Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
29-11-2021 13:46
Static task
static1
Behavioral task
behavioral1
Sample
payment advice_29011021.exe
Resource
win7-en-20211104
General
-
Target
payment advice_29011021.exe
-
Size
292KB
-
MD5
9fd9757825549183fb53a8a7cbd0a11b
-
SHA1
3d24fae431c8c37b50fc0c8f6ca95af1ae19ce9e
-
SHA256
237b6ac1943742314565dfdcc34a5c17f475462ae4399a9a9765bbbd6c679c99
-
SHA512
b0c762e6393b883925368b520087618082e8e8cdb0885b888a5a787ce5525bd89e7b8799486013cceb84460e3bd793d4a4e415288334fdf62a8b52397aef7222
Malware Config
Extracted
xloader
2.5
e8ia
http://www.helpfromjames.com/e8ia/
le-hameau-enchanteur.com
quantumsystem-au.club
engravedeeply.com
yesrecompensas.lat
cavallitowerofficials.com
800seaspray.com
skifun-jetski.com
thouartafoot.com
nft2dollar.com
petrestore.online
cjcutthecord2.com
tippimccullough.com
gadget198.xyz
djmiriam.com
bitbasepay.com
cukierniawz.com
mcclureic.xyz
inthekitchenshakinandbakin.com
busy-clicks.com
melaniemorris.online
elysiangp.com
7bkj.com
wakeanddraw.com
ascalar.com
iteraxon.com
henleygirlscricket.com
torresflooringdecorllc.com
helgquieta.quest
xesteem.com
graffity-aws.com
bolerparts.com
andriylysenko.com
bestinvest-4-you.com
frelsicycling.com
airductcleaningindianapolis.net
nlproperties.net
alkoora.xyz
sakiyaman.com
wwwsmyrnaschooldistrict.com
unitedsafetyassociation.com
fiveallianceapparel.com
edgelordkids.com
herhauling.com
intelldat.com
weprepareamerica-planet.com
webartsolution.net
yiquge.com
marraasociados.com
dentalimplantnearyou-ca.space
linemanbible.com
dunamisdispatchservicellc.com
latamoperationalinstitute.com
stpaulsschoolbagidora.com
groupninemed.com
solar-tribe.com
footairdz.com
blttsperma.quest
xfeuio.xyz
sahodyafbdchapter.com
0934800.com
dandftrading.com
gladway.net
mineriasinmercurio.com
inaampm.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/848-57-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/848-58-0x000000000041D4D0-mapping.dmp xloader behavioral1/memory/1260-66-0x0000000000080000-0x00000000000A9000-memory.dmp xloader behavioral1/memory/456-78-0x000000000041D4D0-mapping.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
wininit.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\JPWDVZIX_JQ = "C:\\Program Files (x86)\\F2d9l_r\\vganz7.exe" wininit.exe -
Executes dropped EXE 2 IoCs
Processes:
vganz7.exevganz7.exepid process 1376 vganz7.exe 456 vganz7.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 364 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
payment advice_29011021.exevganz7.exepid process 1452 payment advice_29011021.exe 1376 vganz7.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
payment advice_29011021.exepayment advice_29011021.exewininit.exevganz7.exedescription pid process target process PID 1452 set thread context of 848 1452 payment advice_29011021.exe payment advice_29011021.exe PID 848 set thread context of 1412 848 payment advice_29011021.exe Explorer.EXE PID 1260 set thread context of 1412 1260 wininit.exe Explorer.EXE PID 1376 set thread context of 456 1376 vganz7.exe vganz7.exe -
Drops file in Program Files directory 2 IoCs
Processes:
wininit.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\F2d9l_r\vganz7.exe wininit.exe File created C:\Program Files (x86)\F2d9l_r\vganz7.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
Processes:
resource yara_rule C:\Program Files (x86)\F2d9l_r\vganz7.exe nsis_installer_1 C:\Program Files (x86)\F2d9l_r\vganz7.exe nsis_installer_2 C:\Program Files (x86)\F2d9l_r\vganz7.exe nsis_installer_1 C:\Program Files (x86)\F2d9l_r\vganz7.exe nsis_installer_2 C:\Program Files (x86)\F2d9l_r\vganz7.exe nsis_installer_1 C:\Program Files (x86)\F2d9l_r\vganz7.exe nsis_installer_2 -
Processes:
wininit.exedescription ioc process Key created \Registry\User\S-1-5-21-103686315-404690609-2047157615-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 wininit.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
payment advice_29011021.exewininit.exevganz7.exepid process 848 payment advice_29011021.exe 848 payment advice_29011021.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 456 vganz7.exe 1260 wininit.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
payment advice_29011021.exewininit.exepid process 848 payment advice_29011021.exe 848 payment advice_29011021.exe 848 payment advice_29011021.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe 1260 wininit.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
payment advice_29011021.exewininit.exevganz7.exedescription pid process Token: SeDebugPrivilege 848 payment advice_29011021.exe Token: SeDebugPrivilege 1260 wininit.exe Token: SeDebugPrivilege 456 vganz7.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
payment advice_29011021.exeExplorer.EXEwininit.exevganz7.exedescription pid process target process PID 1452 wrote to memory of 848 1452 payment advice_29011021.exe payment advice_29011021.exe PID 1452 wrote to memory of 848 1452 payment advice_29011021.exe payment advice_29011021.exe PID 1452 wrote to memory of 848 1452 payment advice_29011021.exe payment advice_29011021.exe PID 1452 wrote to memory of 848 1452 payment advice_29011021.exe payment advice_29011021.exe PID 1452 wrote to memory of 848 1452 payment advice_29011021.exe payment advice_29011021.exe PID 1452 wrote to memory of 848 1452 payment advice_29011021.exe payment advice_29011021.exe PID 1452 wrote to memory of 848 1452 payment advice_29011021.exe payment advice_29011021.exe PID 1412 wrote to memory of 1260 1412 Explorer.EXE wininit.exe PID 1412 wrote to memory of 1260 1412 Explorer.EXE wininit.exe PID 1412 wrote to memory of 1260 1412 Explorer.EXE wininit.exe PID 1412 wrote to memory of 1260 1412 Explorer.EXE wininit.exe PID 1260 wrote to memory of 364 1260 wininit.exe cmd.exe PID 1260 wrote to memory of 364 1260 wininit.exe cmd.exe PID 1260 wrote to memory of 364 1260 wininit.exe cmd.exe PID 1260 wrote to memory of 364 1260 wininit.exe cmd.exe PID 1260 wrote to memory of 1752 1260 wininit.exe Firefox.exe PID 1260 wrote to memory of 1752 1260 wininit.exe Firefox.exe PID 1260 wrote to memory of 1752 1260 wininit.exe Firefox.exe PID 1260 wrote to memory of 1752 1260 wininit.exe Firefox.exe PID 1412 wrote to memory of 1376 1412 Explorer.EXE vganz7.exe PID 1412 wrote to memory of 1376 1412 Explorer.EXE vganz7.exe PID 1412 wrote to memory of 1376 1412 Explorer.EXE vganz7.exe PID 1412 wrote to memory of 1376 1412 Explorer.EXE vganz7.exe PID 1376 wrote to memory of 456 1376 vganz7.exe vganz7.exe PID 1376 wrote to memory of 456 1376 vganz7.exe vganz7.exe PID 1376 wrote to memory of 456 1376 vganz7.exe vganz7.exe PID 1376 wrote to memory of 456 1376 vganz7.exe vganz7.exe PID 1376 wrote to memory of 456 1376 vganz7.exe vganz7.exe PID 1376 wrote to memory of 456 1376 vganz7.exe vganz7.exe PID 1376 wrote to memory of 456 1376 vganz7.exe vganz7.exe PID 1260 wrote to memory of 1752 1260 wininit.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment advice_29011021.exe"C:\Users\Admin\AppData\Local\Temp\payment advice_29011021.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment advice_29011021.exe"C:\Users\Admin\AppData\Local\Temp\payment advice_29011021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\payment advice_29011021.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\F2d9l_r\vganz7.exe"C:\Program Files (x86)\F2d9l_r\vganz7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\F2d9l_r\vganz7.exe"C:\Program Files (x86)\F2d9l_r\vganz7.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\F2d9l_r\vganz7.exeMD5
9fd9757825549183fb53a8a7cbd0a11b
SHA13d24fae431c8c37b50fc0c8f6ca95af1ae19ce9e
SHA256237b6ac1943742314565dfdcc34a5c17f475462ae4399a9a9765bbbd6c679c99
SHA512b0c762e6393b883925368b520087618082e8e8cdb0885b888a5a787ce5525bd89e7b8799486013cceb84460e3bd793d4a4e415288334fdf62a8b52397aef7222
-
C:\Program Files (x86)\F2d9l_r\vganz7.exeMD5
9fd9757825549183fb53a8a7cbd0a11b
SHA13d24fae431c8c37b50fc0c8f6ca95af1ae19ce9e
SHA256237b6ac1943742314565dfdcc34a5c17f475462ae4399a9a9765bbbd6c679c99
SHA512b0c762e6393b883925368b520087618082e8e8cdb0885b888a5a787ce5525bd89e7b8799486013cceb84460e3bd793d4a4e415288334fdf62a8b52397aef7222
-
C:\Program Files (x86)\F2d9l_r\vganz7.exeMD5
9fd9757825549183fb53a8a7cbd0a11b
SHA13d24fae431c8c37b50fc0c8f6ca95af1ae19ce9e
SHA256237b6ac1943742314565dfdcc34a5c17f475462ae4399a9a9765bbbd6c679c99
SHA512b0c762e6393b883925368b520087618082e8e8cdb0885b888a5a787ce5525bd89e7b8799486013cceb84460e3bd793d4a4e415288334fdf62a8b52397aef7222
-
C:\Users\Admin\AppData\Local\Temp\6ajiy25t92q9h4nej1xMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\nseBB5.tmp\fsagsi.dllMD5
c423a14876868b5c0def8b781bc66a62
SHA1f848e7bf0801a32f66c9c3ede645498812ebff06
SHA256dee6a5e04eac8488f9d00d5e6684c9a8368eb6a765180a3f2c89a07499f951f7
SHA512e2ba84a73f84b32cf42999d4f9b241ca22ae8653f7716676b718167b1a980943121ae2ccec5551a720cc7974175aca592a72301583b2accc865dbca89ff41a7e
-
\Users\Admin\AppData\Local\Temp\nsyDAA7.tmp\fsagsi.dllMD5
c423a14876868b5c0def8b781bc66a62
SHA1f848e7bf0801a32f66c9c3ede645498812ebff06
SHA256dee6a5e04eac8488f9d00d5e6684c9a8368eb6a765180a3f2c89a07499f951f7
SHA512e2ba84a73f84b32cf42999d4f9b241ca22ae8653f7716676b718167b1a980943121ae2ccec5551a720cc7974175aca592a72301583b2accc865dbca89ff41a7e
-
memory/364-64-0x0000000000000000-mapping.dmp
-
memory/456-80-0x0000000000970000-0x0000000000C73000-memory.dmpFilesize
3MB
-
memory/456-78-0x000000000041D4D0-mapping.dmp
-
memory/848-61-0x00000000003D0000-0x00000000003E1000-memory.dmpFilesize
68KB
-
memory/848-60-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3MB
-
memory/848-58-0x000000000041D4D0-mapping.dmp
-
memory/848-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1260-66-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1260-67-0x0000000002280000-0x0000000002583000-memory.dmpFilesize
3MB
-
memory/1260-68-0x00000000004E0000-0x0000000000570000-memory.dmpFilesize
576KB
-
memory/1260-65-0x0000000000E60000-0x0000000000E7A000-memory.dmpFilesize
104KB
-
memory/1260-63-0x0000000000000000-mapping.dmp
-
memory/1376-71-0x0000000000000000-mapping.dmp
-
memory/1412-69-0x0000000009070000-0x00000000091D2000-memory.dmpFilesize
1MB
-
memory/1412-62-0x00000000073B0000-0x0000000007509000-memory.dmpFilesize
1MB
-
memory/1452-55-0x0000000076241000-0x0000000076243000-memory.dmpFilesize
8KB