Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en -
submitted
15-09-2021 13:46
Static task
static1
Behavioral task
behavioral1
Sample
Payment document.exe
Resource
win7v20210408
General
-
Target
Payment document.exe
-
Size
532KB
-
MD5
d0cceb56aaec4f8d458498904813b790
-
SHA1
8efefaefb2a32c05c3282721be10c0b838c0cc96
-
SHA256
bb60b98852cad89fe450ec8486cee96bb6932b29c692f97d5b7ed7936556845f
-
SHA512
26137c91ab694b4bc21d06ed5f5f916c6884f7a7a94536a22948290c9cfa1cb1ac84ecd4f0893784eaab0eb6c674f05d6062b0dc6f61293935bb3eef53571de0
Malware Config
Extracted
xloader
2.4
dbew
http://www.mengtai.xyz/dbew/
unblock-sites.xyz
xkmfiue.com
8pz96.com
affkart.com
attila-velte.com
hyrq30.website
tinoovia.com
egraintrade.com
smokynagata.com
welojz.xyz
lizethdavid.com
traumland56.com
player23games.com
mvnupersonaltraining.com
anonymousmen.com
learnchinese-school.com
haus-us.com
homayounmusic.com
kp-taku.com
djalleykat.com
cinaje.com
leohusdesign.com
johnstowntechsupport.com
epicaccesssolutions.biz
ny660.xyz
frtgfrfcfddffyvhhuhvfhujjfr.com
stopshopma.com
liylaehamarmaat3.xyz
1axlpkfm.icu
everbytecloud.com
tokitrip.com
popllp.com
29athurleighgrove.com
nakamotorecords.com
classiccityfringefestival.com
neovoguetriunfo.com
kishakpeace.com
tongsh.net
snaggy.site
justinamashcompany.com
blackdoorvermont.com
soukawaii.com
connector3.xyz
qlifescooter.com
instanewsinfo.com
zs-spring.com
hilist.xyz
ffpc.site
brightsunlatheworks.com
goosengakhaw.com
rowadconstruct.com
octanesyndicate.com
taxisperu.com
noweyessee.com
thooklivestock.com
treiding-oficial.site
southbanktempe.com
mo2.asia
tastetheduniya.com
santinoguera.com
deerfieldbeachmedicare.com
lifeslemon.com
shanghaiinvestments.com
driveretaildirect.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4044-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4044-126-0x000000000041D3E0-mapping.dmp xloader behavioral2/memory/3656-133-0x00000000006E0000-0x0000000000709000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Payment document.exePayment document.exeexplorer.exedescription pid process target process PID 3972 set thread context of 4044 3972 Payment document.exe Payment document.exe PID 4044 set thread context of 2280 4044 Payment document.exe Explorer.EXE PID 3656 set thread context of 2280 3656 explorer.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
Payment document.exePayment document.exeexplorer.exepid process 3972 Payment document.exe 3972 Payment document.exe 4044 Payment document.exe 4044 Payment document.exe 4044 Payment document.exe 4044 Payment document.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe 3656 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2280 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Payment document.exeexplorer.exepid process 4044 Payment document.exe 4044 Payment document.exe 4044 Payment document.exe 3656 explorer.exe 3656 explorer.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
Payment document.exePayment document.exeexplorer.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 3972 Payment document.exe Token: SeDebugPrivilege 4044 Payment document.exe Token: SeDebugPrivilege 3656 explorer.exe Token: SeShutdownPrivilege 2280 Explorer.EXE Token: SeCreatePagefilePrivilege 2280 Explorer.EXE Token: SeShutdownPrivilege 2280 Explorer.EXE Token: SeCreatePagefilePrivilege 2280 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 2280 Explorer.EXE 2280 Explorer.EXE 2280 Explorer.EXE 2280 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Payment document.exeExplorer.EXEexplorer.exedescription pid process target process PID 3972 wrote to memory of 4044 3972 Payment document.exe Payment document.exe PID 3972 wrote to memory of 4044 3972 Payment document.exe Payment document.exe PID 3972 wrote to memory of 4044 3972 Payment document.exe Payment document.exe PID 3972 wrote to memory of 4044 3972 Payment document.exe Payment document.exe PID 3972 wrote to memory of 4044 3972 Payment document.exe Payment document.exe PID 3972 wrote to memory of 4044 3972 Payment document.exe Payment document.exe PID 2280 wrote to memory of 3656 2280 Explorer.EXE explorer.exe PID 2280 wrote to memory of 3656 2280 Explorer.EXE explorer.exe PID 2280 wrote to memory of 3656 2280 Explorer.EXE explorer.exe PID 3656 wrote to memory of 776 3656 explorer.exe cmd.exe PID 3656 wrote to memory of 776 3656 explorer.exe cmd.exe PID 3656 wrote to memory of 776 3656 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment document.exe"C:\Users\Admin\AppData\Local\Temp\Payment document.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment document.exe"C:\Users\Admin\AppData\Local\Temp\Payment document.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment document.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/776-131-0x0000000000000000-mapping.dmp
-
memory/2280-129-0x0000000006030000-0x0000000006145000-memory.dmpFilesize
1.1MB
-
memory/2280-136-0x0000000002BC0000-0x0000000002C8D000-memory.dmpFilesize
820KB
-
memory/3656-135-0x0000000004980000-0x0000000004A10000-memory.dmpFilesize
576KB
-
memory/3656-134-0x0000000004CB0000-0x0000000004FD0000-memory.dmpFilesize
3.1MB
-
memory/3656-132-0x0000000000C20000-0x000000000105F000-memory.dmpFilesize
4.2MB
-
memory/3656-133-0x00000000006E0000-0x0000000000709000-memory.dmpFilesize
164KB
-
memory/3656-130-0x0000000000000000-mapping.dmp
-
memory/3972-121-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/3972-124-0x00000000081A0000-0x00000000081CB000-memory.dmpFilesize
172KB
-
memory/3972-123-0x0000000005C90000-0x0000000005CEE000-memory.dmpFilesize
376KB
-
memory/3972-122-0x0000000004F50000-0x0000000004F57000-memory.dmpFilesize
28KB
-
memory/3972-115-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB
-
memory/3972-120-0x0000000004FB0000-0x00000000054AE000-memory.dmpFilesize
5.0MB
-
memory/3972-119-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/3972-118-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/3972-117-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/4044-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4044-126-0x000000000041D3E0-mapping.dmp
-
memory/4044-128-0x00000000017B0000-0x00000000017C1000-memory.dmpFilesize
68KB
-
memory/4044-127-0x0000000001880000-0x0000000001BA0000-memory.dmpFilesize
3.1MB