Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
06-12-2021 13:38
Static task
static1
Behavioral task
behavioral1
Sample
Payment Advice.exe
Resource
win7-en-20211104
General
-
Target
Payment Advice.exe
-
Size
1.3MB
-
MD5
6e976bdd711770b20d6664fd18fe5c7b
-
SHA1
168d5d7bece8d371a379148c1988841e49b21ace
-
SHA256
d2b976a493c6d3b694dba0e139cea1d4943c0176a807109a9ab045a6b23b75c1
-
SHA512
6d6eb05864690352a47dc32670ef968c6c6edd908372e335a8abd44ccd76c6b230177fd29841d0a1672891b7bd1488057358e0d35be80f7c8edea3ef55227648
Malware Config
Extracted
xloader
2.5
ea0r
http://www.asiapubz-hk.com/ea0r/
lionheartcreativestudios.com
konzertmanagement.com
blackpanther.online
broychim-int.com
takut18.com
txstarsolar.com
herdsherpa.com
igorshestakov.com
shinesbox.com
reflectpkljlt.xyz
oiltoolshub.com
viralmoneychallenge.com
changingalphastrategies.com
mecitiris.com
rdadmin.online
miniambiente.com
kominarcine.com
pino-almond.com
heihit.xyz
junqi888.com
metalumber.com
sclvfu.com
macanostore.online
projecturs.com
ahcprp.com
gztyfnrj.com
lospacenos.com
tak-etranger.com
dingermail.com
skiin.club
ystops.com
tnboxes.com
ccafgz.com
info1337.xyz
platinum24.top
hothess.com
novelfinancewhite.xyz
theselectdifference.com
flufca.com
giftcodefreefirevns.com
kgv-lachswehr.com
report-alfarabilabs.com
skeetones.com
4bcinc.com
americamr.com
wewonacademy.com
evrazavto.store
true-fanbox.com
greencofiji.com
threecommaspartners.com
hgtradingcoltd.com
xihe1919.com
241mk.com
helplockedout.com
wefundprojects.com
neosecure.store
purenewsworldwide.com
luckylottovip999.com
lottidobler.com
proyectohaciendohistoria.com
raintm.com
theproducerformula.com
trademarkitforyourself.com
ottaweed.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1160-67-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1160-68-0x000000000041D410-mapping.dmp xloader behavioral1/memory/1160-76-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1684-81-0x00000000000E0000-0x0000000000109000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 860 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Payment Advice.exePayment Advice.exesvchost.exedescription pid process target process PID 1576 set thread context of 1160 1576 Payment Advice.exe Payment Advice.exe PID 1160 set thread context of 1376 1160 Payment Advice.exe Explorer.EXE PID 1160 set thread context of 1376 1160 Payment Advice.exe Explorer.EXE PID 1684 set thread context of 1376 1684 svchost.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
Payment Advice.exePayment Advice.exepowershell.exesvchost.exepid process 1576 Payment Advice.exe 1576 Payment Advice.exe 1160 Payment Advice.exe 1160 Payment Advice.exe 544 powershell.exe 1160 Payment Advice.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe 1684 svchost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Payment Advice.exesvchost.exepid process 1160 Payment Advice.exe 1160 Payment Advice.exe 1160 Payment Advice.exe 1160 Payment Advice.exe 1684 svchost.exe 1684 svchost.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Payment Advice.exePayment Advice.exepowershell.exesvchost.exedescription pid process Token: SeDebugPrivilege 1576 Payment Advice.exe Token: SeDebugPrivilege 1160 Payment Advice.exe Token: SeDebugPrivilege 544 powershell.exe Token: SeDebugPrivilege 1684 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
Payment Advice.exeExplorer.EXEsvchost.exedescription pid process target process PID 1576 wrote to memory of 544 1576 Payment Advice.exe powershell.exe PID 1576 wrote to memory of 544 1576 Payment Advice.exe powershell.exe PID 1576 wrote to memory of 544 1576 Payment Advice.exe powershell.exe PID 1576 wrote to memory of 544 1576 Payment Advice.exe powershell.exe PID 1576 wrote to memory of 924 1576 Payment Advice.exe schtasks.exe PID 1576 wrote to memory of 924 1576 Payment Advice.exe schtasks.exe PID 1576 wrote to memory of 924 1576 Payment Advice.exe schtasks.exe PID 1576 wrote to memory of 924 1576 Payment Advice.exe schtasks.exe PID 1576 wrote to memory of 1160 1576 Payment Advice.exe Payment Advice.exe PID 1576 wrote to memory of 1160 1576 Payment Advice.exe Payment Advice.exe PID 1576 wrote to memory of 1160 1576 Payment Advice.exe Payment Advice.exe PID 1576 wrote to memory of 1160 1576 Payment Advice.exe Payment Advice.exe PID 1576 wrote to memory of 1160 1576 Payment Advice.exe Payment Advice.exe PID 1576 wrote to memory of 1160 1576 Payment Advice.exe Payment Advice.exe PID 1576 wrote to memory of 1160 1576 Payment Advice.exe Payment Advice.exe PID 1376 wrote to memory of 1684 1376 Explorer.EXE svchost.exe PID 1376 wrote to memory of 1684 1376 Explorer.EXE svchost.exe PID 1376 wrote to memory of 1684 1376 Explorer.EXE svchost.exe PID 1376 wrote to memory of 1684 1376 Explorer.EXE svchost.exe PID 1684 wrote to memory of 860 1684 svchost.exe cmd.exe PID 1684 wrote to memory of 860 1684 svchost.exe cmd.exe PID 1684 wrote to memory of 860 1684 svchost.exe cmd.exe PID 1684 wrote to memory of 860 1684 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GUkSklAlcp.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GUkSklAlcp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4B62.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4B62.tmpMD5
c13af8863a9a3cd00bef2fc23c743ba0
SHA167aea05bf3e1069e58260aa628446fcb7ccd895d
SHA2565e4c1c1bbdd7f84a21bbdf8e19e559b837e4deb32dd52e4cfd0e5771918b8cda
SHA51223b849359011d0998604ffe491ffde8b5be11301b53c302c4c0275e88967d7df52822affe82dc4b672989e4c487d9f3bfebfa9f0b217515c6338ec2e1d30d205
-
memory/544-75-0x0000000002480000-0x00000000030CA000-memory.dmpFilesize
12.3MB
-
memory/544-71-0x0000000002480000-0x00000000030CA000-memory.dmpFilesize
12.3MB
-
memory/544-69-0x0000000002480000-0x00000000030CA000-memory.dmpFilesize
12.3MB
-
memory/544-61-0x0000000000000000-mapping.dmp
-
memory/860-82-0x0000000000000000-mapping.dmp
-
memory/924-62-0x0000000000000000-mapping.dmp
-
memory/1160-73-0x0000000000280000-0x0000000000291000-memory.dmpFilesize
68KB
-
memory/1160-76-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1160-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1160-67-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1160-68-0x000000000041D410-mapping.dmp
-
memory/1160-77-0x0000000000360000-0x0000000000371000-memory.dmpFilesize
68KB
-
memory/1160-72-0x0000000000890000-0x0000000000B93000-memory.dmpFilesize
3.0MB
-
memory/1160-65-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1376-78-0x0000000005EF0000-0x0000000005FC7000-memory.dmpFilesize
860KB
-
memory/1376-74-0x00000000044A0000-0x000000000454F000-memory.dmpFilesize
700KB
-
memory/1376-86-0x0000000005FD0000-0x000000000608B000-memory.dmpFilesize
748KB
-
memory/1576-57-0x00000000753E1000-0x00000000753E3000-memory.dmpFilesize
8KB
-
memory/1576-55-0x0000000001390000-0x0000000001391000-memory.dmpFilesize
4KB
-
memory/1576-60-0x00000000054B0000-0x00000000055C6000-memory.dmpFilesize
1.1MB
-
memory/1576-59-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/1576-58-0x0000000000910000-0x0000000000918000-memory.dmpFilesize
32KB
-
memory/1684-79-0x0000000000000000-mapping.dmp
-
memory/1684-80-0x0000000000070000-0x0000000000078000-memory.dmpFilesize
32KB
-
memory/1684-81-0x00000000000E0000-0x0000000000109000-memory.dmpFilesize
164KB
-
memory/1684-83-0x00000000006D0000-0x00000000009D3000-memory.dmpFilesize
3.0MB
-
memory/1684-85-0x00000000005B0000-0x0000000000640000-memory.dmpFilesize
576KB