Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17-01-2021 18:04
Static task
static1
Behavioral task
behavioral1
Sample
SUNEJ PAYMENT.exe
Resource
win7v20201028
General
-
Target
SUNEJ PAYMENT.exe
-
Size
939KB
-
MD5
b6b8a1ad3d8f308457b07b88afeab4cd
-
SHA1
f49329c30a3870c5b4c0b988197045140a6d5c23
-
SHA256
7aa2116b5dcb055987e0e18b5e2f869eae15f6093adfd55b6a6d28b8be53dcb4
-
SHA512
7fc6887f80879d04ceac0b4a59f9cb5161a8f52474afa4f14394051ff4d2c2a63e9afd1729824a8ac39c4767e56a086e70072b4913096e3a1c18e8c26451b6d7
Malware Config
Extracted
formbook
http://www.a-emeservice.com/m8ec/
thomascraigwealth.com
melbournemedicalhealth.net
tdxcoin.com
lukassbprojects.net
aldemallc.com
moqawalat-kuwait.com
txcsco.com
jobcarepro.com
sedotwcmedanmurah.com
niconthenine.com
radliffrehab.com
infiniteechogroup.com
stellantis-luxury-rent.com
ibusehat.info
resellerauctions.com
softwarexprogrammers.com
bumpnlifestyle.com
mintmacher.com
partapprintercare.com
justrightinsurance.com
beyond-ml.com
mikrotandborste.com
madisonmeadowsseniorliving.com
smart14day.com
fiftyfivetwelve.com
respectinvestadvance.com
shelleylutherfortexas.com
kunst-stueck-chen.com
adastraperaspera.xyz
aletheaastraea.info
zhghzlg.com
cameroncooperar.com
inrushconsulting.com
oldeny.com
foggardens.com
bubbygoobers.com
apartmentnegotiator.com
iregentos.info
charlesadoptionhome.com
sugawara-garasu.com
insidescripps.net
offerlamp.com
flagpeel.com
tb1919.com
estherneil.com
greatunsearchablethings.com
jeunetherapie.com
ricardoinman.com
sbq58.com
morifan.com
foodpukka.com
onewaytaxi.club
ksolves-vendor.com
ashleighemmaboyle.com
hbseelong.com
vanotti-watches.com
faizulrahmanmusafir.com
cb5677.com
gcasservices.com
perteprampram01.com
308hamlinloop.com
machkind.com
cwpdhambers.xyz
glenwoodsteak.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4220-4-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4220-5-0x000000000041D0A0-mapping.dmp xloader behavioral2/memory/3156-15-0x0000000000560000-0x0000000000589000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SUNEJ PAYMENT.exeSUNEJ PAYMENT.exeNETSTAT.EXEdescription pid process target process PID 4648 set thread context of 4220 4648 SUNEJ PAYMENT.exe SUNEJ PAYMENT.exe PID 4220 set thread context of 3108 4220 SUNEJ PAYMENT.exe Explorer.EXE PID 4220 set thread context of 3108 4220 SUNEJ PAYMENT.exe Explorer.EXE PID 3156 set thread context of 3108 3156 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 3156 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
SUNEJ PAYMENT.exeNETSTAT.EXEpid process 4220 SUNEJ PAYMENT.exe 4220 SUNEJ PAYMENT.exe 4220 SUNEJ PAYMENT.exe 4220 SUNEJ PAYMENT.exe 4220 SUNEJ PAYMENT.exe 4220 SUNEJ PAYMENT.exe 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE 3156 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
SUNEJ PAYMENT.exeNETSTAT.EXEpid process 4220 SUNEJ PAYMENT.exe 4220 SUNEJ PAYMENT.exe 4220 SUNEJ PAYMENT.exe 4220 SUNEJ PAYMENT.exe 3156 NETSTAT.EXE 3156 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SUNEJ PAYMENT.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 4220 SUNEJ PAYMENT.exe Token: SeDebugPrivilege 3156 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
SUNEJ PAYMENT.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 4648 wrote to memory of 4220 4648 SUNEJ PAYMENT.exe SUNEJ PAYMENT.exe PID 4648 wrote to memory of 4220 4648 SUNEJ PAYMENT.exe SUNEJ PAYMENT.exe PID 4648 wrote to memory of 4220 4648 SUNEJ PAYMENT.exe SUNEJ PAYMENT.exe PID 4648 wrote to memory of 4220 4648 SUNEJ PAYMENT.exe SUNEJ PAYMENT.exe PID 4648 wrote to memory of 4220 4648 SUNEJ PAYMENT.exe SUNEJ PAYMENT.exe PID 4648 wrote to memory of 4220 4648 SUNEJ PAYMENT.exe SUNEJ PAYMENT.exe PID 3108 wrote to memory of 3156 3108 Explorer.EXE NETSTAT.EXE PID 3108 wrote to memory of 3156 3108 Explorer.EXE NETSTAT.EXE PID 3108 wrote to memory of 3156 3108 Explorer.EXE NETSTAT.EXE PID 3156 wrote to memory of 3276 3156 NETSTAT.EXE cmd.exe PID 3156 wrote to memory of 3276 3156 NETSTAT.EXE cmd.exe PID 3156 wrote to memory of 3276 3156 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SUNEJ PAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\SUNEJ PAYMENT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SUNEJ PAYMENT.exe"C:\Users\Admin\AppData\Local\Temp\SUNEJ PAYMENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SUNEJ PAYMENT.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3108-19-0x00000000068B0000-0x000000000699B000-memory.dmpFilesize
940KB
-
memory/3108-9-0x0000000006BC0000-0x0000000006D1B000-memory.dmpFilesize
1.4MB
-
memory/3108-11-0x00000000032A0000-0x0000000003376000-memory.dmpFilesize
856KB
-
memory/3156-12-0x0000000000000000-mapping.dmp
-
memory/3156-17-0x0000000002E70000-0x0000000002F00000-memory.dmpFilesize
576KB
-
memory/3156-16-0x0000000003010000-0x0000000003330000-memory.dmpFilesize
3.1MB
-
memory/3156-15-0x0000000000560000-0x0000000000589000-memory.dmpFilesize
164KB
-
memory/3156-14-0x0000000000E60000-0x0000000000E6B000-memory.dmpFilesize
44KB
-
memory/3276-13-0x0000000000000000-mapping.dmp
-
memory/4220-8-0x0000000000B50000-0x0000000000B61000-memory.dmpFilesize
68KB
-
memory/4220-10-0x0000000000C90000-0x0000000000CA1000-memory.dmpFilesize
68KB
-
memory/4220-7-0x0000000001150000-0x0000000001470000-memory.dmpFilesize
3.1MB
-
memory/4220-5-0x000000000041D0A0-mapping.dmp
-
memory/4220-4-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4648-2-0x0000000002B10000-0x0000000002B11000-memory.dmpFilesize
4KB
-
memory/4648-3-0x0000000002B11000-0x0000000002B12000-memory.dmpFilesize
4KB