Analysis
-
max time kernel
181s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-10-2022 04:18
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order MRQ-5525.exe
Resource
win7-20220812-en
General
-
Target
Purchase Order MRQ-5525.exe
-
Size
322KB
-
MD5
aac47b26622b7b112abb2cf4545409b4
-
SHA1
a1878da3ea31f946527897a759ffb1c9393fe426
-
SHA256
f46d6d7bf1c9f466498c2a11c9c96fcc594c3490db04e763f81e7552f7ae6764
-
SHA512
ec2eb8dc95fab52b7d5a8419dd4727e185b23e355de17fbbd8c512f84f07ac1822307c76f9239861ce6266f4dc71e568c7246c6321da0d02cce0674c231f3ef9
-
SSDEEP
6144:T0YnOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOy:lOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO3
Malware Config
Extracted
xloader
2.6
ygkp
cbdlively.com
1nfo-post.com
janejohnsonlmt.com
autotradecryptoswithjack.com
mustang-international.net
dreamthorp.com
alexandratanner.net
exilings.com
gzjdgjg.com
51minzhu.com
wgv.info
raymondjamesconsult.com
omariblair.com
vaalerahealth.com
outdoorvoiceshop.com
spbo.info
blasiandating.online
c01-cdn48-oxble.xyz
mrmycology.com
installturbooax.com
duoxiyuemy.com
creativeartwithcarol.com
jasonatenphotography.net
hhcstarusa.com
91itaogo.com
itubini.com
trypetinsure.com
koushi3737.com
gujiufz.xyz
nereklam.com
greenlandtours.net
furrycutiepet.com
boredmilady.xyz
thepromenadeboutique.com
antoinevigne.com
affinityassurance.ltd
trmstudiotx.com
ganeshpyropark.com
rivaln.net
loupsychiatry.com
ballenasnegras.store
treylonburksjersey.com
cumannstaire.com
vintagemuseumct.com
reich-consulting.com
emmagabriele.com
form4506-t.net
al-muhamdi.com
ggmaprimarycare.com
q0fagmy6x5ctmxn6vykr.com
nqted.com
rebelsoflove.life
birdiecrafts.site
acrostical.info
usarealshop.com
d908.red
vspashkapolya.store
locksmith---pasadena.com
itooktheorangepill.com
findachristianbusiness.com
authorlanijames.com
cryptoreportfraud.com
idolovetheusa.com
moicapitaine.com
southwestcancer.com
Signatures
-
Xloader payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4276-138-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral2/memory/4276-141-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral2/memory/3720-148-0x00000000008A0000-0x00000000008CB000-memory.dmp xloader behavioral2/memory/3720-150-0x00000000008A0000-0x00000000008CB000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
ugoumezapn.exeugoumezapn.exepid process 456 ugoumezapn.exe 4276 ugoumezapn.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
ugoumezapn.exeugoumezapn.exeexplorer.exedescription pid process target process PID 456 set thread context of 4276 456 ugoumezapn.exe ugoumezapn.exe PID 4276 set thread context of 2016 4276 ugoumezapn.exe Explorer.EXE PID 3720 set thread context of 2016 3720 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
ugoumezapn.exeexplorer.exepid process 4276 ugoumezapn.exe 4276 ugoumezapn.exe 4276 ugoumezapn.exe 4276 ugoumezapn.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe 3720 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2016 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
ugoumezapn.exeexplorer.exepid process 4276 ugoumezapn.exe 4276 ugoumezapn.exe 4276 ugoumezapn.exe 3720 explorer.exe 3720 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ugoumezapn.exeexplorer.exedescription pid process Token: SeDebugPrivilege 4276 ugoumezapn.exe Token: SeDebugPrivilege 3720 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Purchase Order MRQ-5525.exeugoumezapn.exeExplorer.EXEexplorer.exedescription pid process target process PID 2712 wrote to memory of 456 2712 Purchase Order MRQ-5525.exe ugoumezapn.exe PID 2712 