Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 20:20
Static task
static1
Behavioral task
behavioral1
Sample
Scan SOA.exe
Resource
win7-20220414-en
General
-
Target
Scan SOA.exe
-
Size
500KB
-
MD5
e69167de6d19a41819f25de01cd10aef
-
SHA1
c302c06e1cb00e72013b0671ba0db1a541673289
-
SHA256
4863509ff407e4a6389305b5555bc804aa5df9b67290feeb1e36bf68f40696e1
-
SHA512
73ec2711e5c3076fee07a03db0289887946a66d3f6656ece5a12db6ad672424368a6e9b5feb339b97a8cec63bf3869b8062f90335fb58e99a9894ef0afa742e1
Malware Config
Extracted
xloader
2.8
nmd2
FNWENUOMqqSv0Q==
ls6DEbQ1KBCeSsvUyRg=
mwgrjwpFplaykGoT
Uzzj8yXi13iLMnNGZcnViQliwA==
T7vzj0l0lqquyA==
csHzBjwvF7rmjcmWxjThd61NuuVl4gQ=
YaXyTwg3p1vrf/n9kYJQjrc=
cHAfFEI1JKDF4mTsGjDbeg==
TdDv+o9VSFep3wgTtY0swqQ=
Jw66vdyXdRZG9jJZycLD
icGvsuKZgXNid1M=
6m6H0GvguY+vZZpcioudbQ==
kNUBYMuymhgm2b0q3bEAiQliwA==
M3SiAXRbVe0XAsxDOIp6cg==
+eWLk+HjRRe3LuyavQ==
753R3QYD8XOWtWI0ouGpYw==
dRg+bQZ6TSbC8Sbs2mXXxLM=
kDlUsE+U7Y/RfUQ=
oENlcFZVqqSv0Q==
HCC+nbachxEs1f29GjDbeg==
ctsJlTxo3LFbK0RZycLD
VAV965YJquX+b2gE
wUpcvG0A0kxkhA6dsxec/Ufb
+Kzh3Pz/WTFKLuyavQ==
5IBvVoiTqqSv0Q==
qhS7ELozBsxWGdGNLWXXxLM=
sIdm8Gid7Y/RfUQ=
o9jFl8KnrZEe2UrO2mXXxLM=
eecJaOIceBS8YCLfz2XXxLM=
wvauO+RYyniHRncupG0Ten2V2PDf
meDvRhWM7I/RfUQ=
LlL2kO+2mQQBt6Mbi3M85yXR
/5hqNCjixE1T+DRZycLD
mghXL0b5y1BTAeKFZgcVnbs=
vpRLqCgVpBo+
MhWVgapZL/AkxgTV9WAniQliwA==
G1w14UrRoHGpQ2UVK4BOy+cryA==
Xfjtvd7Rx2B9KWsoP7tp2dGrHmR49g==
YV3YuM5Fbwwp
6l5Yu2CUBLdfCsCe1E47UUFRqOVl4gQ=
zvsbe+zuUwGeQ8vUyRg=
1cI0GBeUfY/RfUQ=
nWgfnkDEUGOJLuyavQ==
0bosGEv++89jmJdZycLD
k55xymOPqqSv0Q==
9Vo/hSEVpBo+
Goh71Ec2I5igPHhLh/mfMmK1d4RK4BA=
ejin8nSfnQonPPibLWXXxLM=
yQUskS2vGpw=
YCbKnMOAcS5Y+zBZycLD
UsS4CoF4lqquyA==
FpSWpcVFbwwp
vFSrpMeaqqSv0Q==
tFR01kVKp0L6IRiD9c7Of5Gus1L3/g==
yr44IihjQHNid1M=
2VRJm0F25df4EZY9bdXViQliwA==
jm/jvLpEJfmbUfbOAH5IaYmZTuVl4gQ=
iYId/jAYAao9W1Oz20NHfcakEBY=
tiUNWfcurI6YSYQ5U7m4ysDQLVBMgdA6iw==
ZeixX31Fbwwp
7FBmslXBOQwbzrIwoXNBiQliwA==
VVr3w7qAY8/hAH5hZsDU
vDlm1IsR5KjVf276e18NPWGBTOVl4gQ=
IxGhEq722C9Yfbn6GjDbeg==
gelasbeauty.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1964-62-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1964-63-0x000000000041F650-mapping.dmp xloader behavioral1/memory/1964-69-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral1/memory/1924-73-0x0000000000080000-0x00000000000AC000-memory.dmp xloader behavioral1/memory/1924-77-0x0000000000080000-0x00000000000AC000-memory.dmp xloader -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Scan SOA.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\International\Geo\Nation Scan SOA.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 776 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Scan SOA.exeScan SOA.execolorcpl.exedescription pid process target process PID 1708 set thread context of 1964 1708 Scan SOA.exe Scan SOA.exe PID 1964 set thread context of 1208 1964 Scan SOA.exe Explorer.EXE PID 1924 set thread context of 1208 1924 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
