Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 22:52
Static task
static1
Behavioral task
behavioral1
Sample
TT Advice Transfer confirmation.exe
Resource
win7-en-20211208
General
-
Target
TT Advice Transfer confirmation.exe
-
Size
388KB
-
MD5
48efc858b71dd263d50a4c7eab5cbd28
-
SHA1
b7fa887a0724cfe06d1752231e839694ede363b1
-
SHA256
947781dc2bb16bf085419b1804e568c2a0293423018f4b5e60beda4ed0ae218e
-
SHA512
28705d51526bef013f7752726ed7e59e84d14f9fecc91836822cadd5795cccd4e47c6aa1d8f2b82b382eb5a071eca1e07654866878f16910b2502f4fc0315855
Malware Config
Extracted
xloader
2.5
n8bs
monese-bank.com
silkypumps.xyz
tashabouvier.com
eduardoleonsilva.com
pinnaclecorporaterentals.com
megafluids.com
worldwidecarfans.com
benjamlnesq.com
unitedraxiapp.com
thetanheroes.com
jypmore.quest
indianasheriffs.biz
saintinstead.com
alldansmx.com
trulyproofreading.com
indotogel369.com
mermadekusse.store
radosenterprisellc.com
gseequalservices.com
techride.xyz
2031corp.com
centelytics.com
payperlivecalls.com
iphone13promax.guide
leadslingerstraining.com
generateideasint.com
afgelocal2741.com
n-visionlearning.com
strumagokart.quest
noisesocial.com
completefilmguide.com
mawuyrapaulin.com
heptagonfx.com
hype-clicks.com
uxog0.online
932381.com
trumpetrofnky.xyz
samudombang.com
hairtederionos.com
10karmy.com
nangniubanchanviet.online
brooklynprowellness.com
rockstarcleaningclub.com
rollnwin.top
breastextra.com
zahad-riedel.com
xuebqufvcdbgbqypuywgntpy.store
blogging2success.com
cnshippingagency.com
danielquasar.net
allthingsdog.info
legaltulsa.com
pure-impression.store
jonbeedle.com
ndtailgateofchampions.com
steelhorserescue.com
smart-realy.com
rebornmkt.com
zaktheme.xyz
myfranciscanshoe.com
linkedinupdate.com
fulviopires.com
magicspaces.digital
avtoshop761.com
myveguiolcusbyopappgroup.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/368-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/600-68-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Blocklisted process makes network request 1 IoCs
Processes:
cmstp.exeflow pid process 11 600 cmstp.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 628 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
TT Advice Transfer confirmation.exeTT Advice Transfer confirmation.execmstp.exedescription pid process target process PID 760 set thread context of 368 760 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 368 set thread context of 1360 368 TT Advice Transfer confirmation.exe Explorer.EXE PID 600 set thread context of 1360 600 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
TT Advice Transfer confirmation.execmstp.exepid process 368 TT Advice Transfer confirmation.exe 368 TT Advice Transfer confirmation.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe 600 cmstp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
TT Advice Transfer confirmation.execmstp.exepid process 368 TT Advice Transfer confirmation.exe 368 TT Advice Transfer confirmation.exe 368 TT Advice Transfer confirmation.exe 600 cmstp.exe 600 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
TT Advice Transfer confirmation.execmstp.exedescription pid process Token: SeDebugPrivilege 368 TT Advice Transfer confirmation.exe Token: SeDebugPrivilege 600 cmstp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
TT Advice Transfer confirmation.exeExplorer.EXEcmstp.exedescription pid process target process PID 760 wrote to memory of 368 760 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 760 wrote to memory of 368 760 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 760 wrote to memory of 368 760 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 760 wrote to memory of 368 760 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 760 wrote to memory of 368 760 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 760 wrote to memory of 368 760 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 760 wrote to memory of 368 760 TT Advice Transfer confirmation.exe TT Advice Transfer confirmation.exe PID 1360 wrote to memory of 600 1360 Explorer.EXE cmstp.exe PID 1360 wrote to memory of 600 1360 Explorer.EXE cmstp.exe PID 1360 wrote to memory of 600 1360 Explorer.EXE cmstp.exe PID 1360 wrote to memory of 600 1360 Explorer.EXE cmstp.exe PID 1360 wrote to memory of 600 1360 Explorer.EXE cmstp.exe PID 1360 wrote to memory of 600 1360 Explorer.EXE cmstp.exe PID 1360 wrote to memory of 600 1360 Explorer.EXE cmstp.exe PID 600 wrote to memory of 628 600 cmstp.exe cmd.exe PID 600 wrote to memory of 628 600 cmstp.exe cmd.exe PID 600 wrote to memory of 628 600 cmstp.exe cmd.exe PID 600 wrote to memory of 628 600 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TT Advice Transfer confirmation.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/368-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/368-64-0x0000000000350000-0x0000000000361000-memory.dmpFilesize
68KB
-
memory/368-63-0x0000000000870000-0x0000000000D33000-memory.dmpFilesize
4.8MB
-
memory/368-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/368-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/600-68-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/600-67-0x00000000006D0000-0x00000000006E8000-memory.dmpFilesize
96KB
-
memory/600-69-0x0000000001FC0000-0x00000000022C3000-memory.dmpFilesize
3.0MB
-
memory/600-70-0x0000000001D90000-0x0000000001E20000-memory.dmpFilesize
576KB
-
memory/760-58-0x00000000052E0000-0x0000000005342000-memory.dmpFilesize
392KB
-
memory/760-57-0x0000000000390000-0x000000000039C000-memory.dmpFilesize
48KB
-
memory/760-56-0x0000000004E20000-0x0000000004E21000-memory.dmpFilesize
4KB
-
memory/760-55-0x0000000075D61000-0x0000000075D63000-memory.dmpFilesize
8KB
-
memory/760-54-0x00000000009C0000-0x0000000000A28000-memory.dmpFilesize
416KB
-
memory/1360-65-0x0000000004CB0000-0x0000000004D68000-memory.dmpFilesize
736KB
-
memory/1360-71-0x0000000006A10000-0x0000000006B98000-memory.dmpFilesize
1.5MB