Analysis
-
max time kernel
176s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
09-02-2022 10:21
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT_xlsx.exe
Resource
win7-en-20211208
General
-
Target
PAYMENT_xlsx.exe
-
Size
260KB
-
MD5
903f090170c015ce8a923608be5f5529
-
SHA1
ca5ab369fa9fa10367f8d2de5530986dd5add4a1
-
SHA256
ae912e8263a9242ff6590f2c818cdc64c3a6f2f059576dc8d760a3af93db63fc
-
SHA512
fb716c05053f9643ebdaff1e5a5a3d9b88cee77c1753a51618ab3c8f7897cd79384250edbe49cad6cf86579b83dd317ce2922674835ea3d484a0fb0f79f3bf6b
Malware Config
Extracted
xloader
2.5
dtt3
edilononlineshop.com
cursosd.com
viellacharteredland.com
increasey0urenergylevels.codes
yjy-hotel.com
claym.xyz
reelsguide.com
gives-cardano.com
ashrafannuar.com
mammalians.com
rocketleaguedads.com
yubierp.com
minimi36.com
chn-chn.com
jagojp888.com
parsian-shetab.com
273351.com
mdtouhid.com
babedads.com
vallinam2.com
buro-tic.com
az-rent.net
shifaebio.xyz
circuitoalberghiero.com
xn--b1afb9b.xn--p1acf
canlioyundasin.online
sachainchirajaomega.com
scandinest.com
pluky.net
tpxcy.com
nbg.global
automountproducts.com
hghbj.com
beachsidecoatings.com
householdertips.com
coworkingspace.online
doujyou.com
tenloe053.xyz
udpbkp.biz
kondanginyuk.online
zipiter.com
christiankrog.com
reliantrecruitinggroup.com
acrylicus.com
cruelgirls.biz
oeinsulation.com
mapnft.xyz
leadersfort.com
foodroutine.com
mayerohio.info
systemofsolutions.com
gideonajibike.com
bigboobz.net
townofis.com
mhkxlgs.com
sussaautocare.com
quicktle.com
boutiquedangel.com
garrisonroadhouse.com
stiff-pols.art
cabalaconsultores.com
theweddinggame.net
themoneymagicians.com
overtonesa.com
janasflannels.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2768-132-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3296-139-0x0000000000560000-0x0000000000589000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
PAYMENT_xlsx.exepid process 2188 PAYMENT_xlsx.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PAYMENT_xlsx.exePAYMENT_xlsx.execmmon32.exedescription pid process target process PID 2188 set thread context of 2768 2188 PAYMENT_xlsx.exe PAYMENT_xlsx.exe PID 2768 set thread context of 656 2768 PAYMENT_xlsx.exe Explorer.EXE PID 3296 set thread context of 656 3296 cmmon32.exe Explorer.EXE -
Drops file in Windows directory 8 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
PAYMENT_xlsx.execmmon32.exepid process 2768 PAYMENT_xlsx.exe 2768 PAYMENT_xlsx.exe 2768 PAYMENT_xlsx.exe 2768 PAYMENT_xlsx.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe 3296 cmmon32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 656 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PAYMENT_xlsx.execmmon32.exepid process 2768 PAYMENT_xlsx.exe 2768 PAYMENT_xlsx.exe 2768 PAYMENT_xlsx.exe 3296 cmmon32.exe 3296 cmmon32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
PAYMENT_xlsx.execmmon32.exesvchost.exeTiWorker.exedescription pid process Token: SeDebugPrivilege 2768 PAYMENT_xlsx.exe Token: SeDebugPrivilege 3296 cmmon32.exe Token: SeShutdownPrivilege 3592 svchost.exe Token: SeCreatePagefilePrivilege 3592 svchost.exe Token: SeShutdownPrivilege 3592 svchost.exe Token: SeCreatePagefilePrivilege 3592 svchost.exe Token: SeShutdownPrivilege 3592 svchost.exe Token: SeCreatePagefilePrivilege 3592 svchost.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe Token: SeSecurityPrivilege 4128 TiWorker.exe Token: SeBackupPrivilege 4128 TiWorker.exe Token: SeRestorePrivilege 4128 TiWorker.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 656 Explorer.EXE 656 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PAYMENT_xlsx.exeExplorer.EXEcmmon32.exedescription pid process target process PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe PAYMENT_xlsx.exe PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe PAYMENT_xlsx.exe PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe PAYMENT_xlsx.exe PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe PAYMENT_xlsx.exe PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe PAYMENT_xlsx.exe PID 2188 wrote to memory of 2768 2188 PAYMENT_xlsx.exe PAYMENT_xlsx.exe PID 656 wrote to memory of 3296 656 Explorer.EXE cmmon32.exe PID 656 wrote to memory of 3296 656 Explorer.EXE cmmon32.exe PID 656 wrote to memory of 3296 656 Explorer.EXE cmmon32.exe PID 3296 wrote to memory of 1572 3296 cmmon32.exe cmd.exe PID 3296 wrote to memory of 1572 3296 cmmon32.exe cmd.exe PID 3296 wrote to memory of 1572 3296 cmmon32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT_xlsx.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT_xlsx.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT_xlsx.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT_xlsx.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PAYMENT_xlsx.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nswCFD2.tmp\grjrgdnfat.dllMD5
4f17fcc87799615ed77345f05d8c5520
SHA11f4a7f5b874c28afdb8efa185282e8276147d305
SHA25642af13597bd2e5a22c31c9776403f45ddf4cded7a488fd7ae2463cfa31ba5783
SHA51240f2cbac516a82bccc0a49379a361d885dc97a4cc2589c81c1b39d5d94f9857c22eddc2194c089e392b209d9cc9e177ed4f39637e09639d4a9c08e7569ae485b
-
memory/656-137-0x00000000081B0000-0x0000000008308000-memory.dmpFilesize
1.3MB
-
memory/656-142-0x00000000080A0000-0x0000000008175000-memory.dmpFilesize
852KB
-
memory/2188-131-0x00000000022C0000-0x00000000022C2000-memory.dmpFilesize
8KB
-
memory/2768-133-0x0000000000AF0000-0x0000000000E3A000-memory.dmpFilesize
3.3MB
-
memory/2768-136-0x0000000000A00000-0x0000000000A11000-memory.dmpFilesize
68KB
-
memory/2768-135-0x000000000041D000-0x000000000041E000-memory.dmpFilesize
4KB
-
memory/2768-132-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3296-138-0x0000000000090000-0x000000000009C000-memory.dmpFilesize
48KB
-
memory/3296-139-0x0000000000560000-0x0000000000589000-memory.dmpFilesize
164KB
-
memory/3296-140-0x0000000002800000-0x0000000002B4A000-memory.dmpFilesize
3.3MB
-
memory/3296-141-0x0000000002530000-0x00000000025C0000-memory.dmpFilesize
576KB
-
memory/3592-143-0x000002620EDA0000-0x000002620EDB0000-memory.dmpFilesize
64KB
-
memory/3592-144-0x000002620F560000-0x000002620F570000-memory.dmpFilesize
64KB
-
memory/3592-145-0x0000026212180000-0x0000026212184000-memory.dmpFilesize
16KB