PAYMENT COPY.zip

General
Target

PAYMENT COPY.exe

Filesize

866KB

Completed

24-09-2021 10:22

Score
10 /10
MD5

24736913b455be2ed3d1cc67c767afc4

SHA1

8026db0f265178cf013ac579c1b7267f4014bf2c

SHA256

a109f0b9407728fef1b41d766e8228085ee04661156d84ef543777bf311f450b

Malware Config

Extracted

Family xloader
Version 2.5
Campaign c2ue
C2

http://www.heidevelop.xyz/c2ue/

Decoy

isportdata.com

stellarex.energy

hsucollections.com

menuhaisan.com

joe-tzu.com

lumichargemktg.com

uae.tires

rapidcae.com

softwaresystemsolutions.com

s-galaxy.website

daewon-talks.net

northgamesnetwork.com

catalogue-bouyguestele.com

criativanet.com

theseasonalshift.com

actionfoto.online

openmaildoe.com

trashpenguin.com

ennopure.net

azurermine.com

wingkingtong.com

innovativepropsolutions.com

transportesajusco.online

rosenblasts.info

ttsports.store

servpix.com

liveatthebiltmore.com

magentautil.com

aquolly.com

collabsales.com

bredaslo.com

suddisaddu.com

www920011a.com

uudh.info

bleuexpress.com

xivuko.com

upstatehvacpros.com

acami.art

thqahql.com

mauzabe.com

mydrones.net

franciseshun.com

nrrpri.com

adndpanel.xyz

straightcorndinner.xyz

locngrip.com

wgylab.xyz

greenmamba100.com

dmglobalconsult.net

alissanoume.xyz

Signatures 9

Filter: none

  • Xloader

    Description

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3348-126-0x0000000000400000-0x0000000000429000-memory.dmpxloader
    behavioral2/memory/3348-127-0x000000000041D3A0-mapping.dmpxloader
    behavioral2/memory/1804-136-0x0000000000800000-0x0000000000829000-memory.dmpxloader
  • Suspicious use of SetThreadContext
    PAYMENT COPY.exePAYMENT COPY.exemsiexec.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 628 set thread context of 3348628PAYMENT COPY.exePAYMENT COPY.exe
    PID 3348 set thread context of 29963348PAYMENT COPY.exeExplorer.EXE
    PID 1804 set thread context of 29961804msiexec.exeExplorer.EXE
  • Suspicious behavior: EnumeratesProcesses
    PAYMENT COPY.exePAYMENT COPY.exemsiexec.exe

    Reported IOCs

    pidprocess
    628PAYMENT COPY.exe
    628PAYMENT COPY.exe
    628PAYMENT COPY.exe
    628PAYMENT COPY.exe
    3348PAYMENT COPY.exe
    3348PAYMENT COPY.exe
    3348PAYMENT COPY.exe
    3348PAYMENT COPY.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
    1804msiexec.exe
  • Suspicious behavior: GetForegroundWindowSpam
    Explorer.EXE

    Reported IOCs

    pidprocess
    2996Explorer.EXE
  • Suspicious behavior: MapViewOfSection
    PAYMENT COPY.exemsiexec.exe

    Reported IOCs

    pidprocess
    3348PAYMENT COPY.exe
    3348PAYMENT COPY.exe
    3348PAYMENT COPY.exe
    1804msiexec.exe
    1804msiexec.exe
  • Suspicious use of AdjustPrivilegeToken
    PAYMENT COPY.exePAYMENT COPY.exemsiexec.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege628PAYMENT COPY.exe
    Token: SeDebugPrivilege3348PAYMENT COPY.exe
    Token: SeDebugPrivilege1804msiexec.exe
  • Suspicious use of UnmapMainImage
    Explorer.EXE

