Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:24
Static task
static1
Behavioral task
behavioral1
Sample
Statement Of Account.exe
Resource
win7v20201028
General
-
Target
Statement Of Account.exe
-
Size
893KB
-
MD5
436bfad859d57c0546982a3abf01e069
-
SHA1
bf2362cc3d66a764cc844ae17d820ae2f330abdc
-
SHA256
9763034a6f6e93c907471ca361e619f5fe5ec0b3aeb301cd046bd877c62aaea7
-
SHA512
26411a26de168fbc0dd5db590679570b77daf0ccb6fe8aafc8340bae8488a515a710dcc0234ff7ee23fa158df68d43353afaf20fc401cfc977ccbd30dc1036d4
Malware Config
Extracted
formbook
http://www.elridgeandandrea.com/sz0m/
wttmetroethernet.com
ybeautyinc.com
blackswan-ai.com
elitebettingnews.com
marialangarica.com
ra1nshot.space
sdkunlei.com
lingkarindonesia.com
acceptcreditcardaz.com
yantaifootball.com
checkmysocialcreditscore.com
masjovemestanoite.com
brandtalkspodcast.com
moneymethod.xyz
77js222.com
fuyang3.com
ptypty.com
entre-puneur.com
yes8168.com
lightuniverse-ity.com
siamboss.com
xn--rnovision-b4a.com
casahipoteca.com
wideresidencial.com
weakpathetic.com
networkcua.club
gliddenandglissen.com
jondiez.com
shopmnr.com
sharpshooterx.net
gatelsss.net
theenoughcompany.com
myfishdr.com
fantasyphoton.com
hanyhelmi.com
skiersmarineatlantaoffers.com
stow-away-storage.com
chengdusn.com
melonqueen.com
haopingfu.com
thriftyjersey.com
holiopti.com
themadway.com
top-male-products.com
alohainfinity.com
perphaseelectronics.com
thewefund.tech
magniloquent.media
a-zonlinehealth.com
aisnj.com
ourstreetsluc.com
aesharay.com
sqiua.com
barcelo9.com
philyourmind.com
oasismedicorum.com
iregentos.info
sarniastingshop.com
pairitycards.com
karlin-industrial.com
baileyeisman.com
ediblemantras.com
mclaurus.com
wewantyourhelp.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1584-8-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1584-9-0x000000000041D080-mapping.dmp xloader behavioral1/memory/328-17-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1124 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Statement Of Account.exeStatement Of Account.execmd.exedescription pid process target process PID 1648 set thread context of 1584 1648 Statement Of Account.exe Statement Of Account.exe PID 1584 set thread context of 1248 1584 Statement Of Account.exe Explorer.EXE PID 328 set thread context of 1248 328 cmd.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Statement Of Account.execmd.exepid process 1584 Statement Of Account.exe 1584 Statement Of Account.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe 328 cmd.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Statement Of Account.execmd.exepid process 1584 Statement Of Account.exe 1584 Statement Of Account.exe 1584 Statement Of Account.exe 328 cmd.exe 328 cmd.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Statement Of Account.execmd.exedescription pid process Token: SeDebugPrivilege 1584 Statement Of Account.exe Token: SeDebugPrivilege 328 cmd.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Statement Of Account.exeExplorer.EXEcmd.exedescription pid process target process PID 1648 wrote to memory of 1584 1648 Statement Of Account.exe Statement Of Account.exe PID 1648 wrote to memory of 1584 1648 Statement Of Account.exe Statement Of Account.exe PID 1648 wrote to memory of 1584 1648 Statement Of Account.exe Statement Of Account.exe PID 1648 wrote to memory of 1584 1648 Statement Of Account.exe Statement Of Account.exe PID 1648 wrote to memory of 1584 1648 Statement Of Account.exe Statement Of Account.exe PID 1648 wrote to memory of 1584 1648 Statement Of Account.exe Statement Of Account.exe PID 1648 wrote to memory of 1584 1648 Statement Of Account.exe Statement Of Account.exe PID 1248 wrote to memory of 328 1248 Explorer.EXE cmd.exe PID 1248 wrote to memory of 328 1248 Explorer.EXE cmd.exe PID 1248 wrote to memory of 328 1248 Explorer.EXE cmd.exe PID 1248 wrote to memory of 328 1248 Explorer.EXE cmd.exe PID 328 wrote to memory of 1124 328 cmd.exe cmd.exe PID 328 wrote to memory of 1124 328 cmd.exe cmd.exe PID 328 wrote to memory of 1124 328 cmd.exe cmd.exe PID 328 wrote to memory of 1124 328 cmd.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Statement Of Account.exe"C:\Users\Admin\AppData\Local\Temp\Statement Of Account.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Statement Of Account.exe"C:\Users\Admin\AppData\Local\Temp\Statement Of Account.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Statement Of Account.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/328-19-0x0000000001EE0000-0x0000000001F70000-memory.dmpFilesize
576KB
-
memory/328-18-0x0000000001FE0000-0x00000000022E3000-memory.dmpFilesize
3.0MB
-
memory/328-17-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/328-16-0x000000004AAB0000-0x000000004AAFC000-memory.dmpFilesize
304KB
-
memory/328-14-0x0000000000000000-mapping.dmp
-
memory/1124-15-0x0000000000000000-mapping.dmp
-
memory/1248-13-0x0000000005EB0000-0x0000000005FD2000-memory.dmpFilesize
1.1MB
-
memory/1584-12-0x0000000000190000-0x00000000001A1000-memory.dmpFilesize
68KB
-
memory/1584-11-0x0000000000D20000-0x0000000001023000-memory.dmpFilesize
3.0MB
-
memory/1584-9-0x000000000041D080-mapping.dmp
-
memory/1584-8-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1648-2-0x0000000074110000-0x00000000747FE000-memory.dmpFilesize
6.9MB
-
memory/1648-7-0x0000000004FA0000-0x0000000005002000-memory.dmpFilesize
392KB
-
memory/1648-6-0x0000000000350000-0x0000000000373000-memory.dmpFilesize
140KB
-
memory/1648-5-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/1648-3-0x0000000000C30000-0x0000000000C31000-memory.dmpFilesize
4KB