Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
16-11-2021 19:37
Static task
static1
Behavioral task
behavioral1
Sample
REVISE 50% OCTA INVOICE.exe
Resource
win7-en-20211014
General
-
Target
REVISE 50% OCTA INVOICE.exe
-
Size
257KB
-
MD5
093048c24b9994fef2130cd8457e7a4b
-
SHA1
f3c31eefe661b1febc80c0865af8f4fd1385ac7f
-
SHA256
0e803b7715385244cae58772b5b0da43b7cca6a97c5ffd182081eca8676ff5d7
-
SHA512
e95142b25ae3078c642df183213ed06ccb0b5b65c4b25c3844803258d8b149c3570fdd00a25b539199f44ad10877c37139e430febe304ad6860511c379d4a2ba
Malware Config
Extracted
xloader
2.5
e8ia
http://www.helpfromjames.com/e8ia/
le-hameau-enchanteur.com
quantumsystem-au.club
engravedeeply.com
yesrecompensas.lat
cavallitowerofficials.com
800seaspray.com
skifun-jetski.com
thouartafoot.com
nft2dollar.com
petrestore.online
cjcutthecord2.com
tippimccullough.com
gadget198.xyz
djmiriam.com
bitbasepay.com
cukierniawz.com
mcclureic.xyz
inthekitchenshakinandbakin.com
busy-clicks.com
melaniemorris.online
elysiangp.com
7bkj.com
wakeanddraw.com
ascalar.com
iteraxon.com
henleygirlscricket.com
torresflooringdecorllc.com
helgquieta.quest
xesteem.com
graffity-aws.com
bolerparts.com
andriylysenko.com
bestinvest-4-you.com
frelsicycling.com
airductcleaningindianapolis.net
nlproperties.net
alkoora.xyz
sakiyaman.com
wwwsmyrnaschooldistrict.com
unitedsafetyassociation.com
fiveallianceapparel.com
edgelordkids.com
herhauling.com
intelldat.com
weprepareamerica-planet.com
webartsolution.net
yiquge.com
marraasociados.com
dentalimplantnearyou-ca.space
linemanbible.com
dunamisdispatchservicellc.com
latamoperationalinstitute.com
stpaulsschoolbagidora.com
groupninemed.com
solar-tribe.com
footairdz.com
blttsperma.quest
xfeuio.xyz
sahodyafbdchapter.com
0934800.com
dandftrading.com
gladway.net
mineriasinmercurio.com
inaampm.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1012-57-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1012-58-0x000000000041D4D0-mapping.dmp xloader behavioral1/memory/568-67-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1416 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
REVISE 50% OCTA INVOICE.exepid process 1712 REVISE 50% OCTA INVOICE.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
REVISE 50% OCTA INVOICE.exeREVISE 50% OCTA INVOICE.execmstp.exedescription pid process target process PID 1712 set thread context of 1012 1712 REVISE 50% OCTA INVOICE.exe REVISE 50% OCTA INVOICE.exe PID 1012 set thread context of 1300 1012 REVISE 50% OCTA INVOICE.exe Explorer.EXE PID 568 set thread context of 1300 568 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
REVISE 50% OCTA INVOICE.execmstp.exepid process 1012 REVISE 50% OCTA INVOICE.exe 1012 REVISE 50% OCTA INVOICE.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe 568 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
REVISE 50% OCTA INVOICE.execmstp.exepid process 1012 REVISE 50% OCTA INVOICE.exe 1012 REVISE 50% OCTA INVOICE.exe 1012 REVISE 50% OCTA INVOICE.exe 568 cmstp.exe 568 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
