Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:24
Static task
static1
Behavioral task
behavioral1
Sample
payment _doc.exe
Resource
win7v20201028
General
-
Target
payment _doc.exe
-
Size
884KB
-
MD5
d65c9fe128d2294055cc9b3238e67c07
-
SHA1
1495109fc0760f4becd195b790206a0fc00b89ce
-
SHA256
ad03ca16b05c593894d3cf90ea6ebe56f3ce6dc94dc0675234f357893f3aadfa
-
SHA512
60b9fb9c9d159dac7d9a486ebf7dba7387ac45ab184857a0721d59e2a78dc4a4e074b80126d912d4a00351345f564e283ef2bf7630c437147d398a52b4f9fb21
Malware Config
Extracted
formbook
http://www.bimtracks.com/e3eb/
jrgsestates.com
xpress-supplies.com
manniramart.com
2800delaware.com
abeltobaygo.com
audiologiamallorca.com
motormaniaintl.com
millennialluxuryliving.com
wrightrealestates.com
servicesguide.online
ignitejob.com
overdoza.com
deliveringcarsanywhere.com
lojahellomundo.com
245245.xyz
ngdbusa.com
bandarnalo.network
microbekr.com
myflycodes.club
weatherstationpolinema2020.com
allysonroche.com
yankandducks.com
mommynthemiddle.com
anillanyaralo.com
dreamfinn.com
racevx.xyz
tmtbikes.com
nadiyaku.com
aksharaindia.com
3415elmcrest.com
fivefontaire.com
fourdigitalmarketing.com
buyvalencebatteries.com
oilexpress.online
almassagroups.com
subtlehuesmnl.com
keystonemedicalwellness.com
eastindiaclub.media
halseydevelpment.com
visitcamberhill.com
stocktonweeddelivery.com
myapibank.com
medijobsonline.com
ezgamer.xyz
drivewithcaramel.com
made-in-wonderland.com
veritylogisticsllc.com
winnicapolska.com
ferrerasfeliz.com
milkafrias.com
klumio.com
maquettree.com
mymindwine.com
mnmelectronics.com
bet-s.net
careercoachjuan.com
offencebzo.space
yunchuangyoupin.com
azdirtworks.com
manconnectr.services
islamicandotherhittopics.com
habiliurapol.xyz
exm-droneops.one
lemonbrite.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3500-13-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3500-14-0x000000000041D020-mapping.dmp xloader behavioral2/memory/1372-21-0x0000000002FB0000-0x0000000002FD8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
payment _doc.exepayment _doc.exewscript.exedescription pid process target process PID 1176 set thread context of 3500 1176 payment _doc.exe payment _doc.exe PID 3500 set thread context of 2588 3500 payment _doc.exe Explorer.EXE PID 1372 set thread context of 2588 1372 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
payment _doc.exewscript.exepid process 3500 payment _doc.exe 3500 payment _doc.exe 3500 payment _doc.exe 3500 payment _doc.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe 1372 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
payment _doc.exewscript.exepid process 3500 payment _doc.exe 3500 payment _doc.exe 3500 payment _doc.exe 1372 wscript.exe 1372 wscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
payment _doc.exewscript.exedescription pid process Token: SeDebugPrivilege 3500 payment _doc.exe Token: SeDebugPrivilege 1372 wscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2588 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
payment _doc.exeExplorer.EXEwscript.exedescription pid process target process PID 1176 wrote to memory of 3500 1176 payment _doc.exe payment _doc.exe PID 1176 wrote to memory of 3500 1176 payment _doc.exe payment _doc.exe PID 1176 wrote to memory of 3500 1176 payment _doc.exe payment _doc.exe PID 1176 wrote to memory of 3500 1176 payment _doc.exe payment _doc.exe PID 1176 wrote to memory of 3500 1176 payment _doc.exe payment _doc.exe PID 1176 wrote to memory of 3500 1176 payment _doc.exe payment _doc.exe PID 2588 wrote to memory of 1372 2588 Explorer.EXE wscript.exe PID 2588 wrote to memory of 1372 2588 Explorer.EXE wscript.exe PID 2588 wrote to memory of 1372 2588 Explorer.EXE wscript.exe PID 1372 wrote to memory of 3804 1372 wscript.exe cmd.exe PID 1372 wrote to memory of 3804 1372 wscript.exe cmd.exe PID 1372 wrote to memory of 3804 1372 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\payment _doc.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1176-2-0x0000000073A70000-0x000000007415E000-memory.dmpFilesize
6.9MB
-
memory/1176-3-0x00000000004E0000-0x00000000004E1000-memory.dmpFilesize
4KB
-
memory/1176-5-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/1176-6-0x00000000054D0000-0x00000000054D1000-memory.dmpFilesize
4KB
-
memory/1176-7-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/1176-8-0x00000000027E0000-0x00000000027E1000-memory.dmpFilesize
4KB
-
memory/1176-9-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/1176-10-0x0000000004F90000-0x0000000004FB3000-memory.dmpFilesize
140KB
-
memory/1176-11-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/1176-12-0x0000000005CC0000-0x0000000005D21000-memory.dmpFilesize
388KB
-
memory/1372-19-0x0000000000000000-mapping.dmp
-
memory/1372-21-0x0000000002FB0000-0x0000000002FD8000-memory.dmpFilesize
160KB
-
memory/1372-20-0x00000000008D0000-0x00000000008F7000-memory.dmpFilesize
156KB
-
memory/1372-23-0x0000000004990000-0x0000000004CB0000-memory.dmpFilesize
3.1MB
-
memory/1372-24-0x0000000004720000-0x00000000047AF000-memory.dmpFilesize
572KB
-
memory/2588-18-0x0000000003240000-0x0000000003329000-memory.dmpFilesize
932KB
-
memory/2588-25-0x0000000005820000-0x00000000059AB000-memory.dmpFilesize
1.5MB
-
memory/3500-14-0x000000000041D020-mapping.dmp
-
memory/3500-16-0x00000000017E0000-0x0000000001B00000-memory.dmpFilesize
3.1MB
-
memory/3500-17-0x00000000012E0000-0x00000000012F0000-memory.dmpFilesize
64KB
-
memory/3500-13-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3804-22-0x0000000000000000-mapping.dmp