Analysis
-
max time kernel
151s -
max time network
141s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
16-01-2021 07:34
Static task
static1
Behavioral task
behavioral1
Sample
Carta de pago.exe
Resource
win7v20201028
General
-
Target
Carta de pago.exe
-
Size
357KB
-
MD5
03206cea63667d5f8e8861f554720473
-
SHA1
43bcabbfaffce6dfb7c5ec763f11ea85d8876dad
-
SHA256
c15f6faab41ea44719d795995c15024db0719fa5c9a731110587ec4e1e041fc2
-
SHA512
7552aae69b210e543f27d707952738df7f349daf99450e53b0a39729ea7bea5e31d34b9dc6b876ef2964f759f488a83a052a913125fb6b6f50767f994277e933
Malware Config
Extracted
formbook
http://www.smallcoloradoweddings.com/kio8/
greeaircondition.com
thewilmingtonguide.com
cbluedotlivewdmall.com
globalcrime24.com
heightsplace.com
ghar.pro
asosbira.com
melolandia.com
velactun.com
erniesimms.com
nutbullet.com
drizzerstr.com
hnqym888.com
ghorowaseba.com
1317efoxchasedrive.info
stjudetroop623.com
facestaj.com
airpromaskaccessories.com
wolfetailors.com
56ohdc2016.com
estedindustries.com
magmaplant.net
tf-iot.com
jtkqmz.com
helmihendrahasilbumi.com
audiencetrust.sucks
thespiritualabolitionist.com
lauratoots.com
fantasticsgelato.com
allinoncrypto.site
youremsys.com
awesome-veganism.com
tsunrp.net
systizen.com
73gardinerdrive.com
legamedary.com
newyorkcityhemorrhoidclinic.com
ffhcompany.com
angermgmtathome.com
plantationrevival.com
utopicvibes.net
envirocare-ss.com
domentemenegi20.com
gropedais.club
thaibizgermany.com
noimagreece.com
yogabizhelp.com
sanrenzong.com
bingent.info
chinhphucphaidep.online
dubojx.com
jennaloren.com
thedesigneryshop.com
opera-historica.com
pizzaterry.com
the-aviate.com
perteprampram01.net
pastormariorondon.com
dream-case.com
ocleanwholesaler.com
masdimensiones.com
fireworkstycoons.com
porntvh.com
fixedpriceelectrician.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1464-4-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1464-5-0x000000000041D0B0-mapping.dmp xloader behavioral1/memory/1992-7-0x0000000000000000-mapping.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 816 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Carta de pago.exeCarta de pago.exeNETSTAT.EXEdescription pid process target process PID 728 set thread context of 1464 728 Carta de pago.exe Carta de pago.exe PID 1464 set thread context of 1208 1464 Carta de pago.exe Explorer.EXE PID 1992 set thread context of 1208 1992 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1992 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Carta de pago.exeNETSTAT.EXEpid process 1464 Carta de pago.exe 1464 Carta de pago.exe 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE 1992 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Carta de pago.exeCarta de pago.exeNETSTAT.EXEpid process 728 Carta de pago.exe 1464 Carta de pago.exe 1464 Carta de pago.exe 1464 Carta de pago.exe 1992 NETSTAT.EXE 1992 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Carta de pago.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 1464 Carta de pago.exe Token: SeDebugPrivilege 1992 NETSTAT.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Carta de pago.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 728 wrote to memory of 2004 728 Carta de pago.exe cmd.exe PID 728 wrote to memory of 2004 728 Carta de pago.exe cmd.exe PID 728 wrote to memory of 2004 728 Carta de pago.exe cmd.exe PID 728 wrote to memory of 2004 728 Carta de pago.exe cmd.exe PID 728 wrote to memory of 1392 728 Carta de pago.exe cmd.exe PID 728 wrote to memory of 1392 728 Carta de pago.exe cmd.exe PID 728 wrote to memory of 1392 728 Carta de pago.exe cmd.exe PID 728 wrote to memory of 1392 728 Carta de pago.exe cmd.exe PID 728 wrote to memory of 1464 728 Carta de pago.exe Carta de pago.exe PID 728 wrote to memory of 1464 728 Carta de pago.exe Carta de pago.exe PID 728 wrote to memory of 1464 728 Carta de pago.exe Carta de pago.exe PID 728 wrote to memory of 1464 728 Carta de pago.exe Carta de pago.exe PID 728 wrote to memory of 1464 728 Carta de pago.exe Carta de pago.exe PID 1208 wrote to memory of 1992 1208 Explorer.EXE NETSTAT.EXE PID 1208 wrote to memory of 1992 1208 Explorer.EXE NETSTAT.EXE PID 1208 wrote to memory of 1992 1208 Explorer.EXE NETSTAT.EXE PID 1208 wrote to memory of 1992 1208 Explorer.EXE NETSTAT.EXE PID 1992 wrote to memory of 816 1992 NETSTAT.EXE cmd.exe PID 1992 wrote to memory of 816 1992 NETSTAT.EXE cmd.exe PID 1992 wrote to memory of 816 1992 NETSTAT.EXE cmd.exe PID 1992 wrote to memory of 816 1992 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/816-9-0x0000000000000000-mapping.dmp
-
memory/1392-3-0x0000000000000000-mapping.dmp
-
memory/1464-4-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1464-5-0x000000000041D0B0-mapping.dmp
-
memory/1992-7-0x0000000000000000-mapping.dmp
-
memory/1992-8-0x0000000000C20000-0x0000000000C29000-memory.dmpFilesize
36KB
-
memory/1992-10-0x0000000002030000-0x00000000020F8000-memory.dmpFilesize
800KB
-
memory/2004-2-0x0000000000000000-mapping.dmp