REVISE 50% OCTA INVOICE.execmstp.exedescription pid process Token: SeDebugPrivilege 1012 REVISE 50% OCTA INVOICE.exe Token: SeDebugPrivilege 568 cmstp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1300 Explorer.EXE 1300 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1300 Explorer.EXE 1300 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
REVISE 50% OCTA INVOICE.exeExplorer.EXEcmstp.exedescription pid process target process PID 1712 wrote to memory of 1012 1712 REVISE 50% OCTA INVOICE.exe REVISE 50% OCTA INVOICE.exe PID 1712 wrote to memory of 1012 1712 REVISE 50% OCTA INVOICE.exe REVISE 50% OCTA INVOICE.exe PID 1712 wrote to memory of 1012 1712 REVISE 50% OCTA INVOICE.exe REVISE 50% OCTA INVOICE.exe PID 1712 wrote to memory of 1012 1712 REVISE 50% OCTA INVOICE.exe REVISE 50% OCTA INVOICE.exe PID 1712 wrote to memory of 1012 1712 REVISE 50% OCTA INVOICE.exe REVISE 50% OCTA INVOICE.exe PID 1712 wrote to memory of 1012 1712 REVISE 50% OCTA INVOICE.exe REVISE 50% OCTA INVOICE.exe PID 1712 wrote to memory of 1012 1712 REVISE 50% OCTA INVOICE.exe REVISE 50% OCTA INVOICE.exe PID 1300 wrote to memory of 568 1300 Explorer.EXE cmstp.exe PID 1300 wrote to memory of 568 1300 Explorer.EXE cmstp.exe PID 1300 wrote to memory of 568 1300 Explorer.EXE cmstp.exe PID 1300 wrote to memory of 568 1300 Explorer.EXE cmstp.exe PID 1300 wrote to memory of 568 1300 Explorer.EXE cmstp.exe PID 1300 wrote to memory of 568 1300 Explorer.EXE cmstp.exe PID 1300 wrote to memory of 568 1300 Explorer.EXE cmstp.exe PID 568 wrote to memory of 1416 568 cmstp.exe cmd.exe PID 568 wrote to memory of 1416 568 cmstp.exe cmd.exe PID 568 wrote to memory of 1416 568 cmstp.exe cmd.exe PID 568 wrote to memory of 1416 568 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REVISE 50% OCTA INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\REVISE 50% OCTA INVOICE.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REVISE 50% OCTA INVOICE.exe"C:\Users\Admin\AppData\Local\Temp\REVISE 50% OCTA INVOICE.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REVISE 50% OCTA INVOICE.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsyE551.tmp\pqcs.dllMD5
f2828be237823a888b96c7d265c0ec05
SHA1bf3b7ee29a6ff865fd6c17fd449cca42e4c6bc74
SHA25661591ac877c329a2b715066f957ea19c164bc78c1ffaf59c769462a689f3b139
SHA5122b94e24a27f47cac7494cc9a876e7f27a0f9a53b1a2be5e9f46efa94abd29287edae2de1784e387f28483dad99d7af12ac61e0fe450e1b00a1c5c1cdf32185c5
-
memory/568-63-0x0000000000000000-mapping.dmp
-
memory/568-69-0x0000000001C20000-0x0000000001CB0000-memory.dmpFilesize
576KB
-
memory/568-68-0x0000000001E60000-0x0000000002163000-memory.dmpFilesize
3.0MB
-
memory/568-67-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/568-66-0x0000000000250000-0x0000000000268000-memory.dmpFilesize
96KB
-
memory/1012-58-0x000000000041D4D0-mapping.dmp
-
memory/1012-61-0x00000000003E0000-0x00000000003F1000-memory.dmpFilesize
68KB
-
memory/1012-60-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1012-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1300-62-0x00000000074B0000-0x000000000764A000-memory.dmpFilesize
1.6MB
-
memory/1300-70-0x0000000004AB0000-0x0000000004B47000-memory.dmpFilesize
604KB
-
memory/1416-65-0x0000000000000000-mapping.dmp
-
memory/1712-55-0x00000000758C1000-0x00000000758C3000-memory.dmpFilesize
8KB