Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 16:40
Static task
static1
Behavioral task
behavioral1
Sample
Payment_Advice000987.exe
Resource
win7v20210408
General
-
Target
Payment_Advice000987.exe
-
Size
1.1MB
-
MD5
ce92634fff801af8ce0a1263ce436fc0
-
SHA1
28c4d7ca4f3f3680b2d23a109c2b8934c625c219
-
SHA256
ce9fb89fadc9b872b78b1eb08bf0e160f08c00acf7de61a490de8d62a5d770de
-
SHA512
78b4976506401fe1a7d9cf2569293cd8ec97b6ea3281a5e7078d8eb5b655dd27273e6e1b57310424aa43c7d5f00e3b3541259af666ed7097f2a55c85840fa714
Malware Config
Extracted
xloader
2.3
http://www.bodymoisturizer.online/q4kr/
realmodapk.com
hanoharuka.com
shivalikspiritualproducts.com
womenshealthclinincagra.com
racketpark.com
startuporig.com
azkachinas.com
klanblog.com
linuxradio.tools
siteoficial-liquida.com
glsbuyer.com
bestdeez.com
teens2cash.com
valleyviewconstruct.com
myfortniteskins.com
cambecare.com
csec2011.com
idookap.com
warmwallsrecords.com
smartmirror.one
alertreels.com
oiop.online
61cratoslot.com
hispanicassoclv.com
pennyforyourprep.com
fayansistanbul.com
superbartendergigs.club
herr-nourimann.com
oatkc.net
romahony.com
sportcrea.com
crystalnieblas.com
lcmet.com
nwaymyatthu-mm.com
edsufferen.club
apispotlight.com
shadowcatrecording.com
capwisefin.com
themesinsider.com
kadrisells.com
db-82.com
rentyoursubmarine.com
rin-ronshop.com
donzfamilia.com
loyalcollegeofart.com
socialize.site
shadesailstructure.com
smcenterbiz.com
zcdonghua.com
1420radiolider.com
ckenpo.com
trucksitasa.com
getthistle.com
usvisanicaragua.com
josiemaxwrites.com
dehaagennutraceuticals.com
noiaapp.com
blinbins.com
getreitive.com
turmericbar.com
manifestwealthrightnow.com
garagekuhn.com
longviewfinancialadvisor.com
hallworthcapital.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2124-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2124-126-0x000000000041D0D0-mapping.dmp xloader behavioral2/memory/800-134-0x0000000000160000-0x0000000000189000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Payment_Advice000987.exeRegSvcs.execmstp.exedescription pid process target process PID 4036 set thread context of 2124 4036 Payment_Advice000987.exe RegSvcs.exe PID 2124 set thread context of 3120 2124 RegSvcs.exe Explorer.EXE PID 2124 set thread context of 3120 2124 RegSvcs.exe Explorer.EXE PID 800 set thread context of 3120 800 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 41 IoCs
Processes:
Payment_Advice000987.exeRegSvcs.execmstp.exepid process 4036 Payment_Advice000987.exe 4036 Payment_Advice000987.exe 4036 Payment_Advice000987.exe 2124 RegSvcs.exe 2124 RegSvcs.exe 2124 RegSvcs.exe 2124 RegSvcs.exe 2124 RegSvcs.exe 2124 RegSvcs.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe 800 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3120 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.execmstp.exepid process 2124 RegSvcs.exe 2124 RegSvcs.exe 2124 RegSvcs.exe 2124 RegSvcs.exe 800 cmstp.exe 800 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Payment_Advice000987.exeRegSvcs.execmstp.exedescription pid process Token: SeDebugPrivilege 4036 Payment_Advice000987.exe Token: SeDebugPrivilege 2124 RegSvcs.exe Token: SeDebugPrivilege 800 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3120 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Payment_Advice000987.exeExplorer.EXEcmstp.exedescription pid process target process PID 4036 wrote to memory of 3832 4036 Payment_Advice000987.exe RegSvcs.exe PID 4036 wrote to memory of 3832 4036 Payment_Advice000987.exe RegSvcs.exe PID 4036 wrote to memory of 3832 4036 Payment_Advice000987.exe RegSvcs.exe PID 4036 wrote to memory of 2124 4036 Payment_Advice000987.exe RegSvcs.exe PID 4036 wrote to memory of 2124 4036 Payment_Advice000987.exe RegSvcs.exe PID 4036 wrote to memory of 2124 4036 Payment_Advice000987.exe RegSvcs.exe PID 4036 wrote to memory of 2124 4036 Payment_Advice000987.exe RegSvcs.exe PID 4036 wrote to memory of 2124 4036 Payment_Advice000987.exe RegSvcs.exe PID 4036 wrote to memory of 2124 4036 Payment_Advice000987.exe RegSvcs.exe PID 3120 wrote to memory of 800 3120 Explorer.EXE cmstp.exe PID 3120 wrote to memory of 800 3120 Explorer.EXE cmstp.exe PID 3120 wrote to memory of 800 3120 Explorer.EXE cmstp.exe PID 800 wrote to memory of 392 800 cmstp.exe cmd.exe PID 800 wrote to memory of 392 800 cmstp.exe cmd.exe PID 800 wrote to memory of 392 800 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment_Advice000987.exe"C:\Users\Admin\AppData\Local\Temp\Payment_Advice000987.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/392-136-0x0000000000000000-mapping.dmp
-
memory/800-132-0x0000000000000000-mapping.dmp
-
memory/800-137-0x0000000004170000-0x00000000041FF000-memory.dmpFilesize
572KB
-
memory/800-134-0x0000000000160000-0x0000000000189000-memory.dmpFilesize
164KB
-
memory/800-135-0x0000000004280000-0x00000000045A0000-memory.dmpFilesize
3.1MB
-
memory/800-133-0x0000000000AB0000-0x0000000000AC6000-memory.dmpFilesize
88KB
-
memory/2124-128-0x0000000001300000-0x000000000144A000-memory.dmpFilesize
1.3MB
-
memory/2124-130-0x0000000001490000-0x00000000014A0000-memory.dmpFilesize
64KB
-
memory/2124-127-0x00000000019A0000-0x0000000001CC0000-memory.dmpFilesize
3.1MB
-
memory/2124-126-0x000000000041D0D0-mapping.dmp
-
memory/2124-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3120-129-0x00000000069E0000-0x0000000006AFA000-memory.dmpFilesize
1.1MB
-
memory/3120-138-0x0000000006350000-0x0000000006425000-memory.dmpFilesize
852KB
-
memory/3120-131-0x0000000006B00000-0x0000000006C16000-memory.dmpFilesize
1.1MB
-
memory/4036-121-0x0000000005900000-0x0000000005DFE000-memory.dmpFilesize
5.0MB
-
memory/4036-122-0x0000000005C50000-0x0000000005C6B000-memory.dmpFilesize
108KB
-
memory/4036-123-0x0000000007EE0000-0x0000000007F87000-memory.dmpFilesize
668KB
-
memory/4036-124-0x0000000007FA0000-0x0000000008002000-memory.dmpFilesize
392KB
-
memory/4036-120-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/4036-119-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/4036-118-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/4036-117-0x0000000005E00000-0x0000000005E01000-memory.dmpFilesize
4KB
-
memory/4036-114-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/4036-116-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB