Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:24
Static task
static1
Behavioral task
behavioral1
Sample
Statement Of Account.exe
Resource
win7v20201028
General
-
Target
Statement Of Account.exe
-
Size
893KB
-
MD5
436bfad859d57c0546982a3abf01e069
-
SHA1
bf2362cc3d66a764cc844ae17d820ae2f330abdc
-
SHA256
9763034a6f6e93c907471ca361e619f5fe5ec0b3aeb301cd046bd877c62aaea7
-
SHA512
26411a26de168fbc0dd5db590679570b77daf0ccb6fe8aafc8340bae8488a515a710dcc0234ff7ee23fa158df68d43353afaf20fc401cfc977ccbd30dc1036d4
Malware Config
Extracted
formbook
http://www.elridgeandandrea.com/sz0m/
wttmetroethernet.com
ybeautyinc.com
blackswan-ai.com
elitebettingnews.com
marialangarica.com
ra1nshot.space
sdkunlei.com
lingkarindonesia.com
acceptcreditcardaz.com
yantaifootball.com
checkmysocialcreditscore.com
masjovemestanoite.com
brandtalkspodcast.com
moneymethod.xyz
77js222.com
fuyang3.com
ptypty.com
entre-puneur.com
yes8168.com
lightuniverse-ity.com
siamboss.com
xn--rnovision-b4a.com
casahipoteca.com
wideresidencial.com
weakpathetic.com
networkcua.club
gliddenandglissen.com
jondiez.com
shopmnr.com
sharpshooterx.net
gatelsss.net
theenoughcompany.com
myfishdr.com
fantasyphoton.com
hanyhelmi.com
skiersmarineatlantaoffers.com
stow-away-storage.com
chengdusn.com
melonqueen.com
haopingfu.com
thriftyjersey.com
holiopti.com
themadway.com
top-male-products.com
alohainfinity.com
perphaseelectronics.com
thewefund.tech
magniloquent.media
a-zonlinehealth.com
aisnj.com
ourstreetsluc.com
aesharay.com
sqiua.com
barcelo9.com
philyourmind.com
oasismedicorum.com
iregentos.info
sarniastingshop.com
pairitycards.com
karlin-industrial.com
baileyeisman.com
ediblemantras.com
mclaurus.com
wewantyourhelp.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1100-14-0x000000000041D080-mapping.dmp xloader behavioral2/memory/1100-13-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2112-24-0x0000000000350000-0x0000000000379000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Statement Of Account.exeStatement Of Account.execscript.exedescription pid process target process PID 4092 set thread context of 1100 4092 Statement Of Account.exe Statement Of Account.exe PID 1100 set thread context of 2756 1100 Statement Of Account.exe Explorer.EXE PID 1100 set thread context of 2756 1100 Statement Of Account.exe Explorer.EXE PID 2112 set thread context of 2756 2112 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
Statement Of Account.execscript.exepid process 1100 Statement Of Account.exe 1100 Statement Of Account.exe 1100 Statement Of Account.exe 1100 Statement Of Account.exe 1100 Statement Of Account.exe 1100 Statement Of Account.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe 2112 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Statement Of Account.execscript.exepid process 1100 Statement Of Account.exe 1100 Statement Of Account.exe 1100 Statement Of Account.exe 1100 Statement Of Account.exe 2112 cscript.exe 2112 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Statement Of Account.execscript.exedescription pid process Token: SeDebugPrivilege 1100 Statement Of Account.exe Token: SeDebugPrivilege 2112 cscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2756 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Statement Of Account.exeExplorer.EXEcscript.exedescription pid process target process PID 4092 wrote to memory of 1100 4092 Statement Of Account.exe Statement Of Account.exe PID 4092 wrote to memory of 1100 4092 Statement Of Account.exe Statement Of Account.exe PID 4092 wrote to memory of 1100 4092 Statement Of Account.exe Statement Of Account.exe PID 4092 wrote to memory of 1100 4092 Statement Of Account.exe Statement Of Account.exe PID 4092 wrote to memory of 1100 4092 Statement Of Account.exe Statement Of Account.exe PID 4092 wrote to memory of 1100 4092 Statement Of Account.exe Statement Of Account.exe PID 2756 wrote to memory of 2112 2756 Explorer.EXE cscript.exe PID 2756 wrote to memory of 2112 2756 Explorer.EXE cscript.exe PID 2756 wrote to memory of 2112 2756 Explorer.EXE cscript.exe PID 2112 wrote to memory of 2116 2112 cscript.exe cmd.exe PID 2112 wrote to memory of 2116 2112 cscript.exe cmd.exe PID 2112 wrote to memory of 2116 2112 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Statement Of Account.exe"C:\Users\Admin\AppData\Local\Temp\Statement Of Account.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Statement Of Account.exe"C:\Users\Admin\AppData\Local\Temp\Statement Of Account.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Statement Of Account.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1100-14-0x000000000041D080-mapping.dmp
-
memory/1100-19-0x00000000012B0000-0x00000000012C1000-memory.dmpFilesize
68KB
-
memory/1100-17-0x0000000000F50000-0x0000000000F61000-memory.dmpFilesize
68KB
-
memory/1100-16-0x0000000000F90000-0x00000000012B0000-memory.dmpFilesize
3.1MB
-
memory/1100-13-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2112-26-0x0000000004670000-0x0000000004700000-memory.dmpFilesize
576KB
-
memory/2112-25-0x00000000048C0000-0x0000000004BE0000-memory.dmpFilesize
3.1MB
-
memory/2112-24-0x0000000000350000-0x0000000000379000-memory.dmpFilesize
164KB
-
memory/2112-23-0x0000000001150000-0x0000000001177000-memory.dmpFilesize
156KB
-
memory/2112-21-0x0000000000000000-mapping.dmp
-
memory/2116-22-0x0000000000000000-mapping.dmp
-
memory/2756-20-0x00000000065A0000-0x0000000006725000-memory.dmpFilesize
1.5MB
-
memory/2756-27-0x0000000007090000-0x0000000007210000-memory.dmpFilesize
1.5MB
-
memory/2756-18-0x0000000006070000-0x0000000006177000-memory.dmpFilesize
1.0MB
-
memory/4092-8-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/4092-10-0x00000000058B0000-0x00000000058D3000-memory.dmpFilesize
140KB
-
memory/4092-9-0x0000000005910000-0x0000000005911000-memory.dmpFilesize
4KB
-
memory/4092-12-0x00000000064E0000-0x0000000006542000-memory.dmpFilesize
392KB
-
memory/4092-2-0x00000000739A0000-0x000000007408E000-memory.dmpFilesize
6.9MB
-
memory/4092-7-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/4092-6-0x0000000005C50000-0x0000000005C51000-memory.dmpFilesize
4KB
-
memory/4092-5-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/4092-3-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/4092-11-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB