Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 04:18
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order MRQ-5525.exe
Resource
win7-20220812-en
General
-
Target
Purchase Order MRQ-5525.exe
-
Size
322KB
-
MD5
aac47b26622b7b112abb2cf4545409b4
-
SHA1
a1878da3ea31f946527897a759ffb1c9393fe426
-
SHA256
f46d6d7bf1c9f466498c2a11c9c96fcc594c3490db04e763f81e7552f7ae6764
-
SHA512
ec2eb8dc95fab52b7d5a8419dd4727e185b23e355de17fbbd8c512f84f07ac1822307c76f9239861ce6266f4dc71e568c7246c6321da0d02cce0674c231f3ef9
-
SSDEEP
6144:T0YnOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOy:lOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO3
Malware Config
Extracted
xloader
2.6
ygkp
cbdlively.com
1nfo-post.com
janejohnsonlmt.com
autotradecryptoswithjack.com
mustang-international.net
dreamthorp.com
alexandratanner.net
exilings.com
gzjdgjg.com
51minzhu.com
wgv.info
raymondjamesconsult.com
omariblair.com
vaalerahealth.com
outdoorvoiceshop.com
spbo.info
blasiandating.online
c01-cdn48-oxble.xyz
mrmycology.com
installturbooax.com
duoxiyuemy.com
creativeartwithcarol.com
jasonatenphotography.net
hhcstarusa.com
91itaogo.com
itubini.com
trypetinsure.com
koushi3737.com
gujiufz.xyz
nereklam.com
greenlandtours.net
furrycutiepet.com
boredmilady.xyz
thepromenadeboutique.com
antoinevigne.com
affinityassurance.ltd
trmstudiotx.com
ganeshpyropark.com
rivaln.net
loupsychiatry.com
ballenasnegras.store
treylonburksjersey.com
cumannstaire.com
vintagemuseumct.com
reich-consulting.com
emmagabriele.com
form4506-t.net
al-muhamdi.com
ggmaprimarycare.com
q0fagmy6x5ctmxn6vykr.com
nqted.com
rebelsoflove.life
birdiecrafts.site
acrostical.info
usarealshop.com
d908.red
vspashkapolya.store
locksmith---pasadena.com
itooktheorangepill.com
findachristianbusiness.com
authorlanijames.com
cryptoreportfraud.com
idolovetheusa.com
moicapitaine.com
southwestcancer.com
Signatures
-
Xloader payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1388-63-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1388-64-0x000000000041F350-mapping.dmp xloader behavioral1/memory/1388-67-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1084-75-0x00000000000C0000-0x00000000000EB000-memory.dmp xloader behavioral1/memory/1084-79-0x00000000000C0000-0x00000000000EB000-memory.dmp xloader -
Executes dropped EXE 3 IoCs
Processes:
ugoumezapn.exeugoumezapn.exemfccbcpfzx.exepid process 1592 ugoumezapn.exe 1388 ugoumezapn.exe 1932 mfccbcpfzx.exe -
Loads dropped DLL 5 IoCs
Processes:
Purchase Order MRQ-5525.exeugoumezapn.exeWerFault.exepid process 2012 Purchase Order MRQ-5525.exe 1592 ugoumezapn.exe 1728 WerFault.exe 1728 WerFault.exe 1728 WerFault.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
help.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run help.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\-Z-XJLGPTH = "C:\\Program Files (x86)\\Dbbcdufw\\mfccbcpfzx.exe" help.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ugoumezapn.exeugoumezapn.exehelp.exedescription pid process target process PID 1592 set thread context of 1388 1592 ugoumezapn.exe ugoumezapn.exe PID 1388 set thread context of 1248 1388 ugoumezapn.exe Explorer.EXE PID 1084 set thread context of 1248 1084 help.exe Explorer.EXE -
Drops file in Program Files directory 2 IoCs
Processes:
help.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Dbbcdufw\mfccbcpfzx.exe help.exe File created C:\Program Files (x86)\Dbbcdufw\mfccbcpfzx.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1728 1932 WerFault.exe mfccbcpfzx.exe -
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 help.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
ugoumezapn.exehelp.exepid process 1388 ugoumezapn.exe 1388 ugoumezapn.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
ugoumezapn.exehelp.exepid process 1388 ugoumezapn.exe 1388 ugoumezapn.exe 1388 ugoumezapn.exe 1084 help.exe 1084 help.exe 1084 help.exe 1084 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ugoumezapn.exehelp.exedescription pid process Token: SeDebugPrivilege 1388 ugoumezapn.exe Token: SeDebugPrivilege 1084 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
Purchase Order MRQ-5525.exeugoumezapn.exeExplorer.EXEhelp.exemfccbcpfzx.exedescription pid process target process PID 2012 wrote to memory of 1592 2012 Purchase Order MRQ-5525.exe ugoumezapn.exe PID 2012 wrote to memory of 1592 2012 Purchase Order MRQ-5525.exe ugoumezapn.exe PID 2012 wrote to memory of 1592 2012 Purchase Order MRQ-5525.exe ugoumezapn.exe PID 2012 wrote to memory of 1592 2012 Purchase Order MRQ-5525.exe ugoumezapn.exe PID 1592 wrote to memory of 1388 1592 ugoumezapn.exe ugoumezapn.exe PID 1592 wrote to memory of 1388 1592 ugoumezapn.exe ugoumezapn.exe PID 1592 wrote to memory of 1388 1592 ugoumezapn.exe ugoumezapn.exe PID 1592 wrote to memory of 1388 1592 ugoumezapn.exe ugoumezapn.exe PID 1592 wrote to memory of 1388 1592 ugoumezapn.exe ugoumezapn.exe PID 1592 wrote to memory of 1388 1592 ugoumezapn.exe ugoumezapn.exe PID 1592 wrote to memory of 1388 1592 ugoumezapn.exe ugoumezapn.exe PID 1248 wrote to memory of 1084 1248 Explorer.EXE help.exe PID 1248 wrote to memory of 1084 1248 Explorer.EXE help.exe PID 1248 wrote to memory of 1084 1248 Explorer.EXE help.exe PID 1248 wrote to memory of 1084 1248 Explorer.EXE help.exe PID 1084 wrote to memory of 1704 1084 help.exe cmd.exe PID 1084 wrote to memory of 1704 1084 help.exe cmd.exe PID 1084 wrote to memory of 1704 1084 help.exe cmd.exe PID 1084 wrote to memory of 1704 1084 help.exe cmd.exe PID 1084 wrote to memory of 1152 1084 help.exe Firefox.exe PID 1084 wrote to memory of 1152 1084 help.exe Firefox.exe PID 1084 wrote to memory of 1152 1084 help.exe Firefox.exe PID 1084 wrote to memory of 1152 1084 help.exe Firefox.exe PID 1084 wrote to memory of 1152 1084 help.exe Firefox.exe PID 1248 wrote to memory of 1932 1248 Explorer.EXE mfccbcpfzx.exe PID 1248 wrote to memory of 1932 1248 Explorer.EXE mfccbcpfzx.exe PID 1248 wrote to memory of 1932 1248 Explorer.EXE mfccbcpfzx.exe PID 1248 wrote to memory of 1932 1248 Explorer.EXE mfccbcpfzx.exe PID 1932 wrote to memory of 1728 1932 mfccbcpfzx.exe WerFault.exe PID 1932 wrote to memory of 1728 1932 mfccbcpfzx.exe WerFault.exe PID 1932 wrote to memory of 1728 1932 mfccbcpfzx.exe WerFault.exe PID 1932 wrote to memory of 1728 1932 mfccbcpfzx.exe WerFault.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order MRQ-5525.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order MRQ-5525.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exeC:\Users\Admin\AppData\Local\Temp\ugoumezapn.exe C:\Users\Admin\AppData\Local\Temp\ytsjpl3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exeC:\Users\Admin\AppData\Local\Temp\ugoumezapn.exe C:\Users\Admin\AppData\Local\Temp\ytsjpl4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Dbbcdufw\mfccbcpfzx.exe"C:\Program Files (x86)\Dbbcdufw\mfccbcpfzx.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 2043⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Dbbcdufw\mfccbcpfzx.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
C:\Users\Admin\AppData\Local\Temp\y84jg0z3myvs1ehqFilesize
171KB
MD5213b7ae988a475d2096b03e8b58c0cba
SHA18634ccaf2a816cc81363722430de5799b52eecd8
SHA256997ba82b07c3d33f225975826ccfccabb6e13964bbc66bea8b484474fa067ccb
SHA5129c167e42900af5df67fdc0ddbbcb9024d976667bee5427be5810c5df463deaf51c5ff96930be5100953940f8c57c29c47a656026268d7fba854eaec29a429ca6
-
C:\Users\Admin\AppData\Local\Temp\ytsjplFilesize
5KB
MD5e89c8f428bf1e9512047a530ffab4cc0
SHA1dae18c62de9ad71aaace440e570e0066d9977473
SHA256b57b56853e974693eea1b67cccc726eeca122fc05587fc18cf86ad908c83ad21
SHA512b9dadf686f1132456935afa2c0b3089565a727916d09658ffe321f48bbbea49ccd0446c61ce22567b5f0a9f1b81e9897cfbe0bd8d1131a9bb079f11cb4336271
-
\Program Files (x86)\Dbbcdufw\mfccbcpfzx.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
\Program Files (x86)\Dbbcdufw\mfccbcpfzx.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
\Program Files (x86)\Dbbcdufw\mfccbcpfzx.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
\Users\Admin\AppData\Local\Temp\ugoumezapn.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
\Users\Admin\AppData\Local\Temp\ugoumezapn.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
memory/1084-73-0x0000000000CE0000-0x0000000000CE6000-memory.dmpFilesize
24KB
-
memory/1084-79-0x00000000000C0000-0x00000000000EB000-memory.dmpFilesize
172KB
-
memory/1084-76-0x0000000000470000-0x0000000000500000-memory.dmpFilesize
576KB
-
memory/1084-75-0x00000000000C0000-0x00000000000EB000-memory.dmpFilesize
172KB
-
memory/1084-71-0x0000000000000000-mapping.dmp
-
memory/1084-74-0x0000000000860000-0x0000000000B63000-memory.dmpFilesize
3.0MB
-
memory/1248-70-0x0000000004B00000-0x0000000004C79000-memory.dmpFilesize
1.5MB
-
memory/1248-80-0x0000000002A70000-0x0000000002B11000-memory.dmpFilesize
644KB
-
memory/1248-78-0x0000000004B00000-0x0000000004C79000-memory.dmpFilesize
1.5MB
-
memory/1248-77-0x0000000002A70000-0x0000000002B11000-memory.dmpFilesize
644KB
-
memory/1388-69-0x0000000000290000-0x00000000002A1000-memory.dmpFilesize
68KB
-
memory/1388-68-0x0000000000A10000-0x0000000000D13000-memory.dmpFilesize
3.0MB
-
memory/1388-67-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1388-64-0x000000000041F350-mapping.dmp
-
memory/1388-63-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1592-56-0x0000000000000000-mapping.dmp
-
memory/1704-72-0x0000000000000000-mapping.dmp
-
memory/1728-85-0x0000000000000000-mapping.dmp
-
memory/1932-82-0x0000000000000000-mapping.dmp
-
memory/2012-54-0x0000000075E81000-0x0000000075E83000-memory.dmpFilesize
8KB