Analysis
-
max time kernel
4294209s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220311-en -
submitted
08-04-2022 08:28
Static task
static1
Behavioral task
behavioral1
Sample
fiyat talebi.exe
Resource
win7-20220311-en
General
-
Target
fiyat talebi.exe
-
Size
242KB
-
MD5
cd5a1f00e5069978e2265c76b1ddf25d
-
SHA1
b995ba1b34b3debabad436b14ad5c94829e6e27b
-
SHA256
f2b30831e93ef719ecc6b3d7fa88509a1b77d35068d4d6ab2728d9938c8a7859
-
SHA512
656bca68ff35b4f341f2347af02b0f68cf56b1e3a20629dd446e0abad18d229de2501879a002c7bf99b9b27890fc2e5c1171bb7d585312bf0eaf74827d30200c
Malware Config
Extracted
xloader
2.5
cbgo
santesha.com
britneysbeautybar.com
sh-cy17.com
jeffcarveragency.com
3117111.com
sobrehosting.net
ddm123.xyz
toxcompliance.com
auditorydesigns.com
vliftfacial.com
ielhii.com
naameliss.com
ritualchariot.com
solchange.com
quatre-vingts.design
lawnmowermashine.com
braceletsstore.net
admappy.com
tollivercoltd.com
vaidix.com
rodrigomartinsadv.com
bouncingskull.com
hamiltonhellerrealestate.com
dream-kidz.com
growupnotgrowold.com
clanginandbangin.com
cornerstone-constructions.com
mcdonalds-delivery.xyz
omnikro.com
nca-group.com
hughers3.com
move-mobius.com
shrivs.com
hoshikuzu-hegemony.com
zpwx17.online
masoncable.com
butecreditunion.com
creativefolksnetwork.xyz
lejanet.com
tacticalslings.club
bestprodutos.com
quirkysoul39.com
sdettest.com
aomendc.xyz
lorticepttoyof6.xyz
nonvaxrnpositions.com
maintainaviation.com
kubanitka.com
fractalmerch.xyz
elbowguru.com
nikiyang.com
cialisactivesupers.com
bestofrochester.info
ynov-rennes.com
saiden8164.com
ffuster.com
papierle.com
dobsonfryedentist.com
rufisquoisedetransit.com
compassionatecuddling.com
kimlady.com
mashinchand.com
semicivilization.com
milamixecommerce.com
ambassadorandceoclub.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/792-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/792-64-0x000000000041D450-mapping.dmp xloader behavioral1/memory/792-70-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1348-76-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
qmzngjtx.exeqmzngjtx.exepid process 804 qmzngjtx.exe 792 qmzngjtx.exe -
Loads dropped DLL 2 IoCs
Processes:
fiyat talebi.exeqmzngjtx.exepid process 2040 fiyat talebi.exe 804 qmzngjtx.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
qmzngjtx.exeqmzngjtx.exemsiexec.exedescription pid process target process PID 804 set thread context of 792 804 qmzngjtx.exe qmzngjtx.exe PID 792 set thread context of 1196 792 qmzngjtx.exe Explorer.EXE PID 792 set thread context of 1196 792 qmzngjtx.exe Explorer.EXE PID 1348 set thread context of 1196 1348 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
qmzngjtx.exemsiexec.exepid process 792 qmzngjtx.exe 792 qmzngjtx.exe 792 qmzngjtx.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe 1348 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
