Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
26-11-2021 04:05
Static task
static1
Behavioral task
behavioral1
Sample
remittance advice_001001098.exe
Resource
win7-en-20211104
General
-
Target
remittance advice_001001098.exe
-
Size
331KB
-
MD5
7877a7074c688baf439f7ec1ab150682
-
SHA1
6c2539fb927b57388866f1c072cdf681b585fb2a
-
SHA256
08ade6bd3efcd20c80defdde936ef1329713af42d28889ffb69ba26b321a297f
-
SHA512
6e5dff775fe478634fc3553b0bed3e9e9fda7a956cc17743f2b1b27e06256008ba7bc229d55a409cb710f078c97b70bb709c764b9fc144c0700d77dab6f83402
Malware Config
Extracted
xloader
2.5
e8ia
http://www.helpfromjames.com/e8ia/
le-hameau-enchanteur.com
quantumsystem-au.club
engravedeeply.com
yesrecompensas.lat
cavallitowerofficials.com
800seaspray.com
skifun-jetski.com
thouartafoot.com
nft2dollar.com
petrestore.online
cjcutthecord2.com
tippimccullough.com
gadget198.xyz
djmiriam.com
bitbasepay.com
cukierniawz.com
mcclureic.xyz
inthekitchenshakinandbakin.com
busy-clicks.com
melaniemorris.online
elysiangp.com
7bkj.com
wakeanddraw.com
ascalar.com
iteraxon.com
henleygirlscricket.com
torresflooringdecorllc.com
helgquieta.quest
xesteem.com
graffity-aws.com
bolerparts.com
andriylysenko.com
bestinvest-4-you.com
frelsicycling.com
airductcleaningindianapolis.net
nlproperties.net
alkoora.xyz
sakiyaman.com
wwwsmyrnaschooldistrict.com
unitedsafetyassociation.com
fiveallianceapparel.com
edgelordkids.com
herhauling.com
intelldat.com
weprepareamerica-planet.com
webartsolution.net
yiquge.com
marraasociados.com
dentalimplantnearyou-ca.space
linemanbible.com
dunamisdispatchservicellc.com
latamoperationalinstitute.com
stpaulsschoolbagidora.com
groupninemed.com
solar-tribe.com
footairdz.com
blttsperma.quest
xfeuio.xyz
sahodyafbdchapter.com
0934800.com
dandftrading.com
gladway.net
mineriasinmercurio.com
inaampm.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1192-57-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1192-58-0x000000000041D4D0-mapping.dmp xloader behavioral1/memory/1192-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/576-69-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 276 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
remittance advice_001001098.exepid process 1564 remittance advice_001001098.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
remittance advice_001001098.exeremittance advice_001001098.exesvchost.exedescription pid process target process PID 1564 set thread context of 1192 1564 remittance advice_001001098.exe remittance advice_001001098.exe PID 1192 set thread context of 1392 1192 remittance advice_001001098.exe Explorer.EXE PID 1192 set thread context of 1392 1192 remittance advice_001001098.exe Explorer.EXE PID 576 set thread context of 1392 576 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
remittance advice_001001098.exesvchost.exepid process 1192 remittance advice_001001098.exe 1192 remittance advice_001001098.exe 1192 remittance advice_001001098.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe 576 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
remittance advice_001001098.exesvchost.exepid process 1192 remittance advice_001001098.exe 1192 remittance advice_001001098.exe 1192 remittance advice_001001098.exe 1192 remittance advice_001001098.exe 576 svchost.exe 576 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
remittance advice_001001098.exesvchost.exedescription pid process Token: SeDebugPrivilege 1192 remittance advice_001001098.exe Token: SeDebugPrivilege 576 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE 1392 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1392 Explorer.EXE 1392 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
remittance advice_001001098.exeremittance advice_001001098.exesvchost.exedescription pid process target process PID 1564 wrote to memory of 1192 1564 remittance advice_001001098.exe remittance advice_001001098.exe PID 1564 wrote to memory of 1192 1564 remittance advice_001001098.exe remittance advice_001001098.exe PID 1564 wrote to memory of 1192 1564 remittance advice_001001098.exe remittance advice_001001098.exe PID 1564 wrote to memory of 1192 1564 remittance advice_001001098.exe remittance advice_001001098.exe PID 1564 wrote to memory of 1192 1564 remittance advice_001001098.exe remittance advice_001001098.exe PID 1564 wrote to memory of 1192 1564 remittance advice_001001098.exe remittance advice_001001098.exe PID 1564 wrote to memory of 1192 1564 remittance advice_001001098.exe remittance advice_001001098.exe PID 1192 wrote to memory of 576 1192 remittance advice_001001098.exe svchost.exe PID 1192 wrote to memory of 576 1192 remittance advice_001001098.exe svchost.exe PID 1192 wrote to memory of 576 1192 remittance advice_001001098.exe svchost.exe PID 1192 wrote to memory of 576 1192 remittance advice_001001098.exe svchost.exe PID 576 wrote to memory of 276 576 svchost.exe cmd.exe PID 576 wrote to memory of 276 576 svchost.exe cmd.exe PID 576 wrote to memory of 276 576 svchost.exe cmd.exe PID 576 wrote to memory of 276 576 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\remittance advice_001001098.exe"C:\Users\Admin\AppData\Local\Temp\remittance advice_001001098.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\remittance advice_001001098.exe"C:\Users\Admin\AppData\Local\Temp\remittance advice_001001098.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\remittance advice_001001098.exe"5⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsyB923.tmp\tngylslz.dllMD5
5dce4ab196ebed51421a281746048281
SHA1372e20701622727ca50c39feeccb53d5c26102ff
SHA256ccc17ccc0b0f0f45309c8dbff3671f9a1d178e5cf22e47174f8da054f71e1edd
SHA512a03f9bbb52c755ef73fd2ed425454f1d47432d3e59937324761f3817be21d719c7a8b947d315fccbf7e197c081beb9cafe727952606634ba31ee1c07c59ae30e
-
memory/276-67-0x0000000000000000-mapping.dmp
-
memory/576-66-0x0000000000000000-mapping.dmp
-
memory/576-71-0x0000000000350000-0x00000000003E0000-memory.dmpFilesize
576KB
-
memory/576-70-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/576-68-0x0000000000E10000-0x0000000000E18000-memory.dmpFilesize
32KB
-
memory/576-69-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1192-61-0x0000000000350000-0x0000000000361000-memory.dmpFilesize
68KB
-
memory/1192-64-0x00000000003A0000-0x00000000003B1000-memory.dmpFilesize
68KB
-
memory/1192-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1192-60-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/1192-58-0x000000000041D4D0-mapping.dmp
-
memory/1192-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1392-65-0x0000000006980000-0x0000000006A41000-memory.dmpFilesize
772KB
-
memory/1392-62-0x00000000070C0000-0x000000000725F000-memory.dmpFilesize
1.6MB
-
memory/1392-72-0x0000000008DC0000-0x0000000008F08000-memory.dmpFilesize
1.3MB
-
memory/1564-55-0x00000000758F1000-0x00000000758F3000-memory.dmpFilesize
8KB