Analysis
- max time kernel
147s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
31/12/2020, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
payment copy.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
- Target payment copy.exe
- Size 278KB
- Sample201231-3ndvrpj28j
- SHA256 9322c039cec01a5d43492f882c2b5d02aa9357ea4c2e95a039ea1ca1841112da
- MD5 91a91997f8113487f258846b7689bd2f
- SHA1 a01f9d8a72c0afd243a7e3161794e1895af66ac1
- SHA512 be8eb5642f0b4719f8c21435f2bda1f9785a2e46d68be00cc4a856a6ce413ab1be662aca6b671765c5c60ed7c121f455fbb0bcb6dc18ef754bf2d4760e606e65
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
formbook
C2
-
http://www.destinny.com/s9zh/
Decoy
-
paintedinafrica.com
-
electrumfix.download
-
edlange.com
-
tqiawy.xyz
-
satiscenter.xyz
-
nc-affiliates.com
-
agencybuilderforum.com
-
testabcde.net
-
venisseturf.net
-
rubenvdsande.com
-
nzmatrimony.com
-
mdthriftsandflips.com
-
virtualfxstudio.com
-
communityinsuranceut.com
-
qqbokep.com
-
copeva.net
-
bookedupdaily.com
-
houstongrowmyairway.com
-
fortunapublishing.com
-
empireplumbingandheating.com
-
globalefactory.com
-
alfrednelson.com
-
kernwide.com
-
soulwaves.info
-
iregentos.info
-
emfirstchoice.com
-
popvoc.com
-
clubdeproyectos.com
-
nathanlaube.net
-
davaresoon.com
-
girlsnightoutcollection.net
-
alchemdiagnostics.com
-
intlgrowcap.com
-
northeasttnrentalproperties.com
-
1971265.com
-
yobingo.ltd
-
comunityassn.com
-
pupupe.com
-
physicianmedspa.com
-
forestloretour.com
-
tauntongo.com
-
elegancescent.com
-
traumatotrust.com
-
blkdenim.com
-
b-taking.com
-
naturalhealthadvisery.com
-
fight-box.com
-
socia1security.net
-
prestondelnorteapartments.com
-
peaclbgju.icu
-
thegolfclubatcirclec.com
-
westqueenwestlofts.com
-
elitedesignzink.com
-
czpeixun.com
-
blossomenterpriseuganda.com
-
danettesgifts.com
-
psikometriums.com
-
rainbowbanks.com
-
deshbari.com
-
movementspecialistslv.com
-
amkcar.com
-
contractorsan.com
-
onurtel.com
-
dotalogy.com
Signatures
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/2960-2-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2960-3-0x000000000041D060-mapping.dmp xloader behavioral2/memory/200-5-0x0000000000000000-mapping.dmp xloader - Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 580 set thread context of 2960 580 payment copy.exe 77 PID 2960 set thread context of 3040 2960 vbc.exe 20 PID 200 set thread context of 3040 200 cmstp.exe 20 - Program crash 1 IoCs
pid pid_target Process procid_target 2616 580 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 75 IoCs
pid Process 580 payment copy.exe 580 payment copy.exe 580 payment copy.exe 2960 vbc.exe 2960 vbc.exe 2960 vbc.exe 2960 vbc.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 2616 WerFault.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe 200 cmstp.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2960 vbc.exe 2960 vbc.exe 2960 vbc.exe 200 cmstp.exe 200 cmstp.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 580 payment copy.exe Token: SeDebugPrivilege 2960 vbc.exe Token: SeRestorePrivilege 2616 WerFault.exe Token: SeBackupPrivilege 2616 WerFault.exe Token: SeDebugPrivilege 2616 WerFault.exe Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeDebugPrivilege 200 cmstp.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3040 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 580 wrote to memory of 2960 580 payment copy.exe 77 PID 580 wrote to memory of 2960 580 payment copy.exe 77 PID 580 wrote to memory of 2960 580 payment copy.exe 77 PID 580 wrote to memory of 2960 580 payment copy.exe 77 PID 580 wrote to memory of 2960 580 payment copy.exe 77 PID 580 wrote to memory of 2960 580 payment copy.exe 77 PID 3040 wrote to memory of 200 3040 Explorer.EXE 80 PID 3040 wrote to memory of 200 3040 Explorer.EXE 80 PID 3040 wrote to memory of 200 3040 Explorer.EXE 80 PID 200 wrote to memory of 2996 200 cmstp.exe 81 PID 200 wrote to memory of 2996 200 cmstp.exe 81 PID 200 wrote to memory of 2996 200 cmstp.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\payment copy.exe"C:\Users\Admin\AppData\Local\Temp\payment copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 580 -s 10323⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:200 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"3⤵PID:2996
-
-