Analysis
- max time kernel
151s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
22/12/2020, 15:50
Static task
static1
Behavioral task
behavioral1
Sample
IRS Notice Letter.exe
Resource
win7v20201028
windows7_x64
General
- Target IRS Notice Letter.exe
- Size 1.3MB
- Sample201222-kt64h5vzen
- SHA256 0e6c9ec44aee5518a67ba5b5beda49639a715f191bb77099ecd57e326fc0d811
- MD5 7bc5aa156b65b600db5b75ee2e420126
- SHA1 ee53af6e8315633f4be8552e31183cca47a298f6
- SHA512 482c0c653a2c95adb30f41df9dfe9dbd64106da3b7d71cd9e55be39a501c567ee6bda2e8811bafafbee8e440fb7c97f789043188f5b3dedfb7b5cf6f891eaf15
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.aizimov.com/09rb/
-
chatmeapp.net
-
jennyandmatt2021.com
-
myaarpdentalpln.com
-
valexplorer.com
-
kobumsnetwork.com
-
kimschrierforcongress.com
-
yixun01.com
-
changxunt.com
-
finishingtouchfootball.com
-
stereoslide.com
-
penipay.com
-
iregentos.info
-
thebuzztraders.com
-
ashleyandwarner.com
-
idratherbeinbed.com
-
trysweetlife.com
-
emuprising.com
-
theconnectioncure4anewlife.com
-
wendyallegaert.com
-
88779599.com
-
leanbirthdaycake.com
-
edgehairandbeauty.com
-
nesilyilmaz.com
-
austinscubaschool.com
-
travelscool.site
-
myraklereleafcannaclinic.com
-
virginiadoyle.com
-
edessaconstructiontt.com
-
prendimiconcept.com
-
3991799.com
-
fallguysgen.com
-
legendtrailcommunity.com
-
torisimon.xyz
-
alessandrabortolussi.net
-
winejm.com
-
on3sport.com
-
airfast-express.com
-
becomeadigitalsoul.com
-
watereminder.com
-
lobstermenforgolden.com
-
unitedbythebucket.com
-
789bet168th.com
-
efoh27.com
-
psiexamz.com
-
rednbot.com
-
rappaportcos.com
-
gizzago.com
-
zoratve.com
-
casinogenbo.com
-
vinkakafitness.com
-
pcvczva.icu
-
luxiaoqiao.com
-
morbition.com
-
heavyweightsurf.com
-
artois-plomberie-ambar.com
-
justvalerian.com
-
ohmake.com
-
totallyfitwellness.com
-
bramfambeads.com
-
expandtherapy.com
-
rcheapsmartshop.com
-
maraguaverde.com
-
teechnie.com
-
aksaystudios.com
Signatures
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/3120-8-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral2/memory/3120-9-0x000000000041D060-mapping.dmp xloader behavioral2/memory/3984-10-0x0000000000000000-mapping.dmp xloader - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4688 set thread context of 3120 4688 IRS Notice Letter.exe 75 PID 3120 set thread context of 3128 3120 IRS Notice Letter.exe 9 PID 3120 set thread context of 3128 3120 IRS Notice Letter.exe 9 PID 3984 set thread context of 3128 3984 cmd.exe 9 - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 3120 IRS Notice Letter.exe 3120 IRS Notice Letter.exe 3120 IRS Notice Letter.exe 3120 IRS Notice Letter.exe 3120 IRS Notice Letter.exe 3120 IRS Notice Letter.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe 3984 cmd.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3120 IRS Notice Letter.exe 3120 IRS Notice Letter.exe 3120 IRS Notice Letter.exe 3120 IRS Notice Letter.exe 3984 cmd.exe 3984 cmd.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3120 IRS Notice Letter.exe Token: SeDebugPrivilege 3984 cmd.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4688 wrote to memory of 3120 4688 IRS Notice Letter.exe 75 PID 4688 wrote to memory of 3120 4688 IRS Notice Letter.exe 75 PID 4688 wrote to memory of 3120 4688 IRS Notice Letter.exe 75 PID 4688 wrote to memory of 3120 4688 IRS Notice Letter.exe 75 PID 4688 wrote to memory of 3120 4688 IRS Notice Letter.exe 75 PID 4688 wrote to memory of 3120 4688 IRS Notice Letter.exe 75 PID 4688 wrote to memory of 3120 4688 IRS Notice Letter.exe 75 PID 3120 wrote to memory of 3984 3120 IRS Notice Letter.exe 79 PID 3120 wrote to memory of 3984 3120 IRS Notice Letter.exe 79 PID 3120 wrote to memory of 3984 3120 IRS Notice Letter.exe 79 PID 3984 wrote to memory of 3396 3984 cmd.exe 80 PID 3984 wrote to memory of 3396 3984 cmd.exe 80 PID 3984 wrote to memory of 3396 3984 cmd.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\IRS Notice Letter.exe"C:\Users\Admin\AppData\Local\Temp\IRS Notice Letter.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\IRS Notice Letter.exe"C:\Users\Admin\AppData\Local\Temp\IRS Notice Letter.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IRS Notice Letter.exe"5⤵PID:3396
-
-
-
-