Analysis
-
max time kernel
599s -
max time network
597s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
27-09-2021 04:14
Static task
static1
Behavioral task
behavioral1
Sample
Statement of Acct..exe
Resource
win7-en-20210920
General
-
Target
Statement of Acct..exe
-
Size
521KB
-
MD5
850ef5cb4d3e3023ab26072a4cc6a25f
-
SHA1
0947a5b62ad244324971c7863977befaae3d71fd
-
SHA256
bb7d986712c63235f866f11ebc85ac60c360676e0576a075f16c16f679c31c7b
-
SHA512
58e8d6ecc2fbae3d85ff390c30bb5e7cff7f392ea2eae7bec8844e25b14b310e6af1a40da3e1d85516b881d1dcad2081a4d65e4da07ac6bbe45fa6a6d4e804a7
Malware Config
Extracted
xloader
2.4
tgnd
http://www.fhuosa.com/tgnd/
forever1887.com
zkz889.icu
futuresmanagers.com
salondebelle.biz
ziwomou.site
mobilestoreok.com
codexiveserver.xyz
cloudrail.net
pancakeandwaffle.net
ckbtmg.com
ralphboyer.net
carpenterglobal.solutions
mercoso.com
restoreyourpavers.com
tianyunpd.com
lan-sinoh.xyz
networlink.com
kazisworkshop.com
hempandcan.com
wd255.com
spectedsinues.com
winbigcompetitions.com
careconnectorsfl.com
customia.xyz
aestheticsbychill.com
sydneymortgagebroker.sydney
legallawgroup.com
posafrica.biz
rrstables.net
opexma.com
xxertyg.xyz
centermen.com
2272772.com
badplants.com
scrappyjonez.com
habesha-dream.com
doradoeventos.com
truegifty.website
markoonline.com
rockpresident.com
datasydney2022.com
tubbsbaitco.com
shopavix.com
ol9qz8i2sj3ic2f8.cfd
67161.xyz
tallulah.top
24-7homebiz.info
thesugarbuddy.com
instantcancelorder.xyz
bpost-international.com
infracreation.com
otomakyaj35.xyz
aboutforeverness.com
racheleaton.info
16ty6.com
davideli.com
financertr.xyz
matteogonfiantini.com
loudandclearcaraudio.com
spalp.xyz
apkversion.site
littlehappy.world
georgecuthbert.com
au-easyprofit-way.xyz
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1616-60-0x000000000041D410-mapping.dmp xloader behavioral1/memory/1616-59-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1224-67-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Statement of Acct..exeRegSvcs.exeNETSTAT.EXEdescription pid process target process PID 1112 set thread context of 1616 1112 Statement of Acct..exe RegSvcs.exe PID 1616 set thread context of 1268 1616 RegSvcs.exe Explorer.EXE PID 1224 set thread context of 1268 1224 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1224 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Statement of Acct..exeRegSvcs.exeNETSTAT.EXEpid process 1112 Statement of Acct..exe 1616 RegSvcs.exe 1616 RegSvcs.exe 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE 1224 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exeNETSTAT.EXEpid process 1616 RegSvcs.exe 1616 RegSvcs.exe 1616 RegSvcs.exe 1224 NETSTAT.EXE 1224 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
Statement of Acct..exeRegSvcs.exeNETSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 1112 Statement of Acct..exe Token: SeDebugPrivilege 1616 RegSvcs.exe Token: SeDebugPrivilege 1224 NETSTAT.EXE Token: SeShutdownPrivilege 1268 Explorer.EXE Token: SeShutdownPrivilege 1268 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
Statement of Acct..exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1112 wrote to memory of 1612 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1612 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1612 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1612 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1612 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1612 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1612 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1616 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1616 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1616 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1616 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1616 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1616 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1616 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1616 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1616 1112 Statement of Acct..exe RegSvcs.exe PID 1112 wrote to memory of 1616 1112 Statement of Acct..exe RegSvcs.exe PID 1268 wrote to memory of 1224 1268 Explorer.EXE NETSTAT.EXE PID 1268 wrote to memory of 1224 1268 Explorer.EXE NETSTAT.EXE PID 1268 wrote to memory of 1224 1268 Explorer.EXE NETSTAT.EXE PID 1268 wrote to memory of 1224 1268 Explorer.EXE NETSTAT.EXE PID 1224 wrote to memory of 592 1224 NETSTAT.EXE cmd.exe PID 1224 wrote to memory of 592 1224 NETSTAT.EXE cmd.exe PID 1224 wrote to memory of 592 1224 NETSTAT.EXE cmd.exe PID 1224 wrote to memory of 592 1224 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Statement of Acct..exe"C:\Users\Admin\AppData\Local\Temp\Statement of Acct..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/592-65-0x0000000000000000-mapping.dmp
-
memory/1112-55-0x0000000004E90000-0x0000000004E91000-memory.dmpFilesize
4KB
-
memory/1112-56-0x0000000000530000-0x0000000000537000-memory.dmpFilesize
28KB
-
memory/1112-57-0x0000000005120000-0x0000000005196000-memory.dmpFilesize
472KB
-
memory/1112-58-0x0000000000790000-0x00000000007D6000-memory.dmpFilesize
280KB
-
memory/1112-53-0x0000000001020000-0x0000000001021000-memory.dmpFilesize
4KB
-
memory/1224-66-0x00000000003F0000-0x00000000003F9000-memory.dmpFilesize
36KB
-
memory/1224-64-0x0000000000000000-mapping.dmp
-
memory/1224-67-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/1224-68-0x0000000002020000-0x0000000002323000-memory.dmpFilesize
3.0MB
-
memory/1224-69-0x0000000001ED0000-0x0000000001F60000-memory.dmpFilesize
576KB
-
memory/1224-71-0x0000000075871000-0x0000000075873000-memory.dmpFilesize
8KB
-
memory/1268-63-0x0000000006CC0000-0x0000000006E40000-memory.dmpFilesize
1.5MB
-
memory/1268-70-0x0000000004E00000-0x0000000004ED7000-memory.dmpFilesize
860KB
-
memory/1616-61-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/1616-62-0x00000000002B0000-0x00000000002C1000-memory.dmpFilesize
68KB
-
memory/1616-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1616-60-0x000000000041D410-mapping.dmp