remittance advice_001001098.exe
remittance advice_001001098.exe
331KB
26-11-2021 12:32
7877a7074c688baf439f7ec1ab150682
6c2539fb927b57388866f1c072cdf681b585fb2a
08ade6bd3efcd20c80defdde936ef1329713af42d28889ffb69ba26b321a297f
Extracted
| Family | xloader |
| Version | 2.5 |
| Campaign | e8ia |
| C2 |
http://www.helpfromjames.com/e8ia/ |
| Decoy |
le-hameau-enchanteur.com quantumsystem-au.club engravedeeply.com yesrecompensas.lat cavallitowerofficials.com 800seaspray.com skifun-jetski.com thouartafoot.com nft2dollar.com petrestore.online cjcutthecord2.com tippimccullough.com gadget198.xyz djmiriam.com bitbasepay.com cukierniawz.com mcclureic.xyz inthekitchenshakinandbakin.com busy-clicks.com melaniemorris.online elysiangp.com 7bkj.com wakeanddraw.com ascalar.com iteraxon.com henleygirlscricket.com torresflooringdecorllc.com helgquieta.quest xesteem.com graffity-aws.com bolerparts.com andriylysenko.com bestinvest-4-you.com frelsicycling.com airductcleaningindianapolis.net nlproperties.net alkoora.xyz sakiyaman.com wwwsmyrnaschooldistrict.com unitedsafetyassociation.com fiveallianceapparel.com edgelordkids.com herhauling.com intelldat.com weprepareamerica-planet.com webartsolution.net yiquge.com marraasociados.com dentalimplantnearyou-ca.space linemanbible.com |
Filter: none
-
Xloader
Description
Xloader is a rebranded version of Formbook malware.
Tags
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
Description
suricata: ET MALWARE FormBook CnC Checkin (GET)
Tags
-
Xloader Payload
Tags
Reported IOCs
resource yara_rule behavioral1/memory/568-57-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/568-58-0x000000000041D4D0-mapping.dmp xloader behavioral1/memory/552-65-0x0000000000070000-0x0000000000099000-memory.dmp xloader -
Blocklisted process makes network requestwscript.exe
Reported IOCs
flow pid process 33 552 wscript.exe -
Deletes itselfcmd.exe
Reported IOCs
pid process 700 cmd.exe -
Loads dropped DLLremittance advice_001001098.exe
Reported IOCs
pid process 592 remittance advice_001001098.exe -
Suspicious use of SetThreadContextremittance advice_001001098.exeremittance advice_001001098.exewscript.exe
Reported IOCs
description pid process target process PID 592 set thread context of 568 592 remittance advice_001001098.exe remittance advice_001001098.exe PID 568 set thread context of 1380 568 remittance advice_001001098.exe Explorer.EXE PID 552 set thread context of 1380 552 wscript.exe Explorer.EXE -
Enumerates physical storage devices
Description
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
TTPs
-
Suspicious behavior: EnumeratesProcessesremittance advice_001001098.exewscript.exe
Reported IOCs
pid process 568 remittance advice_001001098.exe 568 remittance advice_001001098.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe 552 wscript.exe -
Suspicious behavior: GetForegroundWindowSpamExplorer.EXE
Reported IOCs
pid process 1380 Explorer.EXE -
Suspicious behavior: MapViewOfSectionremittance advice_001001098.exewscript.exe
Reported IOCs
pid process 568 remittance advice_001001098.exe 568 remittance advice_001001098.exe 568 remittance advice_001001098.exe 552 wscript.exe 552 wscript.exe -
Suspicious use of AdjustPrivilegeTokenremittance advice_001001098.exewscript.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 568 remittance advice_001001098.exe Token: SeDebugPrivilege 552 wscript.exe -
Suspicious use of FindShellTrayWindowExplorer.EXE
Reported IOCs
pid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessageExplorer.EXE
Reported IOCs
pid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemoryremittance advice_001001098.exeExplorer.EXEwscript.exe
Reported IOCs
description pid process target process PID 592 wrote to memory of 568 592 remittance advice_001001098.exe remittance advice_001001098.exe PID 592 wrote to memory of 568 592 remittance advice_001001098.exe remittance advice_001001098.exe PID 592 wrote to memory of 568 592 remittance advice_001001098.exe remittance advice_001001098.exe PID 592 wrote to memory of 568 592 remittance advice_001001098.exe remittance advice_001001098.exe PID 592 wrote to memory of 568 592 remittance advice_001001098.exe remittance advice_001001098.exe PID 592 wrote to memory of 568 592 remittance advice_001001098.exe remittance advice_001001098.exe PID 592 wrote to memory of 568 592 remittance advice_001001098.exe remittance advice_001001098.exe PID 1380 wrote to memory of 552 1380 Explorer.EXE wscript.exe PID 1380 wrote to memory of 552 1380 Explorer.EXE wscript.exe PID 1380 wrote to memory of 552 1380 Explorer.EXE wscript.exe PID 1380 wrote to memory of 552 1380 Explorer.EXE wscript.exe PID 552 wrote to memory of 700 552 wscript.exe cmd.exe PID 552 wrote to memory of 700 552 wscript.exe cmd.exe PID 552 wrote to memory of 700 552 wscript.exe cmd.exe PID 552 wrote to memory of 700 552 wscript.exe cmd.exe
-
C:\Windows\Explorer.EXEPID:1380C:\Windows\Explorer.EXESuspicious behavior: GetForegroundWindowSpamSuspicious use of FindShellTrayWindowSuspicious use of SendNotifyMessageSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\remittance advice_001001098.exePID:592"C:\Users\Admin\AppData\Local\Temp\remittance advice_001001098.exe"Loads dropped DLLSuspicious use of SetThreadContextSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\remittance advice_001001098.exePID:568"C:\Users\Admin\AppData\Local\Temp\remittance advice_001001098.exe"Suspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wscript.exePID:552"C:\Windows\SysWOW64\wscript.exe"Blocklisted process makes network requestSuspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exePID:700/c del "C:\Users\Admin\AppData\Local\Temp\remittance advice_001001098.exe"Deletes itself
-
\Users\Admin\AppData\Local\Temp\nsnAA92.tmp\tngylslz.dll
MD55dce4ab196ebed51421a281746048281
SHA1372e20701622727ca50c39feeccb53d5c26102ff
SHA256ccc17ccc0b0f0f45309c8dbff3671f9a1d178e5cf22e47174f8da054f71e1edd
SHA512a03f9bbb52c755ef73fd2ed425454f1d47432d3e59937324761f3817be21d719c7a8b947d315fccbf7e197c081beb9cafe727952606634ba31ee1c07c59ae30e
-
memory/552-67-0x0000000002170000-0x0000000002473000-memory.dmp
-
memory/552-64-0x0000000000890000-0x00000000008B6000-memory.dmp
-
memory/552-65-0x0000000000070000-0x0000000000099000-memory.dmp
-
memory/552-68-0x00000000004D0000-0x0000000000560000-memory.dmp
-
memory/552-63-0x0000000000000000-mapping.dmp
-
memory/568-59-0x0000000000930000-0x0000000000C33000-memory.dmp
-
memory/568-61-0x00000000002D0000-0x00000000002E1000-memory.dmp
-
memory/568-57-0x0000000000400000-0x0000000000429000-memory.dmp
-
memory/568-58-0x000000000041D4D0-mapping.dmp
-
memory/592-55-0x0000000075981000-0x0000000075983000-memory.dmp
-
memory/700-66-0x0000000000000000-mapping.dmp
-
memory/1380-62-0x0000000007010000-0x00000000071B5000-memory.dmp
-
memory/1380-69-0x0000000006E20000-0x0000000006F62000-memory.dmp