Analysis
- max time kernel
147s - max time network
148s - platform
windows7_x64 - resource
win7v20201028 - submitted
17/12/2020, 08:37
Static task
static1
Behavioral task
behavioral1
Sample
rtgs_pdf.exe
Resource
win7v20201028
windows7_x64
General
- Target rtgs_pdf.exe
- Size 307KB
- Sample201217-3q2js1a5f2
- SHA256 b2f4176efc7fb22a1958f63af6f3029b8d4fdbecb98625828822d471a6a137b4
- MD5 a27577cef313450cf362d2dae973c543
- SHA1 a8841adc11f8846a494bc54940f4edb9d4cbecc0
- SHA512 d4e64e48cd41405b8e72b808055ddd33a135f4e92f07710e08637fabcf9d6b40c7cab301cdd60e0902a461ae5da4bc4c2f334e0a1391716376e9e99bc47a718a
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.fhmaluxury.com/rerx/
-
cyberessentialstutor.com
-
theemergingleadership.com
-
lurapures.com
-
escapenet.cloud
-
schoolofdigitalmasters.com
-
hammockextreme.com
-
setejiako.com
-
southshoredistrictreviews.com
-
activityhacker.com
-
gentlemancosmeticos.com
-
artistictouches.co.uk
-
hubtekweb.com
-
dsr.cool
-
timberlandbarataspt.com
-
aberdeentwp.com
-
basicbitchbugspray.com
-
brandaffektion.com
-
popuplomi.com
-
gaming-alpha.com
-
winterfestfortheholidays.com
-
languageforyou.com
-
charlessbridge.com
-
aphelionscans.com
-
yeehawlove.com
-
themerip.com
-
choicehomesks.com
-
srldzycyp.icu
-
lohas.company
-
gtzxyyy.com
-
linkedoutbook.com
-
bestbootsweb.com
-
ezsusu.net
-
thunderofwaters.com
-
makanshargh.com
-
trusteseseses.com
-
hattefashion.com
-
matchameup.com
-
bidarilawoffices1.com
-
thesuccessliving.com
-
themesgg.com
-
chjyu.com
-
forex160.com
-
vinonabal.com
-
alodolu.com
-
houstonsgrouptravel.com
-
utilizedcurled.net
-
sitesfazendoecomm.com
-
studycafe.store
-
cookies-x.info
-
egginess.com
-
coloradofairallocationplan.com
-
905997.com
-
wifisinfalla.com
-
edusentral.world
-
wohnenamweinberg.com
-
amumutop.com
-
chinafozon.com
-
livestv88.xyz
-
tikoutdoors.com
-
foreverlive2029.com
-
chrysalis-investments.com
-
elteccomp.xyz
-
friedmanu.lat
-
webgloob.com
Signatures
- Xloader Payload 3 IoCs
resource yara_rule behavioral1/memory/1316-3-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1316-4-0x000000000041D030-mapping.dmp xloader behavioral1/memory/1180-5-0x0000000000000000-mapping.dmp xloader - Deletes itself 1 IoCs
pid Process 1220 cmd.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 532 set thread context of 1316 532 rtgs_pdf.exe 29 PID 1316 set thread context of 1260 1316 rtgs_pdf.exe 13 PID 1180 set thread context of 1260 1180 wscript.exe 13 - Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 532 rtgs_pdf.exe 532 rtgs_pdf.exe 532 rtgs_pdf.exe 1316 rtgs_pdf.exe 1316 rtgs_pdf.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe 1180 wscript.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1316 rtgs_pdf.exe 1316 rtgs_pdf.exe 1316 rtgs_pdf.exe 1180 wscript.exe 1180 wscript.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 532 rtgs_pdf.exe Token: SeDebugPrivilege 1316 rtgs_pdf.exe Token: SeDebugPrivilege 1180 wscript.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 532 wrote to memory of 1316 532 rtgs_pdf.exe 29 PID 532 wrote to memory of 1316 532 rtgs_pdf.exe 29 PID 532 wrote to memory of 1316 532 rtgs_pdf.exe 29 PID 532 wrote to memory of 1316 532 rtgs_pdf.exe 29 PID 532 wrote to memory of 1316 532 rtgs_pdf.exe 29 PID 532 wrote to memory of 1316 532 rtgs_pdf.exe 29 PID 532 wrote to memory of 1316 532 rtgs_pdf.exe 29 PID 1260 wrote to memory of 1180 1260 Explorer.EXE 30 PID 1260 wrote to memory of 1180 1260 Explorer.EXE 30 PID 1260 wrote to memory of 1180 1260 Explorer.EXE 30 PID 1260 wrote to memory of 1180 1260 Explorer.EXE 30 PID 1180 wrote to memory of 1220 1180 wscript.exe 31 PID 1180 wrote to memory of 1220 1180 wscript.exe 31 PID 1180 wrote to memory of 1220 1180 wscript.exe 31 PID 1180 wrote to memory of 1220 1180 wscript.exe 31
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\rtgs_pdf.exe"C:\Users\Admin\AppData\Local\Temp\rtgs_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\rtgs_pdf.exe"C:\Users\Admin\AppData\Local\Temp\rtgs_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1316
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\rtgs_pdf.exe"3⤵
- Deletes itself
PID:1220
-
-