Analysis
-
max time kernel
600s -
max time network
600s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-09-2021 04:14
Static task
static1
Behavioral task
behavioral1
Sample
Statement of Acct..exe
Resource
win7-en-20210920
General
-
Target
Statement of Acct..exe
-
Size
521KB
-
MD5
850ef5cb4d3e3023ab26072a4cc6a25f
-
SHA1
0947a5b62ad244324971c7863977befaae3d71fd
-
SHA256
bb7d986712c63235f866f11ebc85ac60c360676e0576a075f16c16f679c31c7b
-
SHA512
58e8d6ecc2fbae3d85ff390c30bb5e7cff7f392ea2eae7bec8844e25b14b310e6af1a40da3e1d85516b881d1dcad2081a4d65e4da07ac6bbe45fa6a6d4e804a7
Malware Config
Extracted
xloader
2.4
tgnd
http://www.fhuosa.com/tgnd/
forever1887.com
zkz889.icu
futuresmanagers.com
salondebelle.biz
ziwomou.site
mobilestoreok.com
codexiveserver.xyz
cloudrail.net
pancakeandwaffle.net
ckbtmg.com
ralphboyer.net
carpenterglobal.solutions
mercoso.com
restoreyourpavers.com
tianyunpd.com
lan-sinoh.xyz
networlink.com
kazisworkshop.com
hempandcan.com
wd255.com
spectedsinues.com
winbigcompetitions.com
careconnectorsfl.com
customia.xyz
aestheticsbychill.com
sydneymortgagebroker.sydney
legallawgroup.com
posafrica.biz
rrstables.net
opexma.com
xxertyg.xyz
centermen.com
2272772.com
badplants.com
scrappyjonez.com
habesha-dream.com
doradoeventos.com
truegifty.website
markoonline.com
rockpresident.com
datasydney2022.com
tubbsbaitco.com
shopavix.com
ol9qz8i2sj3ic2f8.cfd
67161.xyz
tallulah.top
24-7homebiz.info
thesugarbuddy.com
instantcancelorder.xyz
bpost-international.com
infracreation.com
otomakyaj35.xyz
aboutforeverness.com
racheleaton.info
16ty6.com
davideli.com
financertr.xyz
matteogonfiantini.com
loudandclearcaraudio.com
spalp.xyz
apkversion.site
littlehappy.world
georgecuthbert.com
au-easyprofit-way.xyz
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/836-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/836-125-0x000000000041D410-mapping.dmp xloader behavioral2/memory/1132-131-0x0000000002AA0000-0x0000000002AC9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Statement of Acct..exeRegSvcs.exehelp.exedescription pid process target process PID 4060 set thread context of 836 4060 Statement of Acct..exe RegSvcs.exe PID 836 set thread context of 3016 836 RegSvcs.exe Explorer.EXE PID 1132 set thread context of 3016 1132 help.exe Explorer.EXE -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Statement of Acct..exeRegSvcs.exehelp.exepid process 4060 Statement of Acct..exe 4060 Statement of Acct..exe 836 RegSvcs.exe 836 RegSvcs.exe 836 RegSvcs.exe 836 RegSvcs.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe 1132 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3016 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RegSvcs.exehelp.exepid process 836 RegSvcs.exe 836 RegSvcs.exe 836 RegSvcs.exe 1132 help.exe 1132 help.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
Statement of Acct..exeRegSvcs.exeExplorer.EXEhelp.exedescription pid process Token: SeDebugPrivilege 4060 Statement of Acct..exe Token: SeDebugPrivilege 836 RegSvcs.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeDebugPrivilege 1132 help.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE -
Suspicious use of FindShellTrayWindow 10 IoCs
Processes:
Explorer.EXEpid process 3016 Explorer.EXE 3016 Explorer.EXE 3016 Explorer.EXE 3016 Explorer.EXE 3016 Explorer.EXE 3016 Explorer.EXE 3016 Explorer.EXE 3016 Explorer.EXE 3016 Explorer.EXE 3016 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 3016 Explorer.EXE 3016 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3016 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Statement of Acct..exeExplorer.EXEhelp.exedescription pid process target process PID 4060 wrote to memory of 492 4060 Statement of Acct..exe RegSvcs.exe PID 4060 wrote to memory of 492 4060 Statement of Acct..exe RegSvcs.exe PID 4060 wrote to memory of 492 4060 Statement of Acct..exe RegSvcs.exe PID 4060 wrote to memory of 836 4060 Statement of Acct..exe RegSvcs.exe PID 4060 wrote to memory of 836 4060 Statement of Acct..exe RegSvcs.exe PID 4060 wrote to memory of 836 4060 Statement of Acct..exe RegSvcs.exe PID 4060 wrote to memory of 836 4060 Statement of Acct..exe RegSvcs.exe PID 4060 wrote to memory of 836 4060 Statement of Acct..exe RegSvcs.exe PID 4060 wrote to memory of 836 4060 Statement of Acct..exe RegSvcs.exe PID 3016 wrote to memory of 1132 3016 Explorer.EXE help.exe PID 3016 wrote to memory of 1132 3016 Explorer.EXE help.exe PID 3016 wrote to memory of 1132 3016 Explorer.EXE help.exe PID 1132 wrote to memory of 2640 1132 help.exe cmd.exe PID 1132 wrote to memory of 2640 1132 help.exe cmd.exe PID 1132 wrote to memory of 2640 1132 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Statement of Acct..exe"C:\Users\Admin\AppData\Local\Temp\Statement of Acct..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/836-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/836-126-0x0000000001940000-0x0000000001C60000-memory.dmpFilesize
3.1MB
-
memory/836-127-0x0000000001920000-0x0000000001931000-memory.dmpFilesize
68KB
-
memory/836-125-0x000000000041D410-mapping.dmp
-
memory/1132-131-0x0000000002AA0000-0x0000000002AC9000-memory.dmpFilesize
164KB
-
memory/1132-129-0x0000000000000000-mapping.dmp
-
memory/1132-134-0x0000000002C60000-0x0000000002CF0000-memory.dmpFilesize
576KB
-
memory/1132-132-0x0000000002CF0000-0x0000000003010000-memory.dmpFilesize
3.1MB
-
memory/1132-130-0x0000000000110000-0x0000000000117000-memory.dmpFilesize
28KB
-
memory/2640-133-0x0000000000000000-mapping.dmp
-
memory/3016-135-0x0000000005840000-0x0000000005986000-memory.dmpFilesize
1.3MB
-
memory/3016-128-0x0000000006AA0000-0x0000000006C25000-memory.dmpFilesize
1.5MB
-
memory/4060-119-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/4060-116-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/4060-117-0x0000000004B40000-0x0000000004B41000-memory.dmpFilesize
4KB
-
memory/4060-114-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/4060-118-0x0000000004C20000-0x000000000511E000-memory.dmpFilesize
5.0MB
-
memory/4060-120-0x0000000005080000-0x0000000005087000-memory.dmpFilesize
28KB
-
memory/4060-123-0x000000000AD60000-0x000000000ADA6000-memory.dmpFilesize
280KB
-
memory/4060-122-0x00000000085A0000-0x0000000008616000-memory.dmpFilesize
472KB
-
memory/4060-121-0x0000000008090000-0x0000000008091000-memory.dmpFilesize
4KB