Analysis
- max time kernel
176s - max time network
189s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
09/02/2022, 10:21
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT_xlsx.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target PAYMENT_xlsx.exe
- Size 260KB
- Sample220209-mdncjaabdj
- SHA256 ae912e8263a9242ff6590f2c818cdc64c3a6f2f059576dc8d760a3af93db63fc
- MD5 903f090170c015ce8a923608be5f5529
- SHA1 ca5ab369fa9fa10367f8d2de5530986dd5add4a1
- SHA512 fb716c05053f9643ebdaff1e5a5a3d9b88cee77c1753a51618ab3c8f7897cd79384250edbe49cad6cf86579b83dd317ce2922674835ea3d484a0fb0f79f3bf6b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
dtt3
Decoy
-
edilononlineshop.com
-
cursosd.com
-
viellacharteredland.com
-
increasey0urenergylevels.codes
-
yjy-hotel.com
-
claym.xyz
-
reelsguide.com
-
gives-cardano.com
-
ashrafannuar.com
-
mammalians.com
-
rocketleaguedads.com
-
yubierp.com
-
minimi36.com
-
chn-chn.com
-
jagojp888.com
-
parsian-shetab.com
-
273351.com
-
mdtouhid.com
-
babedads.com
-
vallinam2.com
-
buro-tic.com
-
az-rent.net
-
shifaebio.xyz
-
circuitoalberghiero.com
-
xn--b1afb9b.xn--p1acf
-
canlioyundasin.online
-
sachainchirajaomega.com
-
scandinest.com
-
pluky.net
-
tpxcy.com
-
nbg.global
-
automountproducts.com
-
hghbj.com
-
beachsidecoatings.com
-
householdertips.com
-
coworkingspace.online
-
doujyou.com
-
tenloe053.xyz
-
udpbkp.biz
-
kondanginyuk.online
-
zipiter.com
-
christiankrog.com
-
reliantrecruitinggroup.com
-
acrylicus.com
-
cruelgirls.biz
-
oeinsulation.com
-
mapnft.xyz
-
leadersfort.com
-
foodroutine.com
-
mayerohio.info
-
systemofsolutions.com
-
gideonajibike.com
-
bigboobz.net
-
townofis.com
-
mhkxlgs.com
-
sussaautocare.com
-
quicktle.com
-
boutiquedangel.com
-
garrisonroadhouse.com
-
stiff-pols.art
-
cabalaconsultores.com
-
theweddinggame.net
-
themoneymagicians.com
-
overtonesa.com
-
janasflannels.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/2768-132-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3296-139-0x0000000000560000-0x0000000000589000-memory.dmp xloader - Loads dropped DLL 1 IoCs
pid Process 2188 PAYMENT_xlsx.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2188 set thread context of 2768 2188 PAYMENT_xlsx.exe 82 PID 2768 set thread context of 656 2768 PAYMENT_xlsx.exe 49 PID 3296 set thread context of 656 3296 cmmon32.exe 49 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 2768 PAYMENT_xlsx.exe 2768 PAYMENT_xlsx.exe 2768 PAYMENT_xlsx.exe 2768 PAYMENT_xlsx.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 656 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2768 PAYMENT_xlsx.exe 2768 PAYMENT_xlsx.exe 2768 PAYMENT_xlsx.exe 3296 cmmon32.exe 3296 cmmon32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2768 PAYMENT_xlsx.exe Token: SeDebugPrivilege 3296 cmmon32.exe Token: SeShutdownPrivilege 3592 svchost.exe Token: SeCreatePagefilePrivilege 3592 svchost.exe Token: SeShutdownPrivilege 3592 svchost.exe Token: SeCreatePagefilePrivilege 3592 svchost.exe Token: SeShutdownPrivilege 3592 svchost.exe Token: SeCreatePagefilePrivilege 3592 svchost.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 656 Explorer.EXE 656 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe 82 PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe 82 PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe 82 PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe 82 PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe 82 PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe 82 PID 656 wrote to memory of 3296 656 Explorer.EXE 84 PID 656 wrote to memory of 3296 656 Explorer.EXE 84 PID 656 wrote to memory of 3296 656 Explorer.EXE 84 PID 3296 wrote to memory of 1572 3296 cmmon32.exe 86 PID 3296 wrote to memory of 1572 3296 cmmon32.exe 86 PID 3296 wrote to memory of 1572 3296 cmmon32.exe 86
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\PAYMENT_xlsx.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT_xlsx.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\PAYMENT_xlsx.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT_xlsx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2768
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PAYMENT_xlsx.exe"3⤵PID:1572
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3592
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4128