Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en -
submitted
15-09-2021 07:14
Static task
static1
Behavioral task
behavioral1
Sample
Unpaid invoice.exe
Resource
win7v20210408
General
-
Target
Unpaid invoice.exe
-
Size
548KB
-
MD5
3ade5b9b508051cc39c1c610f4af5a12
-
SHA1
662056878a2b1fb1e99d1f74bb0e8694904fdccd
-
SHA256
207dff33f6f91f114deae60a6cb3a404a5f40bc607fb6015f680c8980af7ac16
-
SHA512
a99f9f23663bc09fca19a96968a15014679e8bbe2bb4a6f64897a34b86faf72848af138b4dbdcda1ef19d4e2488e81dc447c50af5e05f2c67cf7521b070c3d0f
Malware Config
Extracted
xloader
2.3
b6cu
http://www.allfyllofficial.com/b6cu/
sxdiyan.com
web0084.com
cpafirmspokane.com
la-bio-geo.com
chacrit.com
stuntfighting.com
rjsworkshop.com
themillennialsfinest.com
thefrontrealestate.com
chairmn.com
best1korea.com
gudssutu.icu
backupchip.net
shrikanthamimports.com
sportrecoverysleeve.com
healthy-shack.com
investperwear.com
intertradeperu.com
resonantonshop.com
greghugheslaw.com
instrumentum.store
creative-cloud.info
sansfoundations.com
pmca.asia
night.doctor
19v5.com
cmas.life
yhanlikho.com
kartikpatelrealtor.com
viralpagi.com
samsonengineeringco.com
mh666.cool
laboratoriosjj.com
produklokal.com
tjhysb.com
solutions-oigroup.com
chictarh.com
gotmail.info
yourvalue.online
mylinkreview.com
champonpowerequipment.com
starcoupeownersindonesia.com
buzagialtligi.com
botol2-lasdnk.com
blunss.info
l3-construction.com
fmodesign.com
silkraga.com
editimpact.com
unionairjordanla.com
lacageavin.com
gushixiu.com
cleanlast.com
awvpvkmzxa.com
xiaosandao.com
nldcostmetics.com
prosperitywithsoul.com
kheticulture.com
booksbykimberlyeandco.com
creativehughes.com
mobilewz.com
arerasols.com
w-hanaemi-personal.com
dynamonetwork.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4660-126-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4660-127-0x000000000041D0B0-mapping.dmp xloader behavioral2/memory/4736-135-0x00000000004F0000-0x0000000000519000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
msiexec.exeflow pid process 40 4736 msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Unpaid invoice.exeUnpaid invoice.exemsiexec.exedescription pid process target process PID 4528 set thread context of 4660 4528 Unpaid invoice.exe Unpaid invoice.exe PID 4660 set thread context of 1832 4660 Unpaid invoice.exe Explorer.EXE PID 4736 set thread context of 1832 4736 msiexec.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
Unpaid invoice.exeUnpaid invoice.exemsiexec.exepid process 4528 Unpaid invoice.exe 4528 Unpaid invoice.exe 4660 Unpaid invoice.exe 4660 Unpaid invoice.exe 4660 Unpaid invoice.exe 4660 Unpaid invoice.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe 4736 msiexec.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1832 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Unpaid invoice.exemsiexec.exepid process 4660 Unpaid invoice.exe 4660 Unpaid invoice.exe 4660 Unpaid invoice.exe 4736 msiexec.exe 4736 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
Unpaid invoice.exeUnpaid invoice.exemsiexec.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 4528 Unpaid invoice.exe Token: SeDebugPrivilege 4660 Unpaid invoice.exe Token: SeDebugPrivilege 4736 msiexec.exe Token: SeShutdownPrivilege 1832 Explorer.EXE Token: SeCreatePagefilePrivilege 1832 Explorer.EXE Token: SeShutdownPrivilege 1832 Explorer.EXE Token: SeCreatePagefilePrivilege 1832 Explorer.EXE Token: SeShutdownPrivilege 1832 Explorer.EXE Token: SeCreatePagefilePrivilege 1832 Explorer.EXE Token: SeShutdownPrivilege 1832 Explorer.EXE Token: SeCreatePagefilePrivilege 1832 Explorer.EXE Token: SeShutdownPrivilege 1832 Explorer.EXE Token: SeCreatePagefilePrivilege 1832 Explorer.EXE Token: SeShutdownPrivilege 1832 Explorer.EXE Token: SeCreatePagefilePrivilege 1832 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1832 Explorer.EXE 1832 Explorer.EXE 1832 Explorer.EXE 1832 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Unpaid invoice.exeExplorer.EXEmsiexec.exedescription pid process target process PID 4528 wrote to memory of 4648 4528 Unpaid invoice.exe schtasks.exe PID 4528 wrote to memory of 4648 4528 Unpaid invoice.exe schtasks.exe PID 4528 wrote to memory of 4648 4528 Unpaid invoice.exe schtasks.exe PID 4528 wrote to memory of 4660 4528 Unpaid invoice.exe Unpaid invoice.exe PID 4528 wrote to memory of 4660 4528 Unpaid invoice.exe Unpaid invoice.exe PID 4528 wrote to memory of 4660 4528 Unpaid invoice.exe Unpaid invoice.exe PID 4528 wrote to memory of 4660 4528 Unpaid invoice.exe Unpaid invoice.exe PID 4528 wrote to memory of 4660 4528 Unpaid invoice.exe Unpaid invoice.exe PID 4528 wrote to memory of 4660 4528 Unpaid invoice.exe Unpaid invoice.exe PID 1832 wrote to memory of 4736 1832 Explorer.EXE msiexec.exe PID 1832 wrote to memory of 4736 1832 Explorer.EXE msiexec.exe PID 1832 wrote to memory of 4736 1832 Explorer.EXE msiexec.exe PID 4736 wrote to memory of 4772 4736 msiexec.exe cmd.exe PID 4736 wrote to memory of 4772 4736 msiexec.exe cmd.exe PID 4736 wrote to memory of 4772 4736 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NBYchW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB06A.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Unpaid invoice.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1832-130-0x0000000005800000-0x0000000005949000-memory.dmpFilesize
1.3MB
-
memory/1832-139-0x00000000011B0000-0x000000000127F000-memory.dmpFilesize
828KB
-
memory/4528-117-0x0000000005960000-0x0000000005961000-memory.dmpFilesize
4KB
-
memory/4528-118-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/4528-119-0x00000000054C0000-0x00000000054C1000-memory.dmpFilesize
4KB
-
memory/4528-120-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/4528-121-0x00000000054D0000-0x00000000054D7000-memory.dmpFilesize
28KB
-
memory/4528-122-0x0000000005460000-0x000000000595E000-memory.dmpFilesize
5.0MB
-
memory/4528-123-0x00000000061C0000-0x000000000621E000-memory.dmpFilesize
376KB
-
memory/4528-124-0x0000000008830000-0x000000000885A000-memory.dmpFilesize
168KB
-
memory/4528-115-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/4648-125-0x0000000000000000-mapping.dmp
-
memory/4660-126-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4660-128-0x0000000000E80000-0x00000000011A0000-memory.dmpFilesize
3.1MB
-
memory/4660-129-0x00000000005F0000-0x0000000000600000-memory.dmpFilesize
64KB
-
memory/4660-127-0x000000000041D0B0-mapping.dmp
-
memory/4736-131-0x0000000000000000-mapping.dmp
-
memory/4736-134-0x00000000013C0000-0x00000000013D2000-memory.dmpFilesize
72KB
-
memory/4736-135-0x00000000004F0000-0x0000000000519000-memory.dmpFilesize
164KB
-
memory/4736-137-0x0000000000F80000-0x00000000012A0000-memory.dmpFilesize
3.1MB
-
memory/4736-138-0x0000000000E00000-0x0000000000E8F000-memory.dmpFilesize
572KB
-
memory/4772-136-0x0000000000000000-mapping.dmp