Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 09:26
Static task
static1
Behavioral task
behavioral1
Sample
TT Advice Transfer confirmation.exe
Resource
win7-en-20211208
General
-
Target
TT Advice Transfer confirmation.exe
-
Size
388KB
-
MD5
48efc858b71dd263d50a4c7eab5cbd28
-
SHA1
b7fa887a0724cfe06d1752231e839694ede363b1
-
SHA256
947781dc2bb16bf085419b1804e568c2a0293423018f4b5e60beda4ed0ae218e
-
SHA512
28705d51526bef013f7752726ed7e59e84d14f9fecc91836822cadd5795cccd4e47c6aa1d8f2b82b382eb5a071eca1e07654866878f16910b2502f4fc0315855
Malware Config
Extracted
xloader
2.5
n8bs
monese-bank.com
silkypumps.xyz
tashabouvier.com
eduardoleonsilva.com
pinnaclecorporaterentals.com
megafluids.com
worldwidecarfans.com
benjamlnesq.com
unitedraxiapp.com
thetanheroes.com
jypmore.quest
indianasheriffs.biz
saintinstead.com
alldansmx.com
trulyproofreading.com
indotogel369.com
mermadekusse.store
radosenterprisellc.com
gseequalservices.com
techride.xyz
2031corp.com
centelytics.com
payperlivecalls.com
iphone13promax.guide
leadslingerstraining.com
generateideasint.com
afgelocal2741.com
n-visionlearning.com
strumagokart.quest
noisesocial.com
completefilmguide.com
mawuyrapaulin.com
heptagonfx.com
hype-clicks.com
uxog0.online
932381.com
trumpetrofnky.xyz
samudombang.com
hairtederionos.com
10karmy.com
nangniubanchanviet.online
brooklynprowellness.com
rockstarcleaningclub.com
rollnwin.top
breastextra.com
zahad-riedel.com
xuebqufvcdbgbqypuywgntpy.store
blogging2success.com
cnshippingagency.com
danielquasar.net
allthingsdog.info
legaltulsa.com
pure-impression.store
jonbeedle.com
ndtailgateofchampions.com
steelhorserescue.com
smart-realy.com
rebornmkt.com
zaktheme.xyz
myfranciscanshoe.com
linkedinupdate.com
fulviopires.com
magicspaces.digital
avtoshop761.com
myveguiolcusbyopappgroup.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3444-123-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3444-126-0x0000000001300000-0x0000000001494000-memory.dmp xloader behavioral2/memory/1844-129-0x0000000000D40000-0x0000000000D69000-memory.dmp xloader behavioral2/memory/1844-131-0x0000000004EF0000-0x000000000507D000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
TT Advice Transfer confirmation.exeTT Advice Transfer confirmation.exemstsc.exedescription pid process target process PID 4052 set thread context of 3444 4052 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 3444 set thread context of 3036 3444 TT Advice Transfer confirmation.exe Explorer.EXE PID 1844 set thread context of 3036 1844 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
TT Advice Transfer confirmation.exemstsc.exepid process 3444 TT Advice Transfer confirmation.exe 3444 TT Advice Transfer confirmation.exe 3444 TT Advice Transfer confirmation.exe 3444 TT Advice Transfer confirmation.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe 1844 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
TT Advice Transfer confirmation.exemstsc.exepid process 3444 TT Advice Transfer confirmation.exe 3444 TT Advice Transfer confirmation.exe 3444 TT Advice Transfer confirmation.exe 1844 mstsc.exe 1844 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TT Advice Transfer confirmation.exemstsc.exedescription pid process Token: SeDebugPrivilege 3444 TT Advice Transfer confirmation.exe Token: SeDebugPrivilege 1844 mstsc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
TT Advice Transfer confirmation.exeExplorer.EXEmstsc.exedescription pid process target process PID 4052 wrote to memory of 3444 4052 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 4052 wrote to memory of 3444 4052 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 4052 wrote to memory of 3444 4052 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 4052 wrote to memory of 3444 4052 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 4052 wrote to memory of 3444 4052 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 4052 wrote to memory of 3444 4052 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 3036 wrote to memory of 1844 3036 Explorer.EXE mstsc.exe PID 3036 wrote to memory of 1844 3036 Explorer.EXE mstsc.exe PID 3036 wrote to memory of 1844 3036 Explorer.EXE mstsc.exe PID 1844 wrote to memory of 1664 1844 mstsc.exe cmd.exe PID 1844 wrote to memory of 1664 1844 mstsc.exe cmd.exe PID 1844 wrote to memory of 1664 1844 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1844-131-0x0000000004EF0000-0x000000000507D000-memory.dmpFilesize
1.6MB
-
memory/1844-130-0x0000000005220000-0x0000000005540000-memory.dmpFilesize
3.1MB
-
memory/1844-129-0x0000000000D40000-0x0000000000D69000-memory.dmpFilesize
164KB
-
memory/1844-128-0x0000000001100000-0x00000000013FC000-memory.dmpFilesize
3.0MB
-
memory/3036-127-0x00000000056F0000-0x0000000005824000-memory.dmpFilesize
1.2MB
-
memory/3036-132-0x00000000068D0000-0x0000000006A23000-memory.dmpFilesize
1.3MB
-
memory/3444-123-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3444-125-0x00000000014A0000-0x00000000017C0000-memory.dmpFilesize
3.1MB
-
memory/3444-126-0x0000000001300000-0x0000000001494000-memory.dmpFilesize
1.6MB
-
memory/4052-122-0x0000000007D50000-0x0000000007DB2000-memory.dmpFilesize
392KB
-
memory/4052-115-0x0000000000C20000-0x0000000000C88000-memory.dmpFilesize
416KB
-
memory/4052-121-0x0000000007BD0000-0x0000000007C6C000-memory.dmpFilesize
624KB
-
memory/4052-120-0x00000000059F0000-0x00000000059FC000-memory.dmpFilesize
48KB
-
memory/4052-118-0x0000000005630000-0x000000000563A000-memory.dmpFilesize
40KB
-
memory/4052-119-0x0000000005570000-0x0000000005A6E000-memory.dmpFilesize
5.0MB
-
memory/4052-117-0x00000000054B0000-0x0000000005542000-memory.dmpFilesize
584KB
-
memory/4052-116-0x0000000005A70000-0x0000000005F6E000-memory.dmpFilesize
5.0MB