Scan SOA.execolorcpl.exepid process 1964 Scan SOA.exe 1964 Scan SOA.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe 1924 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Scan SOA.execolorcpl.exepid process 1964 Scan SOA.exe 1964 Scan SOA.exe 1964 Scan SOA.exe 1924 colorcpl.exe 1924 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Scan SOA.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1964 Scan SOA.exe Token: SeDebugPrivilege 1924 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Scan SOA.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1708 wrote to memory of 1964 1708 Scan SOA.exe Scan SOA.exe PID 1708 wrote to memory of 1964 1708 Scan SOA.exe Scan SOA.exe PID 1708 wrote to memory of 1964 1708 Scan SOA.exe Scan SOA.exe PID 1708 wrote to memory of 1964 1708 Scan SOA.exe Scan SOA.exe PID 1708 wrote to memory of 1964 1708 Scan SOA.exe Scan SOA.exe PID 1708 wrote to memory of 1964 1708 Scan SOA.exe Scan SOA.exe PID 1708 wrote to memory of 1964 1708 Scan SOA.exe Scan SOA.exe PID 1208 wrote to memory of 1924 1208 Explorer.EXE colorcpl.exe PID 1208 wrote to memory of 1924 1208 Explorer.EXE colorcpl.exe PID 1208 wrote to memory of 1924 1208 Explorer.EXE colorcpl.exe PID 1208 wrote to memory of 1924 1208 Explorer.EXE colorcpl.exe PID 1924 wrote to memory of 776 1924 colorcpl.exe cmd.exe PID 1924 wrote to memory of 776 1924 colorcpl.exe cmd.exe PID 1924 wrote to memory of 776 1924 colorcpl.exe cmd.exe PID 1924 wrote to memory of 776 1924 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan SOA.exe"C:\Users\Admin\AppData\Local\Temp\Scan SOA.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan SOA.exe"{path}"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Scan SOA.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/776-71-0x0000000000000000-mapping.dmp
-
memory/1208-78-0x0000000005F40000-0x0000000006027000-memory.dmpFilesize
924KB
-
memory/1208-67-0x0000000004080000-0x0000000004139000-memory.dmpFilesize
740KB
-
memory/1208-76-0x0000000005F40000-0x0000000006027000-memory.dmpFilesize
924KB
-
memory/1708-57-0x00000000062E0000-0x0000000006360000-memory.dmpFilesize
512KB
-
memory/1708-54-0x0000000000F20000-0x0000000000FA4000-memory.dmpFilesize
528KB
-
memory/1708-58-0x0000000000B70000-0x0000000000BA2000-memory.dmpFilesize
200KB
-
memory/1708-56-0x0000000000520000-0x000000000052A000-memory.dmpFilesize
40KB
-
memory/1708-55-0x00000000758D1000-0x00000000758D3000-memory.dmpFilesize
8KB
-
memory/1924-77-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/1924-72-0x0000000000C00000-0x0000000000C18000-memory.dmpFilesize
96KB
-
memory/1924-75-0x0000000000970000-0x0000000000A00000-memory.dmpFilesize
576KB
-
memory/1924-74-0x0000000002020000-0x0000000002323000-memory.dmpFilesize
3.0MB
-
memory/1924-73-0x0000000000080000-0x00000000000AC000-memory.dmpFilesize
176KB
-
memory/1924-68-0x0000000000000000-mapping.dmp
-
memory/1964-59-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1964-69-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1964-66-0x0000000000580000-0x0000000000591000-memory.dmpFilesize
68KB
-
memory/1964-64-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1964-63-0x000000000041F650-mapping.dmp
-
memory/1964-62-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1964-60-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB