Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
10-09-2021 11:29
Static task
static1
Behavioral task
behavioral1
Sample
pay $.exe
Resource
win7-en
General
-
Target
pay $.exe
-
Size
557KB
-
MD5
5f36a5d12506389cb097a59838155c52
-
SHA1
b4de1b62ee1775c0e10fe0442cd1b6b3ef75146b
-
SHA256
43d831616e23a03c055971bc1c7c9ae0e87f491976e72ce8fa0074610f004488
-
SHA512
0dd7386c15c606c465496ff837a9780efa889a117da31c93f388601483d7d8f473a3ef80a727f7ac0b039d272c4753abc3bac73bdd53bb109bd5515134dd7ff6
Malware Config
Extracted
xloader
2.3
t75f
http://www.vertexnailsblaine.com/t75f/
onegolfsydney.com
kaizensportscoaching.com
mliacbjv.icu
rinstech.net
midas-parts.com
istmenian.com
ibrahimpike.com
herbspaces.com
gentleman4higher.com
workabusiness.com
isabusive.website
222555dy.com
lwhyzhzb.xyz
gabrielabravoillanes.com
hearthomelife.com
buildswealth.com
printitaz.com
l-mventures.com
baincot3.com
nstaq-labs.com
wikendi.com
newyears21.com
citestaccnt1597730671.com
thecuriousincidentwes.com
alchembiopro.com
stardustanimations.com
ssgasiaw.com
sarajanesstudio.com
whitepointfineart.com
dlglawtx.com
doudiangroup.com
jackpod.team
abvoltprunus.bid
miimamablog.com
selfbuildwithmannok.com
thanhxuan99.online
germantos.com
waterdoor.net
wmscloud.net
services-24hras.com
maneadvisors.com
mosineetowing.com
blockdelightsmart.com
booyaka.design
brewery-run.com
dexteroushandmade.com
minhamochila.com
drawingwoo.com
thesalcombefurniturecompany.net
nashautoglass.com
beenationgear.com
cleanseforlifewellness.com
corecounselingcenter.info
naturalcreativesociety.com
sarcontraders.com
lickitbuddyrehab.com
theweekendrecap.com
cetiya-veluvana.com
w7asd.net
nyctophilia.net
asialion.net
goldentreegrp.com
jacobuspark.com
punchingforce.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3820-125-0x000000000041D110-mapping.dmp xloader behavioral2/memory/3820-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2256-132-0x00000000022C0000-0x00000000022E9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
pay $.exeRegSvcs.exehelp.exedescription pid process target process PID 740 set thread context of 3820 740 pay $.exe RegSvcs.exe PID 3820 set thread context of 2536 3820 RegSvcs.exe Explorer.EXE PID 2256 set thread context of 2536 2256 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
pay $.exeRegSvcs.exehelp.exepid process 740 pay $.exe 740 pay $.exe 740 pay $.exe 740 pay $.exe 740 pay $.exe 740 pay $.exe 3820 RegSvcs.exe 3820 RegSvcs.exe 3820 RegSvcs.exe 3820 RegSvcs.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe 2256 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2536 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exehelp.exepid process 3820 RegSvcs.exe 3820 RegSvcs.exe 3820 RegSvcs.exe 2256 help.exe 2256 help.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
pay $.exeRegSvcs.exehelp.exedescription pid process Token: SeDebugPrivilege 740 pay $.exe Token: SeDebugPrivilege 3820 RegSvcs.exe Token: SeDebugPrivilege 2256 help.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2536 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
pay $.exeExplorer.EXEhelp.exedescription pid process target process PID 740 wrote to memory of 68 740 pay $.exe RegSvcs.exe PID 740 wrote to memory of 68 740 pay $.exe RegSvcs.exe PID 740 wrote to memory of 68 740 pay $.exe RegSvcs.exe PID 740 wrote to memory of 1008 740 pay $.exe RegSvcs.exe PID 740 wrote to memory of 1008 740 pay $.exe RegSvcs.exe PID 740 wrote to memory of 1008 740 pay $.exe RegSvcs.exe PID 740 wrote to memory of 3820 740 pay $.exe RegSvcs.exe PID 740 wrote to memory of 3820 740 pay $.exe RegSvcs.exe PID 740 wrote to memory of 3820 740 pay $.exe RegSvcs.exe PID 740 wrote to memory of 3820 740 pay $.exe RegSvcs.exe PID 740 wrote to memory of 3820 740 pay $.exe RegSvcs.exe PID 740 wrote to memory of 3820 740 pay $.exe RegSvcs.exe PID 2536 wrote to memory of 2256 2536 Explorer.EXE help.exe PID 2536 wrote to memory of 2256 2536 Explorer.EXE help.exe PID 2536 wrote to memory of 2256 2536 Explorer.EXE help.exe PID 2256 wrote to memory of 3844 2256 help.exe cmd.exe PID 2256 wrote to memory of 3844 2256 help.exe cmd.exe PID 2256 wrote to memory of 3844 2256 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pay $.exe"C:\Users\Admin\AppData\Local\Temp\pay $.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/740-123-0x0000000007060000-0x000000000708A000-memory.dmpFilesize
168KB
-
memory/740-114-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/740-117-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/740-118-0x0000000005280000-0x000000000577E000-memory.dmpFilesize
5.0MB
-
memory/740-122-0x0000000006EA0000-0x0000000006EFB000-memory.dmpFilesize
364KB
-
memory/740-120-0x0000000008980000-0x0000000008981000-memory.dmpFilesize
4KB
-
memory/740-116-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/740-121-0x00000000088E0000-0x00000000088F6000-memory.dmpFilesize
88KB
-
memory/740-119-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/2256-132-0x00000000022C0000-0x00000000022E9000-memory.dmpFilesize
164KB
-
memory/2256-134-0x0000000002A40000-0x0000000002ACF000-memory.dmpFilesize
572KB
-
memory/2256-133-0x0000000002E70000-0x0000000003190000-memory.dmpFilesize
3.1MB
-
memory/2256-129-0x0000000000000000-mapping.dmp
-
memory/2256-131-0x00000000002A0000-0x00000000002A7000-memory.dmpFilesize
28KB
-
memory/2536-135-0x0000000005570000-0x00000000056A4000-memory.dmpFilesize
1.2MB
-
memory/2536-128-0x0000000005E10000-0x0000000005FAC000-memory.dmpFilesize
1.6MB
-
memory/3820-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3820-126-0x00000000011A0000-0x00000000014C0000-memory.dmpFilesize
3.1MB
-
memory/3820-127-0x0000000000E30000-0x0000000000E40000-memory.dmpFilesize
64KB
-
memory/3820-125-0x000000000041D110-mapping.dmp
-
memory/3844-130-0x0000000000000000-mapping.dmp