24b3f56d2298c56a5a38215fd9a65fb8e68e0a6
-
C:\Users\Admin\AppData\Local\Temp\truuummMD5
0a99632c69bc8d3fe6231d0a50bff785
SHA1ad875f4428f17d0474be5ee8667158bd14d10f22
SHA2560a11eae20268581b0ad9c67defaf1a4dc4bf183ede922eca10c5da698eec8078
SHA51293905216a40975163edfcc94cf3c55c40a27e4cf7143d028ef6c5caead6ceaaa1504bd4c5a05d043d61be3df08991ea7e1e8c98cdfafd9d8744ccacdc5d7de2f
-
memory/1828-124-0x00000000001E0000-0x00000000001E2000-memory.dmpFilesize
8KB
-
memory/2876-134-0x0000000004AB0000-0x0000000004C10000-memory.dmpFilesize
1.4MB
-
memory/2876-129-0x0000000004980000-0x0000000004AA5000-memory.dmpFilesize
1.1MB
-
memory/3056-131-0x0000000000CC0000-0x0000000000CE9000-memory.dmpFilesize
164KB
-
memory/3056-133-0x0000000000F40000-0x0000000000FD0000-memory.dmpFilesize
576KB
-
memory/3056-132-0x0000000004580000-0x00000000048A0000-memory.dmpFilesize
3.1MB
-
memory/3056-130-0x0000000001160000-0x0000000001176000-memory.dmpFilesize
88KB
-
memory/3364-122-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3364-128-0x00000000005A0000-0x000000000073B000-memory.dmpFilesize
1.6MB
-
memory/3364-127-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3364-126-0x00000000009E0000-0x0000000000D00000-memory.dmpFilesize
3.1MB