qmzngjtx.exemsiexec.exepid process 792 qmzngjtx.exe 792 qmzngjtx.exe 792 qmzngjtx.exe 792 qmzngjtx.exe 1348 msiexec.exe 1348 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
qmzngjtx.exemsiexec.exedescription pid process Token: SeDebugPrivilege 792 qmzngjtx.exe Token: SeDebugPrivilege 1348 msiexec.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
fiyat talebi.exeqmzngjtx.exeqmzngjtx.exemsiexec.exedescription pid process target process PID 2040 wrote to memory of 804 2040 fiyat talebi.exe qmzngjtx.exe PID 2040 wrote to memory of 804 2040 fiyat talebi.exe qmzngjtx.exe PID 2040 wrote to memory of 804 2040 fiyat talebi.exe qmzngjtx.exe PID 2040 wrote to memory of 804 2040 fiyat talebi.exe qmzngjtx.exe PID 804 wrote to memory of 792 804 qmzngjtx.exe qmzngjtx.exe PID 804 wrote to memory of 792 804 qmzngjtx.exe qmzngjtx.exe PID 804 wrote to memory of 792 804 qmzngjtx.exe qmzngjtx.exe PID 804 wrote to memory of 792 804 qmzngjtx.exe qmzngjtx.exe PID 804 wrote to memory of 792 804 qmzngjtx.exe qmzngjtx.exe PID 804 wrote to memory of 792 804 qmzngjtx.exe qmzngjtx.exe PID 804 wrote to memory of 792 804 qmzngjtx.exe qmzngjtx.exe PID 792 wrote to memory of 1348 792 qmzngjtx.exe msiexec.exe PID 792 wrote to memory of 1348 792 qmzngjtx.exe msiexec.exe PID 792 wrote to memory of 1348 792 qmzngjtx.exe msiexec.exe PID 792 wrote to memory of 1348 792 qmzngjtx.exe msiexec.exe PID 792 wrote to memory of 1348 792 qmzngjtx.exe msiexec.exe PID 792 wrote to memory of 1348 792 qmzngjtx.exe msiexec.exe PID 792 wrote to memory of 1348 792 qmzngjtx.exe msiexec.exe PID 1348 wrote to memory of 1652 1348 msiexec.exe cmd.exe PID 1348 wrote to memory of 1652 1348 msiexec.exe cmd.exe PID 1348 wrote to memory of 1652 1348 msiexec.exe cmd.exe PID 1348 wrote to memory of 1652 1348 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\fiyat talebi.exe"C:\Users\Admin\AppData\Local\Temp\fiyat talebi.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qmzngjtx.exeC:\Users\Admin\AppData\Local\Temp\qmzngjtx.exe C:\Users\Admin\AppData\Local\Temp\qhidoqldbb3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\qmzngjtx.exeC:\Users\Admin\AppData\Local\Temp\qmzngjtx.exe C:\Users\Admin\AppData\Local\Temp\qhidoqldbb4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\qmzngjtx.exe"6⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\n4ctxmrbh0uoaq3yhaFilesize
212KB
MD50800086693d43f3e3f5248c8789ef97c
SHA19779f40e0a93bd5825d7f715453924819b9a59e6
SHA256089179b2f01e25d4117e018c7ebe402d2e4c68b9774c15f29fde43fa57aa32df
SHA5128fa85746c74bd7b2361dab36e3228a1c8f27f2d6b9d6a01b10ab97f07212bdc1ba52724d4239cc76b649763be8c2d2f0f298430fbbb1af94d7d4e1f50d52e0f4
-
C:\Users\Admin\AppData\Local\Temp\qhidoqldbbFilesize
4KB
MD54189ad2dedcab199ef7a58a4c490733e
SHA1023179460cc47e1ede06f9e4cc5b7ecfd87dadc2
SHA256513b1e9affe4c24ff16e2156cb1bf14c0e7c75d53b6886341a01474e5c784f3b
SHA512f27292ea85b5f4cf47c982dce736afdc69f9f0893b0a521546803e524e195a72b5a0e5c132a4f7fdcbed96baecfcee22f7e53363c71a309022dd312dee2597dc
-
C:\Users\Admin\AppData\Local\Temp\qmzngjtx.exeFilesize
5KB
MD5120556bf1317f6395f13ff5377e308d9
SHA1f36799d4885de8cc8f8c947e4fc28e1a3a39beab
SHA25663b0f72ed3dade8ad655daf220470057fce741dda011d4cfbdd7646460df3f46
SHA51275902aac1f4f6758ac53ab717b6f91eb326a8acf331c495b08cff27c571c31d244d8b30cd812a2ecfd9fbf70c230f673672bdbde0b57ededfd8b1c26200c98dd
-
C:\Users\Admin\AppData\Local\Temp\qmzngjtx.exeFilesize
5KB
MD5120556bf1317f6395f13ff5377e308d9
SHA1f36799d4885de8cc8f8c947e4fc28e1a3a39beab
SHA25663b0f72ed3dade8ad655daf220470057fce741dda011d4cfbdd7646460df3f46
SHA51275902aac1f4f6758ac53ab717b6f91eb326a8acf331c495b08cff27c571c31d244d8b30cd812a2ecfd9fbf70c230f673672bdbde0b57ededfd8b1c26200c98dd
-
C:\Users\Admin\AppData\Local\Temp\qmzngjtx.exeFilesize
5KB
MD5120556bf1317f6395f13ff5377e308d9
SHA1f36799d4885de8cc8f8c947e4fc28e1a3a39beab
SHA25663b0f72ed3dade8ad655daf220470057fce741dda011d4cfbdd7646460df3f46
SHA51275902aac1f4f6758ac53ab717b6f91eb326a8acf331c495b08cff27c571c31d244d8b30cd812a2ecfd9fbf70c230f673672bdbde0b57ededfd8b1c26200c98dd
-
\Users\Admin\AppData\Local\Temp\qmzngjtx.exeFilesize
5KB
MD5120556bf1317f6395f13ff5377e308d9
SHA1f36799d4885de8cc8f8c947e4fc28e1a3a39beab
SHA25663b0f72ed3dade8ad655daf220470057fce741dda011d4cfbdd7646460df3f46
SHA51275902aac1f4f6758ac53ab717b6f91eb326a8acf331c495b08cff27c571c31d244d8b30cd812a2ecfd9fbf70c230f673672bdbde0b57ededfd8b1c26200c98dd
-
\Users\Admin\AppData\Local\Temp\qmzngjtx.exeFilesize
5KB
MD5120556bf1317f6395f13ff5377e308d9
SHA1f36799d4885de8cc8f8c947e4fc28e1a3a39beab
SHA25663b0f72ed3dade8ad655daf220470057fce741dda011d4cfbdd7646460df3f46
SHA51275902aac1f4f6758ac53ab717b6f91eb326a8acf331c495b08cff27c571c31d244d8b30cd812a2ecfd9fbf70c230f673672bdbde0b57ededfd8b1c26200c98dd
-
memory/792-68-0x0000000000A10000-0x0000000000A21000-memory.dmpFilesize
68KB
-
memory/792-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/792-64-0x000000000041D450-mapping.dmp
-
memory/792-67-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/792-70-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/792-71-0x00000000022C0000-0x00000000022D1000-memory.dmpFilesize
68KB
-
memory/804-56-0x0000000000000000-mapping.dmp
-
memory/1196-80-0x0000000006E40000-0x0000000006FA6000-memory.dmpFilesize
1.4MB
-
memory/1196-69-0x0000000004C10000-0x0000000004D6C000-memory.dmpFilesize
1.4MB
-
memory/1196-72-0x00000000065F0000-0x000000000673A000-memory.dmpFilesize
1.3MB
-
memory/1348-77-0x0000000002260000-0x0000000002563000-memory.dmpFilesize
3.0MB
-
memory/1348-75-0x0000000000410000-0x0000000000424000-memory.dmpFilesize
80KB
-
memory/1348-76-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/1348-73-0x0000000000000000-mapping.dmp
-
memory/1348-79-0x0000000001F90000-0x0000000002020000-memory.dmpFilesize
576KB
-
memory/1652-78-0x0000000000000000-mapping.dmp
-
memory/2040-54-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB