Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-07-2021 16:40
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Advice000987.exe
Resource
win7v20210408
General
-
Target
Payment_Advice000987.exe
-
Size
1.1MB
-
MD5
ce92634fff801af8ce0a1263ce436fc0
-
SHA1
28c4d7ca4f3f3680b2d23a109c2b8934c625c219
-
SHA256
ce9fb89fadc9b872b78b1eb08bf0e160f08c00acf7de61a490de8d62a5d770de
-
SHA512
78b4976506401fe1a7d9cf2569293cd8ec97b6ea3281a5e7078d8eb5b655dd27273e6e1b57310424aa43c7d5f00e3b3541259af666ed7097f2a55c85840fa714
Malware Config
Extracted
xloader
2.3
http://www.bodymoisturizer.online/q4kr/
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/660-67-0x000000000041D0D0-mapping.dmp xloader behavioral1/memory/660-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/564-74-0x0000000000070000-0x0000000000099000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
wscript.exeflow pid process 12 564 wscript.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Payment_Advice000987.exeRegSvcs.exewscript.exedescription pid process target process PID 684 set thread context of 660 684 Payment_Advice000987.exe RegSvcs.exe PID 660 set thread context of 1252 660 RegSvcs.exe Explorer.EXE PID 564 set thread context of 1252 564 wscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Payment_Advice000987.exeRegSvcs.exewscript.exepid process 684 Payment_Advice000987.exe 660 RegSvcs.exe 660 RegSvcs.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe 564 wscript.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exewscript.exepid process 660 RegSvcs.exe 660 RegSvcs.exe 660 RegSvcs.exe 564 wscript.exe 564 wscript.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Payment_Advice000987.exeRegSvcs.exewscript.exedescription pid process Token: SeDebugPrivilege 684 Payment_Advice000987.exe Token: SeDebugPrivilege 660 RegSvcs.exe Token: SeDebugPrivilege 564 wscript.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE 1252 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Payment_Advice000987.exeExplorer.EXEwscript.exedescription pid process target process PID 684 wrote to memory of 660 684 Payment_Advice000987.exe RegSvcs.exe PID 684 wrote to memory of 660 684 Payment_Advice000987.exe RegSvcs.exe PID 684 wrote to memory of 660 684 Payment_Advice000987.exe RegSvcs.exe PID 684 wrote to memory of 660 684 Payment_Advice000987.exe RegSvcs.exe PID 684 wrote to memory of 660 684 Payment_Advice000987.exe RegSvcs.exe PID 684 wrote to memory of 660 684 Payment_Advice000987.exe RegSvcs.exe PID 684 wrote to memory of 660 684 Payment_Advice000987.exe RegSvcs.exe PID 684 wrote to memory of 660 684 Payment_Advice000987.exe RegSvcs.exe PID 684 wrote to memory of 660 684 Payment_Advice000987.exe RegSvcs.exe PID 684 wrote to memory of 660 684 Payment_Advice000987.exe RegSvcs.exe PID 1252 wrote to memory of 564 1252 Explorer.EXE wscript.exe PID 1252 wrote to memory of 564 1252 Explorer.EXE wscript.exe PID 1252 wrote to memory of 564 1252 Explorer.EXE wscript.exe PID 1252 wrote to memory of 564 1252 Explorer.EXE wscript.exe PID 564 wrote to memory of 576 564 wscript.exe cmd.exe PID 564 wrote to memory of 576 564 wscript.exe cmd.exe PID 564 wrote to memory of 576 564 wscript.exe cmd.exe PID 564 wrote to memory of 576 564 wscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment_Advice000987.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Advice000987.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-71-0x0000000000000000-mapping.dmp
-
memory/564-78-0x0000000075C71000-0x0000000075C73000-memory.dmpFilesize
8KB
-
memory/564-76-0x00000000002C0000-0x000000000034F000-memory.dmpFilesize
572KB
-
memory/564-75-0x0000000001FE0000-0x00000000022E3000-memory.dmpFilesize
3.0MB
-
memory/564-74-0x0000000000070000-0x0000000000099000-memory.dmpFilesize
164KB
-
memory/564-73-0x0000000000390000-0x00000000003B6000-memory.dmpFilesize
152KB
-
memory/576-72-0x0000000000000000-mapping.dmp
-
memory/660-68-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/660-69-0x00000000000C0000-0x00000000000D0000-memory.dmpFilesize
64KB
-
memory/660-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/660-67-0x000000000041D0D0-mapping.dmp
-
memory/684-60-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB
-
memory/684-65-0x00000000050E0000-0x0000000005142000-memory.dmpFilesize
392KB
-
memory/684-64-0x0000000005A00000-0x0000000005AA7000-memory.dmpFilesize
668KB
-
memory/684-63-0x00000000005E0000-0x00000000005FB000-memory.dmpFilesize
108KB
-
memory/684-62-0x0000000004D20000-0x0000000004D21000-memory.dmpFilesize
4KB
-
memory/1252-70-0x0000000004BA0000-0x0000000004CA6000-memory.dmpFilesize
1.0MB
-
memory/1252-77-0x0000000004A40000-0x0000000004B12000-memory.dmpFilesize
840KB