Analysis
- max time kernel
163s - max time network
166s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
14/02/2022, 16:09
Static task
static1
Behavioral task
behavioral1
Sample
pounds Payment.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target pounds Payment.exe
- Size 1.0MB
- Sample220214-tlsesaaab6
- SHA256 2fd3db9eb65d7a120e24e7245a73e4e88d4b2a7998d82986e8b2e2f20af1d932
- MD5 98dada216714b7a1984e574ab802404c
- SHA1 614b15a9f514bf12c87967626eac1a9ceeb86ec0
- SHA512 a81c664c302d465b8db8315c3e5308b73bad1ec06af146c5b95cb336d505c4e87e3586f1b24a63c165f23a38dddbb8f767bc1c5dd6eb2876bbb60d6af146820d
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
8gce
Decoy
-
ultimaslot.net
-
jacqueegui.com
-
aktsecurity.com
-
beattietnpasumo1.xyz
-
kellerwilliamrealestate.com
-
cryptodouble2x3x.online
-
wilsoncreekarts.com
-
portalphotography.art
-
bocafoods.net
-
gloriamcarter.com
-
goodfellascandoit.com
-
xhypxjkc.com
-
mimisminiatureboutique.store
-
plidoo.com
-
splendidbelle.com
-
grand-cas1no.com
-
xegizas.xyz
-
awadhhomes.com
-
piecebin.com
-
baridipay.com
-
carolwhilby.com
-
prefferably.com
-
helikonx.com
-
ejevisual.net
-
responsiblecomputing.com
-
loho5.com
-
tenniswired.com
-
mesadydak.quest
-
stepbystepschoolalwar.com
-
47dgj.xyz
-
shieldsminiaussies.com
-
teo-by.com
-
omgbell.net
-
giaohangtietkiemhcm.com
-
millionistabrujas.com
-
utsaquantum.com
-
sugarcaneloaders.com
-
getcelservice.com
-
shashistyle.com
-
cherryhillemergencydentist.com
-
thehomefurnishings.com
-
ekaowen.com
-
360metaverse.pro
-
ame.agency
-
lemesdev.com
-
clicktoreach.com
-
annikadaniel.love
-
flyy2001.com
-
partywearsarees.com
-
thebuffgolfers.com
-
waterheroes.online
-
loginofy.com
-
reverendrummage.com
-
uniself.online
-
aschengfu.com
-
awanderingbarista.com
-
medeemn.com
-
mgav73.xyz
-
shopthebedroomboutique.com
-
gicblocking.com
-
heisilver.xyz
-
nyimfandsatire.com
-
208.pizza
-
satexch9.com
-
tchatchellosa.com
Signatures
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/4276-140-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3920-147-0x0000000000D00000-0x0000000000D29000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4072 set thread context of 4276 4072 pounds Payment.exe 100 PID 4276 set thread context of 3044 4276 pounds Payment.exe 55 PID 3920 set thread context of 3044 3920 cmstp.exe 55 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 4276 pounds Payment.exe 4276 pounds Payment.exe 4276 pounds Payment.exe 4276 pounds Payment.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 4276 pounds Payment.exe 4276 pounds Payment.exe 4276 pounds Payment.exe 3920 cmstp.exe 3920 cmstp.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4932 svchost.exe Token: SeCreatePagefilePrivilege 4932 svchost.exe Token: SeShutdownPrivilege 4932 svchost.exe Token: SeCreatePagefilePrivilege 4932 svchost.exe Token: SeShutdownPrivilege 4932 svchost.exe Token: SeCreatePagefilePrivilege 4932 svchost.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe Token: SeRestorePrivilege 4936 TiWorker.exe Token: SeSecurityPrivilege 4936 TiWorker.exe Token: SeBackupPrivilege 4936 TiWorker.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4072 wrote to memory of 4276 4072 pounds Payment.exe 100 PID 4072 wrote to memory of 4276 4072 pounds Payment.exe 100 PID 4072 wrote to memory of 4276 4072 pounds Payment.exe 100 PID 4072 wrote to memory of 4276 4072 pounds Payment.exe 100 PID 4072 wrote to memory of 4276 4072 pounds Payment.exe 100 PID 4072 wrote to memory of 4276 4072 pounds Payment.exe 100 PID 3044 wrote to memory of 3920 3044 Explorer.EXE 101 PID 3044 wrote to memory of 3920 3044 Explorer.EXE 101 PID 3044 wrote to memory of 3920 3044 Explorer.EXE 101 PID 3920 wrote to memory of 4432 3920 cmstp.exe 102 PID 3920 wrote to memory of 4432 3920 cmstp.exe 102 PID 3920 wrote to memory of 4432 3920 cmstp.exe 102
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\pounds Payment.exe"C:\Users\Admin\AppData\Local\Temp\pounds Payment.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\pounds Payment.exe"C:\Users\Admin\AppData\Local\Temp\pounds Payment.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4276
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\pounds Payment.exe"3⤵PID:4432
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4936