wrote to memory of 456 2712 Purchase Order MRQ-5525.exe ugoumezapn.exe PID 2712 wrote to memory of 456 2712 Purchase Order MRQ-5525.exe ugoumezapn.exe PID 456 wrote to memory of 4276 456 ugoumezapn.exe ugoumezapn.exe PID 456 wrote to memory of 4276 456 ugoumezapn.exe ugoumezapn.exe PID 456 wrote to memory of 4276 456 ugoumezapn.exe ugoumezapn.exe PID 456 wrote to memory of 4276 456 ugoumezapn.exe ugoumezapn.exe PID 456 wrote to memory of 4276 456 ugoumezapn.exe ugoumezapn.exe PID 456 wrote to memory of 4276 456 ugoumezapn.exe ugoumezapn.exe PID 2016 wrote to memory of 3720 2016 Explorer.EXE explorer.exe PID 2016 wrote to memory of 3720 2016 Explorer.EXE explorer.exe PID 2016 wrote to memory of 3720 2016 Explorer.EXE explorer.exe PID 3720 wrote to memory of 1508 3720 explorer.exe cmd.exe PID 3720 wrote to memory of 1508 3720 explorer.exe cmd.exe PID 3720 wrote to memory of 1508 3720 explorer.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order MRQ-5525.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order MRQ-5525.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exeC:\Users\Admin\AppData\Local\Temp\ugoumezapn.exe C:\Users\Admin\AppData\Local\Temp\ytsjpl2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exeC:\Users\Admin\AppData\Local\Temp\ugoumezapn.exe C:\Users\Admin\AppData\Local\Temp\ytsjpl3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
C:\Users\Admin\AppData\Local\Temp\ugoumezapn.exeFilesize
132KB
MD5c425c007ed7b3ee305dbea78ec07d10e
SHA1c254da6e0a53106504bc6f8db88e3ba0678498b6
SHA2563e839029b68aaccf0e3566d63fa34f9d165c81d365c49ef8fae6d13b1612df19
SHA512d4036e691d4155d4760172dd7b4e5cc6cf70d676735b7d9fcf652ad2002f6710dd2aeff1f500bf36aa54bc2abbc3c9cbed1fa3bf6d8fdfed5b95b79428012ee0
-
C:\Users\Admin\AppData\Local\Temp\y84jg0z3myvs1ehqFilesize
171KB
MD5213b7ae988a475d2096b03e8b58c0cba
SHA18634ccaf2a816cc81363722430de5799b52eecd8
SHA256997ba82b07c3d33f225975826ccfccabb6e13964bbc66bea8b484474fa067ccb
SHA5129c167e42900af5df67fdc0ddbbcb9024d976667bee5427be5810c5df463deaf51c5ff96930be5100953940f8c57c29c47a656026268d7fba854eaec29a429ca6
-
C:\Users\Admin\AppData\Local\Temp\ytsjplFilesize
5KB
MD5e89c8f428bf1e9512047a530ffab4cc0
SHA1dae18c62de9ad71aaace440e570e0066d9977473
SHA256b57b56853e974693eea1b67cccc726eeca122fc05587fc18cf86ad908c83ad21
SHA512b9dadf686f1132456935afa2c0b3089565a727916d09658ffe321f48bbbea49ccd0446c61ce22567b5f0a9f1b81e9897cfbe0bd8d1131a9bb079f11cb4336271
-
memory/456-132-0x0000000000000000-mapping.dmp
-
memory/1508-146-0x0000000000000000-mapping.dmp
-
memory/2016-144-0x0000000007070000-0x00000000071F5000-memory.dmpFilesize
1.5MB
-
memory/2016-153-0x0000000002790000-0x0000000002905000-memory.dmpFilesize
1.5MB
-
memory/2016-152-0x0000000002790000-0x0000000002905000-memory.dmpFilesize
1.5MB
-
memory/3720-151-0x0000000002B20000-0x0000000002BB0000-memory.dmpFilesize
576KB
-
memory/3720-150-0x00000000008A0000-0x00000000008CB000-memory.dmpFilesize
172KB
-
memory/3720-145-0x0000000000000000-mapping.dmp
-
memory/3720-149-0x0000000002CE0000-0x000000000302A000-memory.dmpFilesize
3.3MB
-
memory/3720-147-0x0000000000F50000-0x0000000001383000-memory.dmpFilesize
4.2MB
-
memory/3720-148-0x00000000008A0000-0x00000000008CB000-memory.dmpFilesize
172KB
-
memory/4276-137-0x0000000000000000-mapping.dmp
-
memory/4276-143-0x0000000000F40000-0x0000000000F51000-memory.dmpFilesize
68KB
-
memory/4276-142-0x0000000001500000-0x000000000184A000-memory.dmpFilesize
3.3MB
-
memory/4276-141-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/4276-138-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB