Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
27-07-2022 13:39
Static task
static1
Behavioral task
behavioral1
Sample
819d2fdff92e281140049b008d9e368f.exe
Resource
win7-20220715-en
General
-
Target
819d2fdff92e281140049b008d9e368f.exe
-
Size
889KB
-
MD5
819d2fdff92e281140049b008d9e368f
-
SHA1
2ee177f5965d7275e9dd04bb888a7c5578b19e07
-
SHA256
d44bc10f5bd18cc0467b5c3198014ff93c133b12b503b860c8d7eeba0ca60329
-
SHA512
be2255c7c1eabf628cfd96281cdbc12b8379be5d94e0080dbd4f8bc86efe02ee252137d68499f5d55b3e20d5eb89e593443a1315ad122b20238d67348e62e90a
Malware Config
Extracted
xloader
2.6
pdrq
welchsunstar.com
mppservicesllc.com
wiresofteflon.com
brabov.xyz
compnonoch.site
yourbuilderworks.com
iamsamirahman.com
eriqoes.com
eastudio.design
skyearth-est.com
teethfitness.com
razaancreates.com
shfbfs.com
joyfulbrokekids.com
kjbolden.com
howirep.com
deedeesmainecoons.website
e-powair.com
aheatea.com
shalfey0009.xyz
designcolor.style
netflixpaymentpending.ca
bothoitrang3.site
motondiarts.com
staynmocean.com
miamivideoshows.com
berendsit.com
yndzjs.com
yiwenhome.xyz
royaldeals.net
clearvison-ts.com
peluqueriasusanagalan.com
thelittlewellnessstudio.com
gurulotaska.com
smgsj.com
followpanelbd.com
prinirwedding.com
3559.fyi
amcvips.com
bigroof.top
chipbio-zt.com
candelasluxuryretreat.com
jboycephotography.com
affiliateindex.xyz
grannysseasonings.com
lcl-inc-test.com
beadallcreations.jewelry
yzzhome.top
tobe-science.com
cincinnaticustomrenovation.com
survaicommercial.xyz
businessdirectorymania.com
phqworld.com
miamigocars.com
labfour.systems
gregoryzeitler.com
dj-mary.com
one1-day.com
vegfiber.com
sfbayraw.net
xn--bndarsloto-s4a.com
felipesb.com
108580.com
1swj06mjrowgi.xyz
koalaglen.com
Signatures
-
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1300-67-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1300-68-0x000000000041F270-mapping.dmp xloader behavioral1/memory/1300-70-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1976-79-0x0000000000080000-0x00000000000AB000-memory.dmp xloader behavioral1/memory/1976-83-0x0000000000080000-0x00000000000AB000-memory.dmp xloader -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
chkdsk.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\0D4HS0RH8DNX = "C:\\Program Files (x86)\\Lrfipnz\\gdimjalrp.exe" chkdsk.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
819d2fdff92e281140049b008d9e368f.exeRegSvcs.exechkdsk.exedescription pid process target process PID 908 set thread context of 1300 908 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 1300 set thread context of 1272 1300 RegSvcs.exe Explorer.EXE PID 1976 set thread context of 1272 1976 chkdsk.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
chkdsk.exedescription ioc process File opened for modification C:\Program Files (x86)\Lrfipnz\gdimjalrp.exe chkdsk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Processes:
chkdsk.exedescription ioc process Key created \Registry\User\S-1-5-21-335065374-4263250628-1829373619-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
819d2fdff92e281140049b008d9e368f.exeRegSvcs.exepowershell.exechkdsk.exepid process 908 819d2fdff92e281140049b008d9e368f.exe 908 819d2fdff92e281140049b008d9e368f.exe 1300 RegSvcs.exe 1300 RegSvcs.exe 1392 powershell.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
RegSvcs.exechkdsk.exepid process 1300 RegSvcs.exe 1300 RegSvcs.exe 1300 RegSvcs.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe 1976 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
819d2fdff92e281140049b008d9e368f.exeRegSvcs.exepowershell.exechkdsk.exedescription pid process Token: SeDebugPrivilege 908 819d2fdff92e281140049b008d9e368f.exe Token: SeDebugPrivilege 1300 RegSvcs.exe Token: SeDebugPrivilege 1392 powershell.exe Token: SeDebugPrivilege 1976 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
