Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-12-2021 08:17
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT_018371.js
Resource
win7-en-20211208
General
-
Target
PAYMENT_018371.js
-
Size
354KB
-
MD5
4e5cc8fddecae16e747e6b1a48b31cd5
-
SHA1
9195d4069bc82b38261bb9ec58333921e7164eac
-
SHA256
d2d96154024ca3137cd2e84d367053ea8e0de0459a781356577a3ba775c1fb8e
-
SHA512
fa27ad2184bc22d0d7784e1ecffd049266c43b196635373e73280d71e244061687113143361e8466f29f489259afd0b18e8c50ffb37007cc199fea0e28475ad1
Malware Config
Extracted
xloader
2.5
pzi0
laylmodest.com
woruke.club
metaverseslots.net
syscogent.net
aluxxenterprise.com
lm-solar.com
lightempirestore.com
witcheboutique.com
hometech-bosch.xyz
expert-netcad.com
poteconomist.com
mycousinsfriend.biz
shineveranda.com
collegedictionary.cloud
zqlidexx.com
businessesopportunity.com
2utalahs4.com
participatetn.info
dare2ownit.com
varser.com
gxo.digital
networkroftrl.xyz
renturways.com
theprooff.com
ncgf06.xyz
lighterior2.com
one-seo.xyz
benzprod.xyz
k6tkuwrnjake.biz
robinlynnolson.com
ioptest.com
modern-elementz.com
baetsupreme.net
lapetiteagencequimonte.com
xn--bellemre-60a.com
bringthegalaxy.com
shopnobra.com
maroondragon.com
pandemictickets.com
intelligentrereturns.net
quietshop.art
anarkalidress.com
wasserstoff-station.net
filmweltruhr.com
buck100.com
maxicashprommu.xyz
studiosilhouettes.com
lightningridgetradingpost.com
zhuanzhuan9987.top
mlelement.com
krystalsescapetravels.com
simplyabcbooks.com
greenhouse1995systems.com
altogetheradhd.com
servicedogumentary.com
cdcawpx.com
motometics.com
palisadesattahoe.com
paradgmpharma.com
microexpertise.com
venkycouture.online
maculardegenerationtsusanet.com
atlasbrandwear.com
karegcc.com
buffstaff.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\wealth.exe xloader C:\Users\Admin\AppData\Local\Temp\wealth.exe xloader behavioral2/memory/892-128-0x0000000000110000-0x0000000000139000-memory.dmp xloader -
Blocklisted process makes network request 6 IoCs
Processes:
wscript.exeflow pid process 9 548 wscript.exe 23 548 wscript.exe 43 548 wscript.exe 54 548 wscript.exe 63 548 wscript.exe 72 548 wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
wealth.exepid process 804 wealth.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CJiKMkZXYA.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CJiKMkZXYA.js wscript.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\SEJOKAOI5S = "\"C:\\Users\\Admin\\AppData\\Roaming\\CJiKMkZXYA.js\"" wscript.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
wealth.execmmon32.exedescription pid process target process PID 804 set thread context of 3068 804 wealth.exe Explorer.EXE PID 804 set thread context of 3068 804 wealth.exe Explorer.EXE PID 892 set thread context of 3068 892 cmmon32.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
wealth.execmmon32.exepid process 804 wealth.exe 804 wealth.exe 804 wealth.exe 804 wealth.exe 804 wealth.exe 804 wealth.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe 892 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3068 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
wealth.execmmon32.exepid process 804 wealth.exe 804 wealth.exe 804 wealth.exe 804 wealth.exe 892 cmmon32.exe 892 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
wealth.execmmon32.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 804 wealth.exe Token: SeDebugPrivilege 892 cmmon32.exe Token: SeShutdownPrivilege 3068 Explorer.EXE Token: SeCreatePagefilePrivilege 3068 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
wscript.exeExplorer.EXEcmmon32.exedescription pid process target process PID 684 wrote to memory of 548 684 wscript.exe wscript.exe PID 684 wrote to memory of 548 684 wscript.exe wscript.exe PID 684 wrote to memory of 804 684 wscript.exe wealth.exe PID 684 wrote to memory of 804 684 wscript.exe wealth.exe PID 684 wrote to memory of 804 684 wscript.exe wealth.exe PID 3068 wrote to memory of 892 3068 Explorer.EXE cmmon32.exe PID 3068 wrote to memory of 892 3068 Explorer.EXE cmmon32.exe PID 3068 wrote to memory of 892 3068 Explorer.EXE cmmon32.exe PID 892 wrote to memory of 1992 892 cmmon32.exe cmd.exe PID 892 wrote to memory of 1992 892 cmmon32.exe cmd.exe PID 892 wrote to memory of 1992 892 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\PAYMENT_018371.js2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\CJiKMkZXYA.js"3⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\wealth.exe"C:\Users\Admin\AppData\Local\Temp\wealth.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\wealth.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\wealth.exeMD5
83481bf872730cd133669c5ea5b1be2b
SHA1fbd2369965b20f6bee09063aa454de13a18c71d3
SHA2565d174dd08492f307e4b367e262f3e96b9beefb99f5abb11043ddf7142a18e9e8
SHA5129080dc9bcdfba87ff3ecb3ba04af7a03dea2228f093fbb91149ff8825694601908ba85b2ce27a1de47ce1f6e263b03d96d80d43b7a4033051fbbac64fde7dc51
-
C:\Users\Admin\AppData\Local\Temp\wealth.exeMD5
83481bf872730cd133669c5ea5b1be2b
SHA1fbd2369965b20f6bee09063aa454de13a18c71d3
SHA2565d174dd08492f307e4b367e262f3e96b9beefb99f5abb11043ddf7142a18e9e8
SHA5129080dc9bcdfba87ff3ecb3ba04af7a03dea2228f093fbb91149ff8825694601908ba85b2ce27a1de47ce1f6e263b03d96d80d43b7a4033051fbbac64fde7dc51
-
C:\Users\Admin\AppData\Roaming\CJiKMkZXYA.jsMD5
1962a74165904451424267c78882130c
SHA1761254145b67dd9b85a7c689dcd4aa61e2c16420
SHA256b054f1670ebc434d9c756d7ecf2c0a9cafedbacd2b1ca89aef12a49733007095
SHA512d3abf4e9b6279508f326aa979942d183f02c45c95bcf1a3820f67b6b8bc29c73d44fb19dba8438da46f8c778012d027067655620387b4c88cce7917c525760b4
-
memory/548-115-0x0000000000000000-mapping.dmp
-
memory/804-123-0x00000000028B0000-0x00000000028C1000-memory.dmpFilesize
68KB
-
memory/804-117-0x0000000000000000-mapping.dmp
-
memory/804-120-0x0000000000C00000-0x0000000000CAE000-memory.dmpFilesize
696KB
-
memory/804-121-0x0000000001230000-0x0000000001241000-memory.dmpFilesize
68KB
-
memory/892-128-0x0000000000110000-0x0000000000139000-memory.dmpFilesize
164KB
-
memory/892-125-0x0000000000000000-mapping.dmp
-
memory/892-127-0x0000000000290000-0x000000000029C000-memory.dmpFilesize
48KB
-
memory/892-129-0x0000000004200000-0x0000000004520000-memory.dmpFilesize
3.1MB
-
memory/892-130-0x0000000004050000-0x00000000040E0000-memory.dmpFilesize
576KB
-
memory/1992-126-0x0000000000000000-mapping.dmp
-
memory/3068-124-0x0000000002E20000-0x0000000002F17000-memory.dmpFilesize
988KB
-
memory/3068-122-0x00000000051B0000-0x00000000052BA000-memory.dmpFilesize
1.0MB
-
memory/3068-131-0x0000000006830000-0x000000000698B000-memory.dmpFilesize
1.4MB