Analysis
-
max time kernel
154s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 13:04
Static task
static1
Behavioral task
behavioral1
Sample
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe
Resource
win10v2004-20220812-en
General
-
Target
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe
-
Size
748KB
-
MD5
233f3620139e38ec5ae44f2ea73b2122
-
SHA1
4e582a1411167b7eb59633fe3102c4c1cd19b92f
-
SHA256
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303
-
SHA512
76764469bf253fe56a8c9d543ce327b4bdb60a058041dcd97ceebc9d47999e47221326315d7616fb04dd19376ed64a7857f6f06ce7fa7fbcb841873044262593
-
SSDEEP
12288:geWzt13drPsKlgTA0Ow/WnX5m9stu1EgpU55jgG4HdRUdWQiHL:gee4KCOznX5R4KgQ5RBC
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
xlobkpb.exexlobkpb.exepid process 3592 xlobkpb.exe 324 xlobkpb.exe -
Loads dropped DLL 2 IoCs
Processes:
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exexlobkpb.exepid process 4776 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe 3592 xlobkpb.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exexlobkpb.exedescription pid process target process PID 4776 set thread context of 5080 4776 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe PID 3592 set thread context of 324 3592 xlobkpb.exe xlobkpb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe nsis_installer_2 C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exexlobkpb.exepid process 5080 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe 5080 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe 324 xlobkpb.exe 324 xlobkpb.exe 324 xlobkpb.exe 324 xlobkpb.exe 324 xlobkpb.exe 324 xlobkpb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
xlobkpb.exedescription pid process Token: SeDebugPrivilege 324 xlobkpb.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exexlobkpb.exexlobkpb.exedescription pid process target process PID 4776 wrote to memory of 5080 4776 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe PID 4776 wrote to memory of 5080 4776 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe PID 4776 wrote to memory of 5080 4776 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe PID 4776 wrote to memory of 5080 4776 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe PID 4776 wrote to memory of 5080 4776 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe PID 4776 wrote to memory of 5080 4776 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe 0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe PID 3592 wrote to memory of 324 3592 xlobkpb.exe xlobkpb.exe PID 3592 wrote to memory of 324 3592 xlobkpb.exe xlobkpb.exe PID 3592 wrote to memory of 324 3592 xlobkpb.exe xlobkpb.exe PID 3592 wrote to memory of 324 3592 xlobkpb.exe xlobkpb.exe PID 3592 wrote to memory of 324 3592 xlobkpb.exe xlobkpb.exe PID 3592 wrote to memory of 324 3592 xlobkpb.exe xlobkpb.exe PID 324 wrote to memory of 796 324 xlobkpb.exe svchost.exe
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Users\Admin\AppData\Local\Temp\0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe"C:\Users\Admin\AppData\Local\Temp\0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe"C:\Users\Admin\AppData\Local\Temp\0e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exeC:\Users\Admin\AppData\Local\Temp\xlobkpb.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe"C:\Users\Admin\AppData\Local\Temp\xlobkpb.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Package Cache\xkefqneFilesize
654B
MD54e4b1505e29d7ffb28828b56d01ff9c4
SHA1aa98cec0d4a274e92b74c94cd66940eb5e5b7e33
SHA25626a9783462787f3db770151e88eb8933733b18f7595f7d3a508c5ba7b285b6ac
SHA5121d96144f90e2e38418b7c7ee4ab2fe453ded1d1c01dfcc3d54ae329c784dc834c2a35158403eb914dfbf3738d80ffa35475c7ad0f73da975221a0c049649b107
-
C:\ProgramData\Package Cache\xkefqneFilesize
654B
MD54e4b1505e29d7ffb28828b56d01ff9c4
SHA1aa98cec0d4a274e92b74c94cd66940eb5e5b7e33
SHA25626a9783462787f3db770151e88eb8933733b18f7595f7d3a508c5ba7b285b6ac
SHA5121d96144f90e2e38418b7c7ee4ab2fe453ded1d1c01dfcc3d54ae329c784dc834c2a35158403eb914dfbf3738d80ffa35475c7ad0f73da975221a0c049649b107
-
C:\Users\Admin\AppData\Local\Temp\nsm2AEA.tmp\kiosk.dllFilesize
66KB
MD592ffa507f5b3d9ae074c20894b724629
SHA199af0b89d400cfc7bbea381471d01f2599eb55a3
SHA2565aae1e7c174883e0ebd0220d8d5e897fc5fac10c4f86a1ad009640e24a6ae7c1
SHA51222192058ec654db53ed026dcbf568489315478c765ab6fd8f74304ca46019f5ce2272fff4bfaaabf8d49fbb02b7511812da40ee8211b60da508a4a980fa3641b
-
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exeFilesize
748KB
MD5233f3620139e38ec5ae44f2ea73b2122
SHA14e582a1411167b7eb59633fe3102c4c1cd19b92f
SHA2560e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303
SHA51276764469bf253fe56a8c9d543ce327b4bdb60a058041dcd97ceebc9d47999e47221326315d7616fb04dd19376ed64a7857f6f06ce7fa7fbcb841873044262593
-
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exeFilesize
748KB
MD5233f3620139e38ec5ae44f2ea73b2122
SHA14e582a1411167b7eb59633fe3102c4c1cd19b92f
SHA2560e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303
SHA51276764469bf253fe56a8c9d543ce327b4bdb60a058041dcd97ceebc9d47999e47221326315d7616fb04dd19376ed64a7857f6f06ce7fa7fbcb841873044262593
-
C:\Users\Admin\AppData\Local\Temp\xlobkpb.exeFilesize
748KB
MD5233f3620139e38ec5ae44f2ea73b2122
SHA14e582a1411167b7eb59633fe3102c4c1cd19b92f
SHA2560e4893b6d43728b8d7b9c1483ac5aa03eaa2be552963703369461bb77e653303
SHA51276764469bf253fe56a8c9d543ce327b4bdb60a058041dcd97ceebc9d47999e47221326315d7616fb04dd19376ed64a7857f6f06ce7fa7fbcb841873044262593
-
C:\Windows\Temp\nsuDE4C.tmp\kiosk.dllFilesize
66KB
MD592ffa507f5b3d9ae074c20894b724629
SHA199af0b89d400cfc7bbea381471d01f2599eb55a3
SHA2565aae1e7c174883e0ebd0220d8d5e897fc5fac10c4f86a1ad009640e24a6ae7c1
SHA51222192058ec654db53ed026dcbf568489315478c765ab6fd8f74304ca46019f5ce2272fff4bfaaabf8d49fbb02b7511812da40ee8211b60da508a4a980fa3641b
-
memory/324-142-0x0000000000000000-mapping.dmp
-
memory/324-147-0x00000000008C0000-0x0000000000B0B000-memory.dmpFilesize
2.3MB
-
memory/796-148-0x000000000C210000-0x000000000C287000-memory.dmpFilesize
476KB
-
memory/5080-138-0x00000000009A0000-0x0000000000BEB000-memory.dmpFilesize
2.3MB
-
memory/5080-137-0x0000000000400000-0x00000000004A4600-memory.dmpFilesize
657KB
-
memory/5080-136-0x0000000000780000-0x000000000099A000-memory.dmpFilesize
2.1MB
-
memory/5080-134-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB
-
memory/5080-133-0x0000000000000000-mapping.dmp