Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
14-01-2022 04:19
Static task
static1
Behavioral task
behavioral1
Sample
Payment-402.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Payment-402.exe
Resource
win10-en-20211208
General
-
Target
Payment-402.exe
-
Size
1.2MB
-
MD5
7f9d26535c38eee3561f2e7c214f9854
-
SHA1
80074b8467cb52e6c36d587e1571045bf93521b5
-
SHA256
4d58c656b52ad9e501a74866dd2f0b2fd00ea4cd92013540edaa91f31f2159ae
-
SHA512
97fab9b908fa0eaadfc971c3ff0b34e98a2ea3d33bc8a062f0f3b35631a0ca16d86b24935c6fb38a10d36675316a90500603ba4c88481b6bd058baf49958ca73
Malware Config
Extracted
xloader
2.5
c6si
tristateinc.construction
americanscaregroundstexas.com
kanimisoshiru.com
wihling.com
fishcheekstosa.com
parentsfuid.com
greenstandmarket.com
fc8fla8kzq.com
gametwist-83.club
jobsncvs.com
directrealtysells.com
avida2015.com
conceptasite.net
arkaneattire.com
indev-mobility.info
2160centurypark412.com
valefloor.com
septembership.com
stackflix.com
jimc0sales.net
socialviralup.com
lastra41.com
juliaepaulovaocasar.com
jurisagora.com
drawandgrow.online
rebekahlouise.com
herport-fr.com
iphone13.webcam
appz-one.net
inpost-pl.net
promocion360fitness.com
global-forbes.biz
diamondtrade.net
albertcantos.com
gtgits.com
travel-ai.online
busipe6.com
mualikesubvn.com
niftyhandy.com
docprops.com
lido88.bet
baywoodphotography.com
cargosouq.info
newsnowlive.online
floridafishingoverboard.com
missnikissalsa.net
walletvalidate.space
kissimmeeinternationalcup.com
charterhome.school
gurujupiter.com
entertainmentwitchy.com
jokeaou.com
sugarmountainfirearms.com
iss-sa.com
smittyssierra.com
freedomoff.com
giftoin.com
realitystararmwrestling.com
salsalunch-equallyage.com
ladouba.com
thepropertygoat.com
bestofmerrick.guide
4the.top
regioinversiones.com
129qihu.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/524-62-0x000000000041D4B0-mapping.dmp xloader behavioral1/memory/524-63-0x0000000000080000-0x00000000000A9000-memory.dmp xloader behavioral1/memory/524-68-0x0000000000080000-0x00000000000A9000-memory.dmp xloader behavioral1/memory/1396-74-0x0000000000110000-0x0000000000139000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Payment-402.exeaspnet_regbrowsers.execontrol.exedescription pid process target process PID 1528 set thread context of 524 1528 Payment-402.exe aspnet_regbrowsers.exe PID 524 set thread context of 1200 524 aspnet_regbrowsers.exe Explorer.EXE PID 524 set thread context of 1200 524 aspnet_regbrowsers.exe Explorer.EXE PID 1396 set thread context of 1200 1396 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
aspnet_regbrowsers.execontrol.exepid process 524 aspnet_regbrowsers.exe 524 aspnet_regbrowsers.exe 524 aspnet_regbrowsers.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe 1396 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
aspnet_regbrowsers.execontrol.exepid process 524 aspnet_regbrowsers.exe 524 aspnet_regbrowsers.exe 524 aspnet_regbrowsers.exe 524 aspnet_regbrowsers.exe 1396 control.exe 1396 control.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Payment-402.exeaspnet_regbrowsers.execontrol.exedescription pid process Token: SeDebugPrivilege 1528 Payment-402.exe Token: SeDebugPrivilege 524 aspnet_regbrowsers.exe Token: SeDebugPrivilege 1396 control.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Payment-402.exeaspnet_regbrowsers.execontrol.exedescription pid process target process PID 1528 wrote to memory of 524 1528 Payment-402.exe aspnet_regbrowsers.exe PID 1528 wrote to memory of 524 1528 Payment-402.exe aspnet_regbrowsers.exe PID 1528 wrote to memory of 524 1528 Payment-402.exe aspnet_regbrowsers.exe PID 1528 wrote to memory of 524 1528 Payment-402.exe aspnet_regbrowsers.exe PID 1528 wrote to memory of 524 1528 Payment-402.exe aspnet_regbrowsers.exe PID 1528 wrote to memory of 524 1528 Payment-402.exe aspnet_regbrowsers.exe PID 1528 wrote to memory of 524 1528 Payment-402.exe aspnet_regbrowsers.exe PID 524 wrote to memory of 1396 524 aspnet_regbrowsers.exe control.exe PID 524 wrote to memory of 1396 524 aspnet_regbrowsers.exe control.exe PID 524 wrote to memory of 1396 524 aspnet_regbrowsers.exe control.exe PID 524 wrote to memory of 1396 524 aspnet_regbrowsers.exe control.exe PID 1396 wrote to memory of 1788 1396 control.exe cmd.exe PID 1396 wrote to memory of 1788 1396 control.exe cmd.exe PID 1396 wrote to memory of 1788 1396 control.exe cmd.exe PID 1396 wrote to memory of 1788 1396 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Payment-402.exe"C:\Users\Admin\AppData\Local\Temp\Payment-402.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-65-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/524-69-0x0000000000290000-0x00000000002A1000-memory.dmpFilesize
68KB
-
memory/524-68-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/524-66-0x00000000001C0000-0x00000000001D1000-memory.dmpFilesize
68KB
-
memory/524-59-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/524-60-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/524-62-0x000000000041D4B0-mapping.dmp
-
memory/524-63-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1200-67-0x00000000077C0000-0x000000000793E000-memory.dmpFilesize
1.5MB
-
memory/1200-70-0x0000000004D80000-0x0000000004E5F000-memory.dmpFilesize
892KB
-
memory/1200-78-0x0000000004E60000-0x0000000004FBB000-memory.dmpFilesize
1.4MB
-
memory/1396-75-0x00000000021E0000-0x00000000024E3000-memory.dmpFilesize
3.0MB
-
memory/1396-71-0x0000000000000000-mapping.dmp
-
memory/1396-72-0x00000000769D1000-0x00000000769D3000-memory.dmpFilesize
8KB
-
memory/1396-74-0x0000000000110000-0x0000000000139000-memory.dmpFilesize
164KB
-
memory/1396-73-0x0000000000DC0000-0x0000000000DDF000-memory.dmpFilesize
124KB
-
memory/1396-77-0x0000000000840000-0x00000000008D0000-memory.dmpFilesize
576KB
-
memory/1528-56-0x0000000000DD0000-0x0000000000EFE000-memory.dmpFilesize
1.2MB
-
memory/1528-57-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/1528-58-0x00000000003D0000-0x00000000003E4000-memory.dmpFilesize
80KB
-
memory/1528-55-0x0000000000DD0000-0x0000000000EFE000-memory.dmpFilesize
1.2MB
-
memory/1788-76-0x0000000000000000-mapping.dmp