Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 09:26
Static task
static1
Behavioral task
behavioral1
Sample
TT Advice Transfer confirmation.exe
Resource
win7-en-20211208
General
-
Target
TT Advice Transfer confirmation.exe
-
Size
388KB
-
MD5
48efc858b71dd263d50a4c7eab5cbd28
-
SHA1
b7fa887a0724cfe06d1752231e839694ede363b1
-
SHA256
947781dc2bb16bf085419b1804e568c2a0293423018f4b5e60beda4ed0ae218e
-
SHA512
28705d51526bef013f7752726ed7e59e84d14f9fecc91836822cadd5795cccd4e47c6aa1d8f2b82b382eb5a071eca1e07654866878f16910b2502f4fc0315855
Malware Config
Extracted
xloader
2.5
n8bs
monese-bank.com
silkypumps.xyz
tashabouvier.com
eduardoleonsilva.com
pinnaclecorporaterentals.com
megafluids.com
worldwidecarfans.com
benjamlnesq.com
unitedraxiapp.com
thetanheroes.com
jypmore.quest
indianasheriffs.biz
saintinstead.com
alldansmx.com
trulyproofreading.com
indotogel369.com
mermadekusse.store
radosenterprisellc.com
gseequalservices.com
techride.xyz
2031corp.com
centelytics.com
payperlivecalls.com
iphone13promax.guide
leadslingerstraining.com
generateideasint.com
afgelocal2741.com
n-visionlearning.com
strumagokart.quest
noisesocial.com
completefilmguide.com
mawuyrapaulin.com
heptagonfx.com
hype-clicks.com
uxog0.online
932381.com
trumpetrofnky.xyz
samudombang.com
hairtederionos.com
10karmy.com
nangniubanchanviet.online
brooklynprowellness.com
rockstarcleaningclub.com
rollnwin.top
breastextra.com
zahad-riedel.com
xuebqufvcdbgbqypuywgntpy.store
blogging2success.com
cnshippingagency.com
danielquasar.net
allthingsdog.info
legaltulsa.com
pure-impression.store
jonbeedle.com
ndtailgateofchampions.com
steelhorserescue.com
smart-realy.com
rebornmkt.com
zaktheme.xyz
myfranciscanshoe.com
linkedinupdate.com
fulviopires.com
magicspaces.digital
avtoshop761.com
myveguiolcusbyopappgroup.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/468-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1428-69-0x00000000000E0000-0x0000000000109000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 628 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
TT Advice Transfer confirmation.exeTT Advice Transfer confirmation.exemsdt.exedescription pid process target process PID 960 set thread context of 468 960 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 468 set thread context of 1272 468 TT Advice Transfer confirmation.exe Explorer.EXE PID 1428 set thread context of 1272 1428 msdt.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
TT Advice Transfer confirmation.exemsdt.exepid process 468 TT Advice Transfer confirmation.exe 468 TT Advice Transfer confirmation.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe 1428 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
TT Advice Transfer confirmation.exemsdt.exepid process 468 TT Advice Transfer confirmation.exe 468 TT Advice Transfer confirmation.exe 468 TT Advice Transfer confirmation.exe 1428 msdt.exe 1428 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TT Advice Transfer confirmation.exemsdt.exedescription pid process Token: SeDebugPrivilege 468 TT Advice Transfer confirmation.exe Token: SeDebugPrivilege 1428 msdt.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
TT Advice Transfer confirmation.exeExplorer.EXEmsdt.exedescription pid process target process PID 960 wrote to memory of 468 960 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 960 wrote to memory of 468 960 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 960 wrote to memory of 468 960 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 960 wrote to memory of 468 960 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 960 wrote to memory of 468 960 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 960 wrote to memory of 468 960 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 960 wrote to memory of 468 960 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 1272 wrote to memory of 1428 1272 Explorer.EXE msdt.exe PID 1272 wrote to memory of 1428 1272 Explorer.EXE msdt.exe PID 1272 wrote to memory of 1428 1272 Explorer.EXE msdt.exe PID 1272 wrote to memory of 1428 1272 Explorer.EXE msdt.exe PID 1428 wrote to memory of 628 1428 msdt.exe cmd.exe PID 1428 wrote to memory of 628 1428 msdt.exe cmd.exe PID 1428 wrote to memory of 628 1428 msdt.exe cmd.exe PID 1428 wrote to memory of 628 1428 msdt.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/468-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/468-65-0x0000000000450000-0x0000000000461000-memory.dmpFilesize
68KB
-
memory/468-64-0x00000000009A0000-0x0000000000CA3000-memory.dmpFilesize
3.0MB
-
memory/468-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/468-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/960-59-0x0000000004860000-0x00000000048C2000-memory.dmpFilesize
392KB
-
memory/960-55-0x0000000000050000-0x00000000000B8000-memory.dmpFilesize
416KB
-
memory/960-58-0x0000000000690000-0x000000000069C000-memory.dmpFilesize
48KB
-
memory/960-57-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/960-56-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1272-66-0x0000000005FE0000-0x0000000006091000-memory.dmpFilesize
708KB
-
memory/1272-72-0x0000000006BF0000-0x0000000006D68000-memory.dmpFilesize
1.5MB
-
memory/1428-68-0x0000000000980000-0x0000000000A74000-memory.dmpFilesize
976KB
-
memory/1428-69-0x00000000000E0000-0x0000000000109000-memory.dmpFilesize
164KB
-
memory/1428-70-0x0000000002250000-0x0000000002553000-memory.dmpFilesize
3.0MB
-
memory/1428-71-0x0000000001E80000-0x00000000020BC000-memory.dmpFilesize
2.2MB