819d2fdff92e281140049b008d9e368f.exeExplorer.EXEchkdsk.exedescription pid process target process PID 908 wrote to memory of 1392 908 819d2fdff92e281140049b008d9e368f.exe powershell.exe PID 908 wrote to memory of 1392 908 819d2fdff92e281140049b008d9e368f.exe powershell.exe PID 908 wrote to memory of 1392 908 819d2fdff92e281140049b008d9e368f.exe powershell.exe PID 908 wrote to memory of 1392 908 819d2fdff92e281140049b008d9e368f.exe powershell.exe PID 908 wrote to memory of 952 908 819d2fdff92e281140049b008d9e368f.exe schtasks.exe PID 908 wrote to memory of 952 908 819d2fdff92e281140049b008d9e368f.exe schtasks.exe PID 908 wrote to memory of 952 908 819d2fdff92e281140049b008d9e368f.exe schtasks.exe PID 908 wrote to memory of 952 908 819d2fdff92e281140049b008d9e368f.exe schtasks.exe PID 908 wrote to memory of 1300 908 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 908 wrote to memory of 1300 908 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 908 wrote to memory of 1300 908 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 908 wrote to memory of 1300 908 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 908 wrote to memory of 1300 908 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 908 wrote to memory of 1300 908 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 908 wrote to memory of 1300 908 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 908 wrote to memory of 1300 908 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 908 wrote to memory of 1300 908 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 908 wrote to memory of 1300 908 819d2fdff92e281140049b008d9e368f.exe RegSvcs.exe PID 1272 wrote to memory of 1976 1272 Explorer.EXE chkdsk.exe PID 1272 wrote to memory of 1976 1272 Explorer.EXE chkdsk.exe PID 1272 wrote to memory of 1976 1272 Explorer.EXE chkdsk.exe PID 1272 wrote to memory of 1976 1272 Explorer.EXE chkdsk.exe PID 1976 wrote to memory of 1360 1976 chkdsk.exe cmd.exe PID 1976 wrote to memory of 1360 1976 chkdsk.exe cmd.exe PID 1976 wrote to memory of 1360 1976 chkdsk.exe cmd.exe PID 1976 wrote to memory of 1360 1976 chkdsk.exe cmd.exe PID 1976 wrote to memory of 628 1976 chkdsk.exe Firefox.exe PID 1976 wrote to memory of 628 1976 chkdsk.exe Firefox.exe PID 1976 wrote to memory of 628 1976 chkdsk.exe Firefox.exe PID 1976 wrote to memory of 628 1976 chkdsk.exe Firefox.exe PID 1976 wrote to memory of 628 1976 chkdsk.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\819d2fdff92e281140049b008d9e368f.exe"C:\Users\Admin\AppData\Local\Temp\819d2fdff92e281140049b008d9e368f.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IlJWnRO.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IlJWnRO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1881.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1881.tmpFilesize
1KB
MD51e2648a1caceb7b167cde3eea5645708
SHA1a12ef7fd817c7dc251238143a00d27130ea5f6fe
SHA2566749394dea0559cec0b165a1f4d5b63b8abf11c2cf9225c15e7463f2f54984e8
SHA5120abe0f1d0d0928a3ac37419cb7f131afa2c4b4d7aa830e68160c83f216003b0f3a6f5e65d3e919c7a27bfc2bc01a97803c89f16da772eaa2f7ff2e6ada4a0cbb
-
memory/908-63-0x0000000000EA0000-0x0000000000ED4000-memory.dmpFilesize
208KB
-
memory/908-54-0x0000000000ED0000-0x0000000000FB4000-memory.dmpFilesize
912KB
-
memory/908-56-0x0000000000410000-0x0000000000426000-memory.dmpFilesize
88KB
-
memory/908-58-0x000000000A580000-0x000000000A602000-memory.dmpFilesize
520KB
-
memory/908-57-0x0000000000440000-0x000000000044A000-memory.dmpFilesize
40KB
-
memory/908-55-0x0000000075891000-0x0000000075893000-memory.dmpFilesize
8KB
-
memory/952-60-0x0000000000000000-mapping.dmp
-
memory/1272-82-0x00000000068D0000-0x00000000069E8000-memory.dmpFilesize
1.1MB
-
memory/1272-84-0x00000000068D0000-0x00000000069E8000-memory.dmpFilesize
1.1MB
-
memory/1272-74-0x0000000004DE0000-0x0000000004E91000-memory.dmpFilesize
708KB
-
memory/1300-67-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1300-68-0x000000000041F270-mapping.dmp
-
memory/1300-70-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1300-65-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1300-72-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/1300-73-0x0000000000210000-0x0000000000221000-memory.dmpFilesize
68KB
-
memory/1300-64-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1360-77-0x0000000000000000-mapping.dmp
-
memory/1392-71-0x000000006E7F0000-0x000000006ED9B000-memory.dmpFilesize
5.7MB
-
memory/1392-75-0x000000006E7F0000-0x000000006ED9B000-memory.dmpFilesize
5.7MB
-
memory/1392-59-0x0000000000000000-mapping.dmp
-
memory/1976-76-0x0000000000000000-mapping.dmp
-
memory/1976-78-0x0000000000340000-0x0000000000347000-memory.dmpFilesize
28KB
-
memory/1976-79-0x0000000000080000-0x00000000000AB000-memory.dmpFilesize
172KB
-
memory/1976-80-0x0000000002040000-0x0000000002343000-memory.dmpFilesize
3.0MB
-
memory/1976-81-0x0000000000490000-0x0000000000520000-memory.dmpFilesize
576KB
-
memory/1976-83-0x0000000000080000-0x00000000000AB000-memory.dmpFilesize
172KB