Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-12-2021 08:17
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT_018371.js
Resource
win7-en-20211208
General
-
Target
PAYMENT_018371.js
-
Size
354KB
-
MD5
4e5cc8fddecae16e747e6b1a48b31cd5
-
SHA1
9195d4069bc82b38261bb9ec58333921e7164eac
-
SHA256
d2d96154024ca3137cd2e84d367053ea8e0de0459a781356577a3ba775c1fb8e
-
SHA512
fa27ad2184bc22d0d7784e1ecffd049266c43b196635373e73280d71e244061687113143361e8466f29f489259afd0b18e8c50ffb37007cc199fea0e28475ad1
Malware Config
Extracted
xloader
2.5
pzi0
laylmodest.com
woruke.club
metaverseslots.net
syscogent.net
aluxxenterprise.com
lm-solar.com
lightempirestore.com
witcheboutique.com
hometech-bosch.xyz
expert-netcad.com
poteconomist.com
mycousinsfriend.biz
shineveranda.com
collegedictionary.cloud
zqlidexx.com
businessesopportunity.com
2utalahs4.com
participatetn.info
dare2ownit.com
varser.com
gxo.digital
networkroftrl.xyz
renturways.com
theprooff.com
ncgf06.xyz
lighterior2.com
one-seo.xyz
benzprod.xyz
k6tkuwrnjake.biz
robinlynnolson.com
ioptest.com
modern-elementz.com
baetsupreme.net
lapetiteagencequimonte.com
xn--bellemre-60a.com
bringthegalaxy.com
shopnobra.com
maroondragon.com
pandemictickets.com
intelligentrereturns.net
quietshop.art
anarkalidress.com
wasserstoff-station.net
filmweltruhr.com
buck100.com
maxicashprommu.xyz
studiosilhouettes.com
lightningridgetradingpost.com
zhuanzhuan9987.top
mlelement.com
krystalsescapetravels.com
simplyabcbooks.com
greenhouse1995systems.com
altogetheradhd.com
servicedogumentary.com
cdcawpx.com
motometics.com
palisadesattahoe.com
paradgmpharma.com
microexpertise.com
venkycouture.online
maculardegenerationtsusanet.com
atlasbrandwear.com
karegcc.com
buffstaff.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\wealth.exe xloader C:\Users\Admin\AppData\Local\Temp\wealth.exe xloader behavioral1/memory/2012-64-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Blocklisted process makes network request 5 IoCs
Processes:
wscript.exeflow pid process 5 732 wscript.exe 12 732 wscript.exe 22 732 wscript.exe 30 732 wscript.exe 38 732 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
wealth.exepid process 1520 wealth.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CJiKMkZXYA.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CJiKMkZXYA.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\CJiKMkZXYA.js\"" wscript.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
wealth.exenetsh.exedescription pid process target process PID 1520 set thread context of 1200 1520 wealth.exe Explorer.EXE PID 2012 set thread context of 1200 2012 netsh.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
wealth.exenetsh.exepid process 1520 wealth.exe 1520 wealth.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe 2012 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
wealth.exenetsh.exepid process 1520 wealth.exe 1520 wealth.exe 1520 wealth.exe 2012 netsh.exe 2012 netsh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
wealth.exenetsh.exedescription pid process Token: SeDebugPrivilege 1520 wealth.exe Token: SeDebugPrivilege 2012 netsh.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
wscript.exeExplorer.EXEnetsh.exedescription pid process target process PID 740 wrote to memory of 732 740 wscript.exe wscript.exe PID 740 wrote to memory of 732 740 wscript.exe wscript.exe PID 740 wrote to memory of 732 740 wscript.exe wscript.exe PID 740 wrote to memory of 1520 740 wscript.exe wealth.exe PID 740 wrote to memory of 1520 740 wscript.exe wealth.exe PID 740 wrote to memory of 1520 740 wscript.exe wealth.exe PID 740 wrote to memory of 1520 740 wscript.exe wealth.exe PID 1200 wrote to memory of 2012 1200 Explorer.EXE netsh.exe PID 1200 wrote to memory of 2012 1200 Explorer.EXE netsh.exe PID 1200 wrote to memory of 2012 1200 Explorer.EXE netsh.exe PID 1200 wrote to memory of 2012 1200 Explorer.EXE netsh.exe PID 2012 wrote to memory of 1792 2012 netsh.exe cmd.exe PID 2012 wrote to memory of 1792 2012 netsh.exe cmd.exe PID 2012 wrote to memory of 1792 2012 netsh.exe cmd.exe PID 2012 wrote to memory of 1792 2012 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PAYMENT_018371.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\CJiKMkZXYA.js"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\wealth.exe"C:\Users\Admin\AppData\Local\Temp\wealth.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\wealth.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\wealth.exeMD5
83481bf872730cd133669c5ea5b1be2b
SHA1fbd2369965b20f6bee09063aa454de13a18c71d3
SHA2565d174dd08492f307e4b367e262f3e96b9beefb99f5abb11043ddf7142a18e9e8
SHA5129080dc9bcdfba87ff3ecb3ba04af7a03dea2228f093fbb91149ff8825694601908ba85b2ce27a1de47ce1f6e263b03d96d80d43b7a4033051fbbac64fde7dc51
-
C:\Users\Admin\AppData\Local\Temp\wealth.exeMD5
83481bf872730cd133669c5ea5b1be2b
SHA1fbd2369965b20f6bee09063aa454de13a18c71d3
SHA2565d174dd08492f307e4b367e262f3e96b9beefb99f5abb11043ddf7142a18e9e8
SHA5129080dc9bcdfba87ff3ecb3ba04af7a03dea2228f093fbb91149ff8825694601908ba85b2ce27a1de47ce1f6e263b03d96d80d43b7a4033051fbbac64fde7dc51
-
C:\Users\Admin\AppData\Roaming\CJiKMkZXYA.jsMD5
1962a74165904451424267c78882130c
SHA1761254145b67dd9b85a7c689dcd4aa61e2c16420
SHA256b054f1670ebc434d9c756d7ecf2c0a9cafedbacd2b1ca89aef12a49733007095
SHA512d3abf4e9b6279508f326aa979942d183f02c45c95bcf1a3820f67b6b8bc29c73d44fb19dba8438da46f8c778012d027067655620387b4c88cce7917c525760b4
-
memory/732-54-0x0000000000000000-mapping.dmp
-
memory/740-53-0x000007FEFB8C1000-0x000007FEFB8C3000-memory.dmpFilesize
8KB
-
memory/1200-60-0x0000000004C90000-0x0000000004DA7000-memory.dmpFilesize
1.1MB
-
memory/1200-68-0x00000000069F0000-0x0000000006B1E000-memory.dmpFilesize
1.2MB
-
memory/1520-56-0x0000000000000000-mapping.dmp
-
memory/1520-59-0x00000000002B0000-0x00000000002C1000-memory.dmpFilesize
68KB
-
memory/1520-58-0x0000000000790000-0x0000000000A93000-memory.dmpFilesize
3.0MB
-
memory/1792-66-0x0000000000000000-mapping.dmp
-
memory/2012-63-0x0000000000F60000-0x0000000000F7B000-memory.dmpFilesize
108KB
-
memory/2012-64-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/2012-65-0x0000000000B20000-0x0000000000E23000-memory.dmpFilesize
3.0MB
-
memory/2012-67-0x0000000000E30000-0x0000000000EC0000-memory.dmpFilesize
576KB
-
memory/2012-61-0x0000000000000000-mapping.dmp