Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
16-01-2021 07:37
Static task
static1
Behavioral task
behavioral1
Sample
YUAN PAYMENT.exe
Resource
win7v20201028
General
-
Target
YUAN PAYMENT.exe
-
Size
1.2MB
-
MD5
c3548520f4207f36dff807aaca9374d7
-
SHA1
a9e11e5e8624b789a8e7dd2d6b4e8d8a86b8fae5
-
SHA256
098a33a70506458d7e349d06aac9ca3e3a2a3f73efa39d82942eeff3adc24509
-
SHA512
5260a481fb96f905782b3e65db67d6e7e7216ca39da05980b724af1acbb2681ff69a405f5999f0e2685b9c20a7a833f0ed3a56ca512e99e08507305b84e9df25
Malware Config
Extracted
formbook
http://www.a-emeservice.com/m8ec/
thomascraigwealth.com
melbournemedicalhealth.net
tdxcoin.com
lukassbprojects.net
aldemallc.com
moqawalat-kuwait.com
txcsco.com
jobcarepro.com
sedotwcmedanmurah.com
niconthenine.com
radliffrehab.com
infiniteechogroup.com
stellantis-luxury-rent.com
ibusehat.info
resellerauctions.com
softwarexprogrammers.com
bumpnlifestyle.com
mintmacher.com
partapprintercare.com
justrightinsurance.com
beyond-ml.com
mikrotandborste.com
madisonmeadowsseniorliving.com
smart14day.com
fiftyfivetwelve.com
respectinvestadvance.com
shelleylutherfortexas.com
kunst-stueck-chen.com
adastraperaspera.xyz
aletheaastraea.info
zhghzlg.com
cameroncooperar.com
inrushconsulting.com
oldeny.com
foggardens.com
bubbygoobers.com
apartmentnegotiator.com
iregentos.info
charlesadoptionhome.com
sugawara-garasu.com
insidescripps.net
offerlamp.com
flagpeel.com
tb1919.com
estherneil.com
greatunsearchablethings.com
jeunetherapie.com
ricardoinman.com
sbq58.com
morifan.com
foodpukka.com
onewaytaxi.club
ksolves-vendor.com
ashleighemmaboyle.com
hbseelong.com
vanotti-watches.com
faizulrahmanmusafir.com
cb5677.com
gcasservices.com
perteprampram01.com
308hamlinloop.com
machkind.com
cwpdhambers.xyz
glenwoodsteak.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1268-12-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1268-13-0x000000000041D0A0-mapping.dmp xloader behavioral2/memory/3960-14-0x0000000000000000-mapping.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
YUAN PAYMENT.exeYUAN PAYMENT.exehelp.exedescription pid process target process PID 3988 set thread context of 1268 3988 YUAN PAYMENT.exe YUAN PAYMENT.exe PID 1268 set thread context of 3036 1268 YUAN PAYMENT.exe Explorer.EXE PID 3960 set thread context of 3036 3960 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
YUAN PAYMENT.exehelp.exepid process 1268 YUAN PAYMENT.exe 1268 YUAN PAYMENT.exe 1268 YUAN PAYMENT.exe 1268 YUAN PAYMENT.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe 3960 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
YUAN PAYMENT.exehelp.exepid process 1268 YUAN PAYMENT.exe 1268 YUAN PAYMENT.exe 1268 YUAN PAYMENT.exe 3960 help.exe 3960 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
YUAN PAYMENT.exehelp.exedescription pid process Token: SeDebugPrivilege 1268 YUAN PAYMENT.exe Token: SeDebugPrivilege 3960 help.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
YUAN PAYMENT.exeExplorer.EXEhelp.exedescription pid process target process PID 3988 wrote to memory of 1268 3988 YUAN PAYMENT.exe YUAN PAYMENT.exe PID 3988 wrote to memory of 1268 3988 YUAN PAYMENT.exe YUAN PAYMENT.exe PID 3988 wrote to memory of 1268 3988 YUAN PAYMENT.exe YUAN PAYMENT.exe PID 3988 wrote to memory of 1268 3988 YUAN PAYMENT.exe YUAN PAYMENT.exe PID 3988 wrote to memory of 1268 3988 YUAN PAYMENT.exe YUAN PAYMENT.exe PID 3988 wrote to memory of 1268 3988 YUAN PAYMENT.exe YUAN PAYMENT.exe PID 3036 wrote to memory of 3960 3036 Explorer.EXE help.exe PID 3036 wrote to memory of 3960 3036 Explorer.EXE help.exe PID 3036 wrote to memory of 3960 3036 Explorer.EXE help.exe PID 3960 wrote to memory of 3932 3960 help.exe cmd.exe PID 3960 wrote to memory of 3932 3960 help.exe cmd.exe PID 3960 wrote to memory of 3932 3960 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\YUAN PAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\YUAN PAYMENT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\YUAN PAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\YUAN PAYMENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\YUAN PAYMENT.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1268-12-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1268-13-0x000000000041D0A0-mapping.dmp
-
memory/3932-17-0x0000000000000000-mapping.dmp
-
memory/3960-16-0x0000000000050000-0x0000000000057000-memory.dmpFilesize
28KB
-
memory/3960-15-0x0000000000050000-0x0000000000057000-memory.dmpFilesize
28KB
-
memory/3960-14-0x0000000000000000-mapping.dmp
-
memory/3988-6-0x0000000007CB0000-0x0000000007CB1000-memory.dmpFilesize
4KB
-
memory/3988-10-0x0000000002B60000-0x0000000002B73000-memory.dmpFilesize
76KB
-
memory/3988-11-0x0000000000F70000-0x0000000000FD5000-memory.dmpFilesize
404KB
-
memory/3988-9-0x0000000007A10000-0x0000000007A11000-memory.dmpFilesize
4KB
-
memory/3988-8-0x00000000077D0000-0x00000000077D1000-memory.dmpFilesize
4KB
-
memory/3988-7-0x0000000007850000-0x0000000007851000-memory.dmpFilesize
4KB
-
memory/3988-2-0x00000000738E0000-0x0000000073FCE000-memory.dmpFilesize
6.9MB
-
memory/3988-5-0x0000000007710000-0x0000000007711000-memory.dmpFilesize
4KB
-
memory/3988-3-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB