Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
16-01-2021 07:34
Static task
static1
Behavioral task
behavioral1
Sample
Carta de pago.exe
Resource
win7v20201028
General
-
Target
Carta de pago.exe
-
Size
357KB
-
MD5
03206cea63667d5f8e8861f554720473
-
SHA1
43bcabbfaffce6dfb7c5ec763f11ea85d8876dad
-
SHA256
c15f6faab41ea44719d795995c15024db0719fa5c9a731110587ec4e1e041fc2
-
SHA512
7552aae69b210e543f27d707952738df7f349daf99450e53b0a39729ea7bea5e31d34b9dc6b876ef2964f759f488a83a052a913125fb6b6f50767f994277e933
Malware Config
Extracted
formbook
http://www.smallcoloradoweddings.com/kio8/
greeaircondition.com
thewilmingtonguide.com
cbluedotlivewdmall.com
globalcrime24.com
heightsplace.com
ghar.pro
asosbira.com
melolandia.com
velactun.com
erniesimms.com
nutbullet.com
drizzerstr.com
hnqym888.com
ghorowaseba.com
1317efoxchasedrive.info
stjudetroop623.com
facestaj.com
airpromaskaccessories.com
wolfetailors.com
56ohdc2016.com
estedindustries.com
magmaplant.net
tf-iot.com
jtkqmz.com
helmihendrahasilbumi.com
audiencetrust.sucks
thespiritualabolitionist.com
lauratoots.com
fantasticsgelato.com
allinoncrypto.site
youremsys.com
awesome-veganism.com
tsunrp.net
systizen.com
73gardinerdrive.com
legamedary.com
newyorkcityhemorrhoidclinic.com
ffhcompany.com
angermgmtathome.com
plantationrevival.com
utopicvibes.net
envirocare-ss.com
domentemenegi20.com
gropedais.club
thaibizgermany.com
noimagreece.com
yogabizhelp.com
sanrenzong.com
bingent.info
chinhphucphaidep.online
dubojx.com
jennaloren.com
thedesigneryshop.com
opera-historica.com
pizzaterry.com
the-aviate.com
perteprampram01.net
pastormariorondon.com
dream-case.com
ocleanwholesaler.com
masdimensiones.com
fireworkstycoons.com
porntvh.com
fixedpriceelectrician.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3708-4-0x0000000000380000-0x00000000003A9000-memory.dmp xloader behavioral2/memory/3708-5-0x000000000039D0B0-mapping.dmp xloader behavioral2/memory/784-8-0x0000000000000000-mapping.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Carta de pago.exeCarta de pago.exewlanext.exedescription pid process target process PID 4708 set thread context of 3708 4708 Carta de pago.exe Carta de pago.exe PID 3708 set thread context of 2852 3708 Carta de pago.exe Explorer.EXE PID 784 set thread context of 2852 784 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Carta de pago.exewlanext.exepid process 3708 Carta de pago.exe 3708 Carta de pago.exe 3708 Carta de pago.exe 3708 Carta de pago.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Carta de pago.exeCarta de pago.exewlanext.exepid process 4708 Carta de pago.exe 4708 Carta de pago.exe 3708 Carta de pago.exe 3708 Carta de pago.exe 3708 Carta de pago.exe 784 wlanext.exe 784 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Carta de pago.exewlanext.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3708 Carta de pago.exe Token: SeDebugPrivilege 784 wlanext.exe Token: SeShutdownPrivilege 2852 Explorer.EXE Token: SeCreatePagefilePrivilege 2852 Explorer.EXE Token: SeShutdownPrivilege 2852 Explorer.EXE Token: SeCreatePagefilePrivilege 2852 Explorer.EXE Token: SeShutdownPrivilege 2852 Explorer.EXE Token: SeCreatePagefilePrivilege 2852 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2852 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Carta de pago.exeExplorer.EXEwlanext.exedescription pid process target process PID 4708 wrote to memory of 1680 4708 Carta de pago.exe cmd.exe PID 4708 wrote to memory of 1680 4708 Carta de pago.exe cmd.exe PID 4708 wrote to memory of 1680 4708 Carta de pago.exe cmd.exe PID 4708 wrote to memory of 3440 4708 Carta de pago.exe cmd.exe PID 4708 wrote to memory of 3440 4708 Carta de pago.exe cmd.exe PID 4708 wrote to memory of 3440 4708 Carta de pago.exe cmd.exe PID 4708 wrote to memory of 3708 4708 Carta de pago.exe Carta de pago.exe PID 4708 wrote to memory of 3708 4708 Carta de pago.exe Carta de pago.exe PID 4708 wrote to memory of 3708 4708 Carta de pago.exe Carta de pago.exe PID 4708 wrote to memory of 3708 4708 Carta de pago.exe Carta de pago.exe PID 2852 wrote to memory of 784 2852 Explorer.EXE wlanext.exe PID 2852 wrote to memory of 784 2852 Explorer.EXE wlanext.exe PID 2852 wrote to memory of 784 2852 Explorer.EXE wlanext.exe PID 784 wrote to memory of 4368 784 wlanext.exe cmd.exe PID 784 wrote to memory of 4368 784 wlanext.exe cmd.exe PID 784 wrote to memory of 4368 784 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/784-8-0x0000000000000000-mapping.dmp
-
memory/784-9-0x0000000000210000-0x0000000000227000-memory.dmpFilesize
92KB
-
memory/784-10-0x0000000000210000-0x0000000000227000-memory.dmpFilesize
92KB
-
memory/784-12-0x0000000005000000-0x0000000005128000-memory.dmpFilesize
1.2MB
-
memory/1680-2-0x0000000000000000-mapping.dmp
-
memory/3440-3-0x0000000000000000-mapping.dmp
-
memory/3708-4-0x0000000000380000-0x00000000003A9000-memory.dmpFilesize
164KB
-
memory/3708-5-0x000000000039D0B0-mapping.dmp
-
memory/4368-11-0x0000000000000000-mapping.dmp