Analysis
-
max time kernel
153s -
max time network
12s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:24
Static task
static1
Behavioral task
behavioral1
Sample
payment _doc.exe
Resource
win7v20201028
General
-
Target
payment _doc.exe
-
Size
884KB
-
MD5
d65c9fe128d2294055cc9b3238e67c07
-
SHA1
1495109fc0760f4becd195b790206a0fc00b89ce
-
SHA256
ad03ca16b05c593894d3cf90ea6ebe56f3ce6dc94dc0675234f357893f3aadfa
-
SHA512
60b9fb9c9d159dac7d9a486ebf7dba7387ac45ab184857a0721d59e2a78dc4a4e074b80126d912d4a00351345f564e283ef2bf7630c437147d398a52b4f9fb21
Malware Config
Extracted
formbook
http://www.bimtracks.com/e3eb/
jrgsestates.com
xpress-supplies.com
manniramart.com
2800delaware.com
abeltobaygo.com
audiologiamallorca.com
motormaniaintl.com
millennialluxuryliving.com
wrightrealestates.com
servicesguide.online
ignitejob.com
overdoza.com
deliveringcarsanywhere.com
lojahellomundo.com
245245.xyz
ngdbusa.com
bandarnalo.network
microbekr.com
myflycodes.club
weatherstationpolinema2020.com
allysonroche.com
yankandducks.com
mommynthemiddle.com
anillanyaralo.com
dreamfinn.com
racevx.xyz
tmtbikes.com
nadiyaku.com
aksharaindia.com
3415elmcrest.com
fivefontaire.com
fourdigitalmarketing.com
buyvalencebatteries.com
oilexpress.online
almassagroups.com
subtlehuesmnl.com
keystonemedicalwellness.com
eastindiaclub.media
halseydevelpment.com
visitcamberhill.com
stocktonweeddelivery.com
myapibank.com
medijobsonline.com
ezgamer.xyz
drivewithcaramel.com
made-in-wonderland.com
veritylogisticsllc.com
winnicapolska.com
ferrerasfeliz.com
milkafrias.com
klumio.com
maquettree.com
mymindwine.com
mnmelectronics.com
bet-s.net
careercoachjuan.com
offencebzo.space
yunchuangyoupin.com
azdirtworks.com
manconnectr.services
islamicandotherhittopics.com
habiliurapol.xyz
exm-droneops.one
lemonbrite.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1508-8-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1508-9-0x000000000041D020-mapping.dmp xloader behavioral1/memory/1008-16-0x00000000000E0000-0x0000000000108000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 660 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
payment _doc.exepayment _doc.exesystray.exedescription pid process target process PID 1064 set thread context of 1508 1064 payment _doc.exe payment _doc.exe PID 1508 set thread context of 1220 1508 payment _doc.exe Explorer.EXE PID 1008 set thread context of 1220 1008 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
payment _doc.exepayment _doc.exesystray.exepid process 1064 payment _doc.exe 1064 payment _doc.exe 1508 payment _doc.exe 1508 payment _doc.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe 1008 systray.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
payment _doc.exesystray.exepid process 1508 payment _doc.exe 1508 payment _doc.exe 1508 payment _doc.exe 1008 systray.exe 1008 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
payment _doc.exepayment _doc.exesystray.exedescription pid process Token: SeDebugPrivilege 1064 payment _doc.exe Token: SeDebugPrivilege 1508 payment _doc.exe Token: SeDebugPrivilege 1008 systray.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
payment _doc.exeExplorer.EXEsystray.exedescription pid process target process PID 1064 wrote to memory of 1528 1064 payment _doc.exe payment _doc.exe PID 1064 wrote to memory of 1528 1064 payment _doc.exe payment _doc.exe PID 1064 wrote to memory of 1528 1064 payment _doc.exe payment _doc.exe PID 1064 wrote to memory of 1528 1064 payment _doc.exe payment _doc.exe PID 1064 wrote to memory of 1508 1064 payment _doc.exe payment _doc.exe PID 1064 wrote to memory of 1508 1064 payment _doc.exe payment _doc.exe PID 1064 wrote to memory of 1508 1064 payment _doc.exe payment _doc.exe PID 1064 wrote to memory of 1508 1064 payment _doc.exe payment _doc.exe PID 1064 wrote to memory of 1508 1064 payment _doc.exe payment _doc.exe PID 1064 wrote to memory of 1508 1064 payment _doc.exe payment _doc.exe PID 1064 wrote to memory of 1508 1064 payment _doc.exe payment _doc.exe PID 1220 wrote to memory of 1008 1220 Explorer.EXE systray.exe PID 1220 wrote to memory of 1008 1220 Explorer.EXE systray.exe PID 1220 wrote to memory of 1008 1220 Explorer.EXE systray.exe PID 1220 wrote to memory of 1008 1220 Explorer.EXE systray.exe PID 1008 wrote to memory of 660 1008 systray.exe cmd.exe PID 1008 wrote to memory of 660 1008 systray.exe cmd.exe PID 1008 wrote to memory of 660 1008 systray.exe cmd.exe PID 1008 wrote to memory of 660 1008 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/660-18-0x0000000000000000-mapping.dmp
-
memory/1008-14-0x0000000000000000-mapping.dmp
-
memory/1008-19-0x00000000021D0000-0x000000000225F000-memory.dmpFilesize
572KB
-
memory/1008-16-0x00000000000E0000-0x0000000000108000-memory.dmpFilesize
160KB
-
memory/1008-17-0x00000000009A0000-0x0000000000CA3000-memory.dmpFilesize
3.0MB
-
memory/1008-15-0x0000000000D30000-0x0000000000D35000-memory.dmpFilesize
20KB
-
memory/1064-7-0x0000000005040000-0x00000000050A1000-memory.dmpFilesize
388KB
-
memory/1064-2-0x00000000740B0000-0x000000007479E000-memory.dmpFilesize
6.9MB
-
memory/1064-6-0x0000000000260000-0x0000000000283000-memory.dmpFilesize
140KB
-
memory/1064-5-0x0000000004D90000-0x0000000004D91000-memory.dmpFilesize
4KB
-
memory/1064-3-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/1220-11-0x0000000004B00000-0x0000000004C99000-memory.dmpFilesize
1.6MB
-
memory/1508-12-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/1508-13-0x00000000000B0000-0x00000000000C0000-memory.dmpFilesize
64KB
-
memory/1508-9-0x000000000041D020-mapping.dmp
-
memory/1508-8-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB