Analysis
-
max time kernel
142s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
27-04-2022 10:25
Static task
static1
Behavioral task
behavioral1
Sample
ff766cdd10083147250eabfcaa76bebb.exe
Resource
win7-20220414-en
General
-
Target
ff766cdd10083147250eabfcaa76bebb.exe
-
Size
572KB
-
MD5
ff766cdd10083147250eabfcaa76bebb
-
SHA1
936815953ebeb2a771b03d86923079c01d2eb7f9
-
SHA256
6dcb58ae937b9194609ef51a11f945abb7b82d9f10e032bbef2fda12ee96e6db
-
SHA512
bdf81fdd836b74762bc22d522c9e6a2da73923a62355395472f8d9cf781bcc1fb8da7a6a165ba834ce18a913753e3463b4f9380e67a2cc136db0b2afcf3adac3
Malware Config
Extracted
xloader
2.5
r87g
gzjyjzsj.com
rapibest.com
affordablebathroomsbyfrank.net
roboruben.com
xn--dlisucr-byag.com
encoreasso.com
piscire.com
dixiebusybee.com
newrome.xyz
sunshinejon.com
glacierforfcs.xyz
borhanmarket.com
tous-des-cons.club
hsfstea.com
spiniform.info
vaicomfibra.com
shinigami.xyz
kryptoindia.com
listentoappetite.com
securepplpay.com
savannabrazell.com
dallascowboysticket.online
lemuria4.online
pakistaninusa.com
realdigitaldivide.com
nameandlikenesslabs.com
icris2021.com
amorporlaropa.com
xgirlstar.com
localhuktoyof6.xyz
about-times.xyz
withvertex.com
newtajmahalfashion.xyz
myapple3.com
sjitcom.com
shemanifesteverything.com
nft2yuan.com
misfitlamps.com
nordicautoparts.net
precisecleanteam.com
unmoro.com
gh-michikusa.com
usbgdt.net
ordt.xyz
hcaptchabypass.com
samedaycash.loan
lavistacaffe.com
alicekay.online
aceproservices.net
androidapdate.com
kredsen.website
southwinds-kolkata.com
069superbetin.com
adorablymeboutique.store
xbet973.com
xn--czrr40i.xn--io0a7i
shadow-marketing.com
license-plate-find.online
wwwoneparkfinancial.com
milehighrenewals.com
scyxmq.com
mbdeyren.com
nottryingdoing.com
homesandhorse.com
stpaulsschoolbagidora.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/652-142-0x0000000000400000-0x0000000000429000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
ff766cdd10083147250eabfcaa76bebb.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation ff766cdd10083147250eabfcaa76bebb.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ff766cdd10083147250eabfcaa76bebb.exedescription pid process target process PID 2204 set thread context of 652 2204 ff766cdd10083147250eabfcaa76bebb.exe ff766cdd10083147250eabfcaa76bebb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exeff766cdd10083147250eabfcaa76bebb.exepid process 1384 powershell.exe 652 ff766cdd10083147250eabfcaa76bebb.exe 652 ff766cdd10083147250eabfcaa76bebb.exe 1384 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1384 powershell.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ff766cdd10083147250eabfcaa76bebb.exedescription pid process target process PID 2204 wrote to memory of 1384 2204 ff766cdd10083147250eabfcaa76bebb.exe powershell.exe PID 2204 wrote to memory of 1384 2204 ff766cdd10083147250eabfcaa76bebb.exe powershell.exe PID 2204 wrote to memory of 1384 2204 ff766cdd10083147250eabfcaa76bebb.exe powershell.exe PID 2204 wrote to memory of 3332 2204 ff766cdd10083147250eabfcaa76bebb.exe schtasks.exe PID 2204 wrote to memory of 3332 2204 ff766cdd10083147250eabfcaa76bebb.exe schtasks.exe PID 2204 wrote to memory of 3332 2204 ff766cdd10083147250eabfcaa76bebb.exe schtasks.exe PID 2204 wrote to memory of 652 2204 ff766cdd10083147250eabfcaa76bebb.exe ff766cdd10083147250eabfcaa76bebb.exe PID 2204 wrote to memory of 652 2204 ff766cdd10083147250eabfcaa76bebb.exe ff766cdd10083147250eabfcaa76bebb.exe PID 2204 wrote to memory of 652 2204 ff766cdd10083147250eabfcaa76bebb.exe ff766cdd10083147250eabfcaa76bebb.exe PID 2204 wrote to memory of 652 2204 ff766cdd10083147250eabfcaa76bebb.exe ff766cdd10083147250eabfcaa76bebb.exe PID 2204 wrote to memory of 652 2204 ff766cdd10083147250eabfcaa76bebb.exe ff766cdd10083147250eabfcaa76bebb.exe PID 2204 wrote to memory of 652 2204 ff766cdd10083147250eabfcaa76bebb.exe ff766cdd10083147250eabfcaa76bebb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff766cdd10083147250eabfcaa76bebb.exe"C:\Users\Admin\AppData\Local\Temp\ff766cdd10083147250eabfcaa76bebb.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\nofaYQfZLH.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\nofaYQfZLH" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3DE4.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\ff766cdd10083147250eabfcaa76bebb.exe"C:\Users\Admin\AppData\Local\Temp\ff766cdd10083147250eabfcaa76bebb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp3DE4.tmpFilesize
1KB
MD51f9dae69f424275934c1256f7119df53
SHA1222d8c834c02e81bbb8352000d55657b2a2981f7
SHA256ca1b16e099b463ac48326c39b4a6960523644fee3b48ea23648d71c39f617010
SHA512e6573b94b273b8df4ac5116c941a1457041ee514c66dfaa5363675fd9fce838dce63a05dc2bafca6cdb5549b3a62652fa88e113a5d7ce40ac223dfcf3620ee72
-
memory/652-145-0x00000000019A0000-0x0000000001CEA000-memory.dmpFilesize
3.3MB
-
memory/652-142-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/652-141-0x0000000000000000-mapping.dmp
-
memory/1384-136-0x0000000000000000-mapping.dmp
-
memory/1384-150-0x0000000007AB0000-0x000000000812A000-memory.dmpFilesize
6.5MB
-
memory/1384-156-0x00000000074E0000-0x00000000074E8000-memory.dmpFilesize
32KB
-
memory/1384-155-0x00000000077A0000-0x00000000077BA000-memory.dmpFilesize
104KB
-
memory/1384-138-0x0000000002810000-0x0000000002846000-memory.dmpFilesize
216KB
-
memory/1384-154-0x0000000007440000-0x000000000744E000-memory.dmpFilesize
56KB
-
memory/1384-140-0x0000000005280000-0x00000000058A8000-memory.dmpFilesize
6.2MB
-
memory/1384-153-0x00000000076E0000-0x0000000007776000-memory.dmpFilesize
600KB
-
memory/1384-152-0x00000000074B0000-0x00000000074BA000-memory.dmpFilesize
40KB
-
memory/1384-143-0x0000000005180000-0x00000000051A2000-memory.dmpFilesize
136KB
-
memory/1384-144-0x0000000005A60000-0x0000000005AC6000-memory.dmpFilesize
408KB
-
memory/1384-151-0x00000000072E0000-0x00000000072FA000-memory.dmpFilesize
104KB
-
memory/1384-146-0x0000000005AF0000-0x0000000005B0E000-memory.dmpFilesize
120KB
-
memory/1384-147-0x0000000007300000-0x0000000007332000-memory.dmpFilesize
200KB
-
memory/1384-148-0x0000000071440000-0x000000007148C000-memory.dmpFilesize
304KB
-
memory/1384-149-0x0000000006570000-0x000000000658E000-memory.dmpFilesize
120KB
-
memory/2204-135-0x0000000008DA0000-0x0000000008E06000-memory.dmpFilesize
408KB
-
memory/2204-131-0x0000000005980000-0x0000000005F24000-memory.dmpFilesize
5.6MB
-
memory/2204-132-0x00000000053D0000-0x0000000005462000-memory.dmpFilesize
584KB
-
memory/2204-133-0x0000000005330000-0x000000000533A000-memory.dmpFilesize
40KB
-
memory/2204-134-0x0000000008A70000-0x0000000008B0C000-memory.dmpFilesize
624KB
-
memory/2204-130-0x00000000008D0000-0x0000000000962000-memory.dmpFilesize
584KB
-
memory/3332-137-0x0000000000000000-mapping.dmp