Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
09-12-2021 06:51
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT_PO78893.js
Resource
win7-en-20211208
General
-
Target
PAYMENT_PO78893.js
-
Size
415KB
-
MD5
ed6574999b2277dae2c322d08de349f1
-
SHA1
bf71edb9c1c324c4534acdd46395b5ab67f268d0
-
SHA256
bd7de167ffee33b3abca17c579ca2b38c9c46b02d7e05da4cc3b0362d9331b1a
-
SHA512
65ea4d756d9920a00e707cbeb54f16612a5cab430f79528d0086b9ab19b38f458402afb715dd765332d44bfaf700b1a4d2a90a639ca18661a3dce31b7fdb49d0
Malware Config
Extracted
xloader
2.5
pzi0
http://www.buffstaff.com/pzi0/
laylmodest.com
woruke.club
metaverseslots.net
syscogent.net
aluxxenterprise.com
lm-solar.com
lightempirestore.com
witcheboutique.com
hometech-bosch.xyz
expert-netcad.com
poteconomist.com
mycousinsfriend.biz
shineveranda.com
collegedictionary.cloud
zqlidexx.com
businessesopportunity.com
2utalahs4.com
participatetn.info
dare2ownit.com
varser.com
gxo.digital
networkroftrl.xyz
renturways.com
theprooff.com
ncgf06.xyz
lighterior2.com
one-seo.xyz
benzprod.xyz
k6tkuwrnjake.biz
robinlynnolson.com
ioptest.com
modern-elementz.com
baetsupreme.net
lapetiteagencequimonte.com
xn--bellemre-60a.com
bringthegalaxy.com
shopnobra.com
maroondragon.com
pandemictickets.com
intelligentrereturns.net
quietshop.art
anarkalidress.com
wasserstoff-station.net
filmweltruhr.com
buck100.com
maxicashprommu.xyz
studiosilhouettes.com
lightningridgetradingpost.com
zhuanzhuan9987.top
mlelement.com
krystalsescapetravels.com
simplyabcbooks.com
greenhouse1995systems.com
altogetheradhd.com
servicedogumentary.com
cdcawpx.com
motometics.com
palisadesattahoe.com
paradgmpharma.com
microexpertise.com
venkycouture.online
maculardegenerationtsusanet.com
atlasbrandwear.com
karegcc.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\wealth.exe xloader C:\Users\Admin\AppData\Local\Temp\wealth.exe xloader behavioral2/memory/3808-125-0x0000000000A20000-0x0000000000A49000-memory.dmp xloader -
Blocklisted process makes network request 18 IoCs
Processes:
wscript.exeflow pid process 14 3580 wscript.exe 17 3580 wscript.exe 29 3580 wscript.exe 32 3580 wscript.exe 36 3580 wscript.exe 41 3580 wscript.exe 43 3580 wscript.exe 46 3580 wscript.exe 49 3580 wscript.exe 54 3580 wscript.exe 57 3580 wscript.exe 62 3580 wscript.exe 65 3580 wscript.exe 70 3580 wscript.exe 73 3580 wscript.exe 77 3580 wscript.exe 80 3580 wscript.exe 84 3580 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
wealth.exepid process 1200 wealth.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mCwvamZnOK.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mCwvamZnOK.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\mCwvamZnOK.js\"" wscript.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
wealth.exeexplorer.exedescription pid process target process PID 1200 set thread context of 3004 1200 wealth.exe Explorer.EXE PID 3808 set thread context of 3004 3808 explorer.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
wealth.exeexplorer.exepid process 1200 wealth.exe 1200 wealth.exe 1200 wealth.exe 1200 wealth.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe 3808 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3004 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
wealth.exeexplorer.exepid process 1200 wealth.exe 1200 wealth.exe 1200 wealth.exe 3808 explorer.exe 3808 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wealth.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1200 wealth.exe Token: SeDebugPrivilege 3808 explorer.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
wscript.exeExplorer.EXEexplorer.exedescription pid process target process PID 2736 wrote to memory of 3580 2736 wscript.exe wscript.exe PID 2736 wrote to memory of 3580 2736 wscript.exe wscript.exe PID 2736 wrote to memory of 1200 2736 wscript.exe wealth.exe PID 2736 wrote to memory of 1200 2736 wscript.exe wealth.exe PID 2736 wrote to memory of 1200 2736 wscript.exe wealth.exe PID 3004 wrote to memory of 3808 3004 Explorer.EXE explorer.exe PID 3004 wrote to memory of 3808 3004 Explorer.EXE explorer.exe PID 3004 wrote to memory of 3808 3004 Explorer.EXE explorer.exe PID 3808 wrote to memory of 4064 3808 explorer.exe cmd.exe PID 3808 wrote to memory of 4064 3808 explorer.exe cmd.exe PID 3808 wrote to memory of 4064 3808 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PAYMENT_PO78893.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\mCwvamZnOK.js"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\wealth.exe"C:\Users\Admin\AppData\Local\Temp\wealth.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\wealth.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\wealth.exeMD5
83481bf872730cd133669c5ea5b1be2b
SHA1fbd2369965b20f6bee09063aa454de13a18c71d3
SHA2565d174dd08492f307e4b367e262f3e96b9beefb99f5abb11043ddf7142a18e9e8
SHA5129080dc9bcdfba87ff3ecb3ba04af7a03dea2228f093fbb91149ff8825694601908ba85b2ce27a1de47ce1f6e263b03d96d80d43b7a4033051fbbac64fde7dc51
-
C:\Users\Admin\AppData\Local\Temp\wealth.exeMD5
83481bf872730cd133669c5ea5b1be2b
SHA1fbd2369965b20f6bee09063aa454de13a18c71d3
SHA2565d174dd08492f307e4b367e262f3e96b9beefb99f5abb11043ddf7142a18e9e8
SHA5129080dc9bcdfba87ff3ecb3ba04af7a03dea2228f093fbb91149ff8825694601908ba85b2ce27a1de47ce1f6e263b03d96d80d43b7a4033051fbbac64fde7dc51
-
C:\Users\Admin\AppData\Roaming\mCwvamZnOK.jsMD5
922a967ec05e44eed7e89bce2e858722
SHA10466cb8198ef66d9620da26c2b2d1faa2c61ee7e
SHA2564707b9328e776abe28d01b08df3a7915b5e65fe33208dd7667c5bc8ca0eda7ea
SHA512504b376cb5f1d604e433a429bebabc4a53b64039d1e9d85245af852b910a4342c3407a82fbc25a771190aec21a94f6e80c947ba9d3f6a5f899e0f04dd2e30baa
-
memory/1200-121-0x0000000001980000-0x0000000001991000-memory.dmpFilesize
68KB
-
memory/1200-117-0x0000000000000000-mapping.dmp
-
memory/1200-120-0x0000000001A80000-0x0000000001DA0000-memory.dmpFilesize
3.1MB
-
memory/3004-122-0x0000000006A50000-0x0000000006B79000-memory.dmpFilesize
1.2MB
-
memory/3004-129-0x0000000006E60000-0x0000000006FE8000-memory.dmpFilesize
1.5MB
-
memory/3580-115-0x0000000000000000-mapping.dmp
-
memory/3808-123-0x0000000000000000-mapping.dmp
-
memory/3808-125-0x0000000000A20000-0x0000000000A49000-memory.dmpFilesize
164KB
-
memory/3808-124-0x0000000000D70000-0x00000000011AF000-memory.dmpFilesize
4.2MB
-
memory/3808-127-0x0000000004E60000-0x0000000005180000-memory.dmpFilesize
3.1MB
-
memory/3808-128-0x0000000004C20000-0x0000000004CB0000-memory.dmpFilesize
576KB
-
memory/4064-126-0x0000000000000000-mapping.dmp