Overview

overview

10

Static

static

10

bin/Encode....4.exe

windows11-21h2-x64

10

src/crypte...er.exe

windows11-21h2-x64

3

Resubmissions

04-01-2025 10:12

250104-l8py6svlfx 10

04-01-2025 10:11

250104-l7xbvsxjgk 10

04-01-2025 10:09

250104-l61ynaxjdr 10

Analysis

  • max time kernel
    170s
  • max time network
    122s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04-01-2025 10:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bin/Encoder_Builder_v2.4.exe

  • Size

    883KB

  • MD5

    4c824eb8598f175d41e9a2ea06129890

  • SHA1

    64b57ea796956cbb60ce4fc702239cbc395aee6f

  • SHA256

    7a57d83ae7fde49cfd57e7d2753570306a09c6082bc82f75c89d23fa650a0011

  • SHA512

    122e509a3101a67d867f7a3653c8e5d2f838a04c7cb6a97af52e6b35ad709099a3b5940bca48be225ef0d8403537150f232f6137689180a6fd62affef5114845

  • SSDEEP

    24576:LIzxV583IWM6MV1KB7pgLB5rnjjUafpVMUXfnuq:8zT5oarn0KtX2q

Score
10/10
xoristdiscoveryransomwareupx

Malware Config

Signatures

  • Detected Xorist Ransomware 12 IoCs
  • Xorist Ransomware

    Xorist is a ransomware first seen in 2020.

    ransomwarexorist
  • Xorist family
    xorist
  • Executes dropped EXE 3 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bin\Encoder_Builder_v2.4.exe
    "C:\Users\Admin\AppData\Local\Temp\bin\Encoder_Builder_v2.4.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Users\Admin\AppData\Local\Temp\upx.exe
      "C:\Users\Admin\AppData\Local\Temp\upx.exe" -9 "C:\Users\Admin\Documents\zalupa anusa.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4816
    • C:\Users\Admin\AppData\Local\Temp\upx.exe
      "C:\Users\Admin\AppData\Local\Temp\upx.exe" -9 "C:\Users\Admin\Desktop\zalupa anusa.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2528
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:796
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
    • System Location Discovery: System Language Discovery
    PID:4660
  • C:\Users\Admin\Desktop\zalupa anusa.exe
    "C:\Users\Admin\Desktop\zalupa anusa.exe"
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    PID:2104

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\upx.exe
    Filesize

    283KB

    MD5

    308f709a8f01371a6dd088a793e65a5f

    SHA1

    a07c073d807ab0119b090821ee29edaae481e530

    SHA256

    c0f9faffdf14ab2c853880457be19a237b10f8986755f184ecfe21670076cb35

    SHA512

    c107f1af768d533d02fb82ae2ed5c126c63b53b11a2e5a5bbf45e396cb7796ca4e7984ce969b487ad38d817f4d4366e7953fb555b279aa019ffb5d1bbba57e28

    Download Submit

  • C:\Users\Admin\Documents\zalupa anusa.exe
    Filesize

    6KB

    MD5

    c0359eff2544c2e59037b6bc57afb535

    SHA1

    39412f5c9e6fd624312441ccbd85a498aed9637c

    SHA256

    c955beab8021c516e967632d841aed7496c6bdaed70ddcaf65554dea48790a88

    SHA512

    76c279bf4fab8918207162950b684be6fff293b364bca0884184f9a4663b747d2fdc84052812056ed3d07fe32a313f25b8ce39e00a9403e7d7e3efca7fd97f68

    Download Submit

  • C:\Users\Admin\Documents\zalupa anusa.exe
    Filesize

    11KB

    MD5

    d94bfb49259b0dc224580099d88899e5

    SHA1

    33d595f97c39684562e9c3342d1477719e91678d

    SHA256

    cee0058819af4ced052cc25032682e1739574080196e4727b8b390591d634003

    SHA512

    a1be423b0a76696688ff0999b840e9bd80397506e0a921383c61f84e2dda9a2fc93d7745d7d9f304e7c440553dac4002141d47f27d7308746ca1948fcbc9c71f

    Download Submit

  • memory/1468-25-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

    Download

  • memory/1468-2-0x00000000024A0000-0x00000000024A1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1468-62-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

    Download

  • memory/1468-1-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

    Download

  • memory/1468-55-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

    Download

  • memory/1468-0-0x00000000024A0000-0x00000000024A1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1468-26-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

    Download

  • memory/1468-31-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

    Download

  • memory/1468-32-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

    Download

  • memory/1468-33-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

    Download

  • memory/1468-4-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

    Download

  • memory/1468-35-0x0000000000400000-0x00000000004E2000-memory.dmp

    Filesize

    904KB

    Download

  • memory/2104-58-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2104-60-0x0000000000400000-0x000000000040C000-memory.dmp

    Filesize

    48KB

    Download

  • memory/2528-53-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/4816-24-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/4816-16-0x0000000000400000-0x000000000057E000-memory.dmp

    Filesize

    1.5MB

    Download