Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 07:31
Static task
static1
Behavioral task
behavioral1
Sample
Consignment Document PL&BL Draft.exe
Resource
win7v20201028
General
-
Target
Consignment Document PL&BL Draft.exe
-
Size
318KB
-
MD5
ef20635d931f69c41175aa8f1d81d60c
-
SHA1
3e00db6de337ef48f82ed1af80ca998ea86c5601
-
SHA256
444e72d12e85dffc1b247b29e7789022b251237f56ea83bf72e3c09fcb628874
-
SHA512
d9131029f0dbf8f59fa761031f0962c75dbbf138a97344e242434b324110fda7b7e9507b93bbd2224f5bd5cc654e7accce1e9994ddad499e386086d93ded5f13
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
thefinleyshow.com
basalmeals.com
esurpluss.com
hrbjczsfs.com
tourphuquocnguyenhien.com
mxprographics.com
themetaphysicalmaster.net
directorystar.asia
thehomeofdiamonds.com
riqinxin.com
covicio.com
sciineurope.com
womensportclothes.com
celestialchimes.net
lotsmen.com
hi-rescloud.net
lewisnathaniel.com
ageonward.com
eyetownglasses.com
bingent.info
matildealvaradovera.com
otorrinonews.com
cdeg898.com
lexingtoncoorgresort.com
minidachshundpups.com
tools365-shop.com
romancingtheeras.com
residentmining.com
aquaflowsprinklers.com
crackapks.com
caffeinatedeverafter.com
sureyyapasa.net
strawberryhearts.com
ptgo.net
devyshkam.com
thethrottletherapy.com
givelyrics.com
signaturepsinc.com
mersinsudunyasi.com
fivedayskitchen.com
fefebeauty.com
long0001.com
hmm40.com
claracarbon.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2008-2-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2008-3-0x000000000041D0E0-mapping.dmp xloader behavioral2/memory/2280-6-0x0000000000000000-mapping.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Consignment Document PL&BL Draft.exeConsignment Document PL&BL Draft.exesvchost.exedescription pid process target process PID 3992 set thread context of 2008 3992 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 2008 set thread context of 3036 2008 Consignment Document PL&BL Draft.exe Explorer.EXE PID 2280 set thread context of 3036 2280 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Consignment Document PL&BL Draft.exesvchost.exepid process 2008 Consignment Document PL&BL Draft.exe 2008 Consignment Document PL&BL Draft.exe 2008 Consignment Document PL&BL Draft.exe 2008 Consignment Document PL&BL Draft.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe 2280 svchost.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Consignment Document PL&BL Draft.exeConsignment Document PL&BL Draft.exesvchost.exepid process 3992 Consignment Document PL&BL Draft.exe 2008 Consignment Document PL&BL Draft.exe 2008 Consignment Document PL&BL Draft.exe 2008 Consignment Document PL&BL Draft.exe 2280 svchost.exe 2280 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Consignment Document PL&BL Draft.exesvchost.exedescription pid process Token: SeDebugPrivilege 2008 Consignment Document PL&BL Draft.exe Token: SeDebugPrivilege 2280 svchost.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Consignment Document PL&BL Draft.exeExplorer.EXEsvchost.exedescription pid process target process PID 3992 wrote to memory of 2008 3992 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 3992 wrote to memory of 2008 3992 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 3992 wrote to memory of 2008 3992 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 3992 wrote to memory of 2008 3992 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 3036 wrote to memory of 2280 3036 Explorer.EXE svchost.exe PID 3036 wrote to memory of 2280 3036 Explorer.EXE svchost.exe PID 3036 wrote to memory of 2280 3036 Explorer.EXE svchost.exe PID 2280 wrote to memory of 4032 2280 svchost.exe cmd.exe PID 2280 wrote to memory of 4032 2280 svchost.exe cmd.exe PID 2280 wrote to memory of 4032 2280 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2008-2-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2008-3-0x000000000041D0E0-mapping.dmp
-
memory/2280-6-0x0000000000000000-mapping.dmp
-
memory/2280-7-0x0000000001000000-0x000000000100C000-memory.dmpFilesize
48KB
-
memory/2280-8-0x0000000001000000-0x000000000100C000-memory.dmpFilesize
48KB
-
memory/4032-9-0x0000000000000000-mapping.dmp