Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 20:24
Static task
static1
Behavioral task
behavioral1
Sample
Scan Document 01.exe
Resource
win7v20201028
General
-
Target
Scan Document 01.exe
-
Size
435KB
-
MD5
47a3b1f5f7a8f5d342654a4e351d62ea
-
SHA1
e94eca6012b651847bfb4212c21c989041d1438e
-
SHA256
196b4470cd98c4f6d5c634170a1c6a98cf59b61c9b12a032ec9fb776b74a0527
-
SHA512
d4f4b0064830a0091a9ed070f9e43c0abb768d1fc4bf6d5a9589f2ce3b4a0908125264233a53119c914994474a30f628c04fbdb0361d2e8556094caebb0e303e
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
thefinleyshow.com
basalmeals.com
esurpluss.com
hrbjczsfs.com
tourphuquocnguyenhien.com
mxprographics.com
themetaphysicalmaster.net
directorystar.asia
thehomeofdiamonds.com
riqinxin.com
covicio.com
sciineurope.com
womensportclothes.com
celestialchimes.net
lotsmen.com
hi-rescloud.net
lewisnathaniel.com
ageonward.com
eyetownglasses.com
bingent.info
matildealvaradovera.com
otorrinonews.com
cdeg898.com
lexingtoncoorgresort.com
minidachshundpups.com
tools365-shop.com
romancingtheeras.com
residentmining.com
aquaflowsprinklers.com
crackapks.com
caffeinatedeverafter.com
sureyyapasa.net
strawberryhearts.com
ptgo.net
devyshkam.com
thethrottletherapy.com
givelyrics.com
signaturepsinc.com
mersinsudunyasi.com
fivedayskitchen.com
fefebeauty.com
long0001.com
hmm40.com
claracarbon.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1256-2-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1256-3-0x000000000041D0E0-mapping.dmp xloader behavioral1/memory/1672-5-0x0000000000000000-mapping.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 536 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Scan Document 01.exeScan Document 01.exechkdsk.exedescription pid process target process PID 1944 set thread context of 1256 1944 Scan Document 01.exe Scan Document 01.exe PID 1256 set thread context of 1236 1256 Scan Document 01.exe Explorer.EXE PID 1672 set thread context of 1236 1672 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
Scan Document 01.exechkdsk.exepid process 1256 Scan Document 01.exe 1256 Scan Document 01.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe 1672 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Scan Document 01.exeScan Document 01.exechkdsk.exepid process 1944 Scan Document 01.exe 1256 Scan Document 01.exe 1256 Scan Document 01.exe 1256 Scan Document 01.exe 1672 chkdsk.exe 1672 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Scan Document 01.exechkdsk.exedescription pid process Token: SeDebugPrivilege 1256 Scan Document 01.exe Token: SeDebugPrivilege 1672 chkdsk.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Scan Document 01.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1944 wrote to memory of 1256 1944 Scan Document 01.exe Scan Document 01.exe PID 1944 wrote to memory of 1256 1944 Scan Document 01.exe Scan Document 01.exe PID 1944 wrote to memory of 1256 1944 Scan Document 01.exe Scan Document 01.exe PID 1944 wrote to memory of 1256 1944 Scan Document 01.exe Scan Document 01.exe PID 1944 wrote to memory of 1256 1944 Scan Document 01.exe Scan Document 01.exe PID 1236 wrote to memory of 1672 1236 Explorer.EXE chkdsk.exe PID 1236 wrote to memory of 1672 1236 Explorer.EXE chkdsk.exe PID 1236 wrote to memory of 1672 1236 Explorer.EXE chkdsk.exe PID 1236 wrote to memory of 1672 1236 Explorer.EXE chkdsk.exe PID 1672 wrote to memory of 536 1672 chkdsk.exe cmd.exe PID 1672 wrote to memory of 536 1672 chkdsk.exe cmd.exe PID 1672 wrote to memory of 536 1672 chkdsk.exe cmd.exe PID 1672 wrote to memory of 536 1672 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/536-7-0x0000000000000000-mapping.dmp
-
memory/1256-2-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1256-3-0x000000000041D0E0-mapping.dmp
-
memory/1672-5-0x0000000000000000-mapping.dmp
-
memory/1672-6-0x0000000000310000-0x0000000000317000-memory.dmpFilesize
28KB
-
memory/1672-8-0x00000000041C0000-0x00000000042A4000-memory.dmpFilesize
912KB