    Reported IOCs

    pidprocess
    2996Explorer.EXE
  • Suspicious use of WriteProcessMemory
    PAYMENT COPY.exeExplorer.EXEmsiexec.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 628 wrote to memory of 3632628PAYMENT COPY.exePAYMENT COPY.exe
    PID 628 wrote to memory of 3632628PAYMENT COPY.exePAYMENT COPY.exe
    PID 628 wrote to memory of 3632628PAYMENT COPY.exePAYMENT COPY.exe
    PID 628 wrote to memory of 2664628PAYMENT COPY.exePAYMENT COPY.exe
    PID 628 wrote to memory of 2664628PAYMENT COPY.exePAYMENT COPY.exe
    PID 628 wrote to memory of 2664628PAYMENT COPY.exePAYMENT COPY.exe
    PID 628 wrote to memory of 3348628PAYMENT COPY.exePAYMENT COPY.exe
    PID 628 wrote to memory of 3348628PAYMENT COPY.exePAYMENT COPY.exe
    PID 628 wrote to memory of 3348628PAYMENT COPY.exePAYMENT COPY.exe
    PID 628 wrote to memory of 3348628PAYMENT COPY.exePAYMENT COPY.exe
    PID 628 wrote to memory of 3348628PAYMENT COPY.exePAYMENT COPY.exe
    PID 628 wrote to memory of 3348628PAYMENT COPY.exePAYMENT COPY.exe
    PID 2996 wrote to memory of 18042996Explorer.EXEmsiexec.exe
    PID 2996 wrote to memory of 18042996Explorer.EXEmsiexec.exe
    PID 2996 wrote to memory of 18042996Explorer.EXEmsiexec.exe
    PID 1804 wrote to memory of 4041804msiexec.execmd.exe
    PID 1804 wrote to memory of 4041804msiexec.execmd.exe
    PID 1804 wrote to memory of 4041804msiexec.execmd.exe
Processes 7
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of UnmapMainImage
    Suspicious use of WriteProcessMemory
    PID:2996
    • C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe
      "C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:628
      • C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe
        "{path}"
        PID:3632
      • C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe
        "{path}"
        PID:2664
      • C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe
        "{path}"
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        PID:3348
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\PAYMENT COPY.exe"
        PID:404
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/404-134-0x0000000000000000-mapping.dmp

                          • memory/628-114-0x0000000000150000-0x0000000000151000-memory.dmp

                          • memory/628-116-0x0000000004A60000-0x0000000004A61000-memory.dmp

                          • memory/628-118-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                          • memory/628-119-0x0000000004A40000-0x0000000004A41000-memory.dmp

                          • memory/628-120-0x0000000004D40000-0x0000000004D41000-memory.dmp

                          • memory/628-121-0x00000000049C0000-0x0000000004A5C000-memory.dmp

                          • memory/628-122-0x0000000005540000-0x0000000005541000-memory.dmp

                          • memory/628-117-0x0000000005040000-0x0000000005041000-memory.dmp

                          • memory/628-124-0x0000000008AD0000-0x0000000008B49000-memory.dmp

                          • memory/628-125-0x0000000008B80000-0x0000000008BAB000-memory.dmp

                          • memory/628-123-0x00000000044F0000-0x00000000044FE000-memory.dmp

                          • memory/1804-138-0x0000000001150000-0x00000000011E0000-memory.dmp

                          • memory/1804-137-0x00000000047B0000-0x0000000004AD0000-memory.dmp

                          • memory/1804-136-0x0000000000800000-0x0000000000829000-memory.dmp

                          • memory/1804-135-0x0000000001390000-0x00000000013A2000-memory.dmp

                          • memory/1804-131-0x0000000000000000-mapping.dmp

                          • memory/2996-139-0x0000000007040000-0x0000000007164000-memory.dmp

                          • memory/2996-130-0x0000000006EF0000-0x0000000007038000-memory.dmp

                          • memory/3348-128-0x0000000001180000-0x00000000014A0000-memory.dmp

                          • memory/3348-129-0x00000000010F0000-0x0000000001101000-memory.dmp

                          • memory/3348-127-0x000000000041D3A0-mapping.dmp

                          • memory/3348-126-0x0000000000400000-0x0000000000429000-memory.dmp