Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
12-01-2021 18:01
Static task
static1
Behavioral task
behavioral1
Sample
Revise Order.exe
Resource
win7v20201028
General
-
Target
Revise Order.exe
-
Size
868KB
-
MD5
467fcc237db53f7bb42eac881adde0ba
-
SHA1
bd09e1cb4167721ab3c73f66a947201f13132378
-
SHA256
afaa365ef87b1aa804d330d56de9cee53e284870221ddf9aae2c36774e69e9af
-
SHA512
98a256583937fb716288c8990c46fba7e19d476f86c1be530510d8d76f78c869dbe6329262f10f903ce0cc13622231f23bb4372098125dede5c2e192791d986f
Malware Config
Extracted
formbook
http://www.lensinlens.com/ehxh/
financialaccompany.com
face2bouk.com
blazedisinfecting.com
providaconsultinggroup.com
distriautosdelpacifico.com
myaduhelm.com
thangmaygiatot.com
nuevasantatecla.com
endpedophiles.com
alwanps.com
anzi-studio.com
twoswinginghammers.com
curbedinc.com
purecleantn.com
4levelsplit.com
talklinecall.com
egypte-vakanties.com
xzntfwof.icu
sosyoclassic.com
adjoalearningacademy.com
alphacinema.net
lady2lover.com
eleanorandhick.com
kimsfist.com
pemasangangipsum.com
mrkabaadiwala.com
alltechengwork.com
marvitrans.net
islamicwatchdogmovement.net
fortunefoundrydesign.com
911strongerlife.com
cb13xxx.com
ameriloans.info
grantmohnphotography.com
iregentos.info
tubeknows.com
clarkacademiccoaching.com
hongzhifreight.com
sparkletosprinkles.com
sprtncloud.com
goegoldenretrievers.com
highstreetwear.com
channel22newz.com
jmuboprivacy.com
ayurvedayogasardinia.com
resethire.com
simplyrita.com
fatlosszone4u.com
brian.productions
qoogaloo.com
aubreyntaylor.com
jorgianamarlowe.com
onemilliondollarsapp.com
kontenery-pawilony.site
navinkhumui.xyz
lacroixandkress.com
luxlectric.net
haypr.com
lusomarkets.com
laplumebodas.com
leadhorn.com
masksthatsmile.com
suoxqxnnoj.net
xiamen8.xyz
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2908-12-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/2908-13-0x000000000041D050-mapping.dmp xloader behavioral2/memory/3112-14-0x0000000000000000-mapping.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Revise Order.exeRevise Order.exehelp.exedescription pid process target process PID 4068 set thread context of 2908 4068 Revise Order.exe Revise Order.exe PID 2908 set thread context of 3116 2908 Revise Order.exe Explorer.EXE PID 3112 set thread context of 3116 3112 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
Revise Order.exehelp.exepid process 2908 Revise Order.exe 2908 Revise Order.exe 2908 Revise Order.exe 2908 Revise Order.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe 3112 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Revise Order.exehelp.exepid process 2908 Revise Order.exe 2908 Revise Order.exe 2908 Revise Order.exe 3112 help.exe 3112 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Revise Order.exehelp.exedescription pid process Token: SeDebugPrivilege 2908 Revise Order.exe Token: SeDebugPrivilege 3112 help.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3116 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Revise Order.exeExplorer.EXEhelp.exedescription pid process target process PID 4068 wrote to memory of 2908 4068 Revise Order.exe Revise Order.exe PID 4068 wrote to memory of 2908 4068 Revise Order.exe Revise Order.exe PID 4068 wrote to memory of 2908 4068 Revise Order.exe Revise Order.exe PID 4068 wrote to memory of 2908 4068 Revise Order.exe Revise Order.exe PID 4068 wrote to memory of 2908 4068 Revise Order.exe Revise Order.exe PID 4068 wrote to memory of 2908 4068 Revise Order.exe Revise Order.exe PID 3116 wrote to memory of 3112 3116 Explorer.EXE help.exe PID 3116 wrote to memory of 3112 3116 Explorer.EXE help.exe PID 3116 wrote to memory of 3112 3116 Explorer.EXE help.exe PID 3112 wrote to memory of 2500 3112 help.exe cmd.exe PID 3112 wrote to memory of 2500 3112 help.exe cmd.exe PID 3112 wrote to memory of 2500 3112 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Revise Order.exe"C:\Users\Admin\AppData\Local\Temp\Revise Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Revise Order.exe"C:\Users\Admin\AppData\Local\Temp\Revise Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Revise Order.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2500-17-0x0000000000000000-mapping.dmp
-
memory/2908-12-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2908-13-0x000000000041D050-mapping.dmp
-
memory/3112-16-0x0000000000070000-0x0000000000077000-memory.dmpFilesize
28KB
-
memory/3112-15-0x0000000000070000-0x0000000000077000-memory.dmpFilesize
28KB
-
memory/3112-14-0x0000000000000000-mapping.dmp
-
memory/4068-6-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/4068-10-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/4068-11-0x0000000005E70000-0x0000000005ED8000-memory.dmpFilesize
416KB
-
memory/4068-9-0x0000000005210000-0x0000000005211000-memory.dmpFilesize
4KB
-
memory/4068-8-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/4068-7-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/4068-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/4068-5-0x0000000004F60000-0x0000000004F61000-memory.dmpFilesize
4KB
-
memory/4068-3-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB