Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
20-10-2021 19:56
Static task
static1
Behavioral task
behavioral1
Sample
Overdue Statement of Account.exe
Resource
win7-en-20211014
General
-
Target
Overdue Statement of Account.exe
-
Size
418KB
-
MD5
862838f5e798c19a2c222994789b5b73
-
SHA1
7dce91828df96ad8a6dae4fa1415dbf6755cb143
-
SHA256
a2067ce6f40be6dee1fa10c0155582a43e4b4d5b4bfe1fcf7f239332534b7109
-
SHA512
06b9d77e854045c88bc9440f0e3680930687319c4e0ba9cdf1271614d66b6d732dfd354c27ea847374c7cffde2a786810240888a19431e1ebe9707c2cc3671c2
Malware Config
Extracted
xloader
2.5
naec
http://www.logternal.com/naec/
thugcephus.com
yelomasala.com
rowyprima.quest
besasin09.com
globerentalcar.com
super-dev-li.online
legendaparayoutube.com
sharj4030.online
freebiesandgiveaways.com
greenidge.bet
aligned.guide
limowatchshop.com
cqreb.com
justforlulu.xyz
sppn.info
mycaroutlet.store
lcrventures.com
ultimateapparelprints.online
katakorik.com
jfrecycling.com
plundergomrgg.xyz
cuchikymess.quest
supremeantivirus.com
aceidaho.net
xghnsw.com
harmanhvac.com
herseymagazamda.com
woaini.website
atastefromcalifornia.com
macintoshbooks.store
mappix.net
solarisawesome.com
hunterfineart.net
alendmaj.com
sjzdemao.com
griffin-auto-insurance.info
letitgrowtnpasumo3.xyz
williamkafeartistik.com
plastictraceability.com
pozhirateli.com
companyintel.guru
hammehafen.com
51omr.net
int-certgroup.com
takumistyle.net
abundanteyfeliz.com
csliangzhi.com
arrivalofthelightbeings.com
thentn.com
jameshankreprise.com
newspaper.works
foropatrioticoypopular.online
bynei.com
flavactivecomplex.com
algurgtba.net
appliancerepairhollywoodca.com
warmingdrapes.com
50gjm.xyz
bondnow.company
hustlerslouip.xyz
arizaservismerkez.com
scrjessica.com
thehomeinspo.com
electnotaryservice.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/552-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/552-63-0x000000000041D4B0-mapping.dmp xloader behavioral1/memory/1056-71-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1748 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Overdue Statement of Account.exeOverdue Statement of Account.exenetsh.exedescription pid process target process PID 2004 set thread context of 552 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 552 set thread context of 1348 552 Overdue Statement of Account.exe Explorer.EXE PID 1056 set thread context of 1348 1056 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
Overdue Statement of Account.exeOverdue Statement of Account.exenetsh.exepid process 2004 Overdue Statement of Account.exe 2004 Overdue Statement of Account.exe 2004 Overdue Statement of Account.exe 552 Overdue Statement of Account.exe 552 Overdue Statement of Account.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe 1056 netsh.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Overdue Statement of Account.exenetsh.exepid process 552 Overdue Statement of Account.exe 552 Overdue Statement of Account.exe 552 Overdue Statement of Account.exe 1056 netsh.exe 1056 netsh.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Overdue Statement of Account.exeOverdue Statement of Account.exenetsh.exedescription pid process Token: SeDebugPrivilege 2004 Overdue Statement of Account.exe Token: SeDebugPrivilege 552 Overdue Statement of Account.exe Token: SeDebugPrivilege 1056 netsh.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1348 Explorer.EXE 1348 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1348 Explorer.EXE 1348 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Overdue Statement of Account.exeExplorer.EXEnetsh.exedescription pid process target process PID 2004 wrote to memory of 1084 2004 Overdue Statement of Account.exe schtasks.exe PID 2004 wrote to memory of 1084 2004 Overdue Statement of Account.exe schtasks.exe PID 2004 wrote to memory of 1084 2004 Overdue Statement of Account.exe schtasks.exe PID 2004 wrote to memory of 1084 2004 Overdue Statement of Account.exe schtasks.exe PID 2004 wrote to memory of 1396 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 2004 wrote to memory of 1396 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 2004 wrote to memory of 1396 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 2004 wrote to memory of 1396 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 2004 wrote to memory of 552 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 2004 wrote to memory of 552 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 2004 wrote to memory of 552 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 2004 wrote to memory of 552 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 2004 wrote to memory of 552 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 2004 wrote to memory of 552 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 2004 wrote to memory of 552 2004 Overdue Statement of Account.exe Overdue Statement of Account.exe PID 1348 wrote to memory of 1056 1348 Explorer.EXE netsh.exe PID 1348 wrote to memory of 1056 1348 Explorer.EXE netsh.exe PID 1348 wrote to memory of 1056 1348 Explorer.EXE netsh.exe PID 1348 wrote to memory of 1056 1348 Explorer.EXE netsh.exe PID 1056 wrote to memory of 1748 1056 netsh.exe cmd.exe PID 1056 wrote to memory of 1748 1056 netsh.exe cmd.exe PID 1056 wrote to memory of 1748 1056 netsh.exe cmd.exe PID 1056 wrote to memory of 1748 1056 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Overdue Statement of Account.exe"C:\Users\Admin\AppData\Local\Temp\Overdue Statement of Account.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KHQybrjxsFwGTk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9859.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Overdue Statement of Account.exe"C:\Users\Admin\AppData\Local\Temp\Overdue Statement of Account.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Overdue Statement of Account.exe"C:\Users\Admin\AppData\Local\Temp\Overdue Statement of Account.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Overdue Statement of Account.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/552-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/552-65-0x00000000008D0000-0x0000000000BD3000-memory.dmpFilesize
3.0MB
-
memory/552-66-0x0000000000180000-0x0000000000191000-memory.dmpFilesize
68KB
-
memory/552-63-0x000000000041D4B0-mapping.dmp
-
memory/552-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/552-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1056-68-0x0000000000000000-mapping.dmp
-
memory/1056-71-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1056-72-0x0000000000CD0000-0x0000000000FD3000-memory.dmpFilesize
3.0MB
-
memory/1056-70-0x00000000013B0000-0x00000000013CB000-memory.dmpFilesize
108KB
-
memory/1056-73-0x0000000000450000-0x00000000004E0000-memory.dmpFilesize
576KB
-
memory/1084-59-0x0000000000000000-mapping.dmp
-
memory/1348-67-0x00000000069E0000-0x0000000006B72000-memory.dmpFilesize
1.6MB
-
memory/1348-74-0x0000000004510000-0x00000000045EB000-memory.dmpFilesize
876KB
-
memory/1748-69-0x0000000000000000-mapping.dmp
-
memory/2004-58-0x0000000007010000-0x000000000705B000-memory.dmpFilesize
300KB
-
memory/2004-57-0x00000000008C0000-0x00000000008C7000-memory.dmpFilesize
28KB
-
memory/2004-56-0x0000000000A10000-0x0000000000A11000-memory.dmpFilesize
4KB
-
memory/2004-54-0x0000000001350000-0x0000000001351000-memory.dmpFilesize
4KB