Analysis
-
max time kernel
151s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-01-2021 20:24
Static task
static1
Behavioral task
behavioral1
Sample
Scan Document 01.exe
Resource
win7v20201028
General
-
Target
Scan Document 01.exe
-
Size
435KB
-
MD5
47a3b1f5f7a8f5d342654a4e351d62ea
-
SHA1
e94eca6012b651847bfb4212c21c989041d1438e
-
SHA256
196b4470cd98c4f6d5c634170a1c6a98cf59b61c9b12a032ec9fb776b74a0527
-
SHA512
d4f4b0064830a0091a9ed070f9e43c0abb768d1fc4bf6d5a9589f2ce3b4a0908125264233a53119c914994474a30f628c04fbdb0361d2e8556094caebb0e303e
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
thefinleyshow.com
basalmeals.com
esurpluss.com
hrbjczsfs.com
tourphuquocnguyenhien.com
mxprographics.com
themetaphysicalmaster.net
directorystar.asia
thehomeofdiamonds.com
riqinxin.com
covicio.com
sciineurope.com
womensportclothes.com
celestialchimes.net
lotsmen.com
hi-rescloud.net
lewisnathaniel.com
ageonward.com
eyetownglasses.com
bingent.info
matildealvaradovera.com
otorrinonews.com
cdeg898.com
lexingtoncoorgresort.com
minidachshundpups.com
tools365-shop.com
romancingtheeras.com
residentmining.com
aquaflowsprinklers.com
crackapks.com
caffeinatedeverafter.com
sureyyapasa.net
strawberryhearts.com
ptgo.net
devyshkam.com
thethrottletherapy.com
givelyrics.com
signaturepsinc.com
mersinsudunyasi.com
fivedayskitchen.com
fefebeauty.com
long0001.com
hmm40.com
claracarbon.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2892-2-0x0000000000500000-0x0000000000529000-memory.dmp xloader behavioral2/memory/2892-3-0x000000000051D0E0-mapping.dmp xloader behavioral2/memory/2952-7-0x0000000000000000-mapping.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Scan Document 01.exeScan Document 01.exehelp.exedescription pid process target process PID 580 set thread context of 2892 580 Scan Document 01.exe Scan Document 01.exe PID 2892 set thread context of 3040 2892 Scan Document 01.exe Explorer.EXE PID 2952 set thread context of 3040 2952 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Scan Document 01.exehelp.exepid process 2892 Scan Document 01.exe 2892 Scan Document 01.exe 2892 Scan Document 01.exe 2892 Scan Document 01.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe 2952 help.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Scan Document 01.exeScan Document 01.exehelp.exepid process 580 Scan Document 01.exe 580 Scan Document 01.exe 2892 Scan Document 01.exe 2892 Scan Document 01.exe 2892 Scan Document 01.exe 2952 help.exe 2952 help.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
Scan Document 01.exehelp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2892 Scan Document 01.exe Token: SeDebugPrivilege 2952 help.exe Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Scan Document 01.exeExplorer.EXEhelp.exedescription pid process target process PID 580 wrote to memory of 2892 580 Scan Document 01.exe Scan Document 01.exe PID 580 wrote to memory of 2892 580 Scan Document 01.exe Scan Document 01.exe PID 580 wrote to memory of 2892 580 Scan Document 01.exe Scan Document 01.exe PID 580 wrote to memory of 2892 580 Scan Document 01.exe Scan Document 01.exe PID 3040 wrote to memory of 2952 3040 Explorer.EXE help.exe PID 3040 wrote to memory of 2952 3040 Explorer.EXE help.exe PID 3040 wrote to memory of 2952 3040 Explorer.EXE help.exe PID 2952 wrote to memory of 1928 2952 help.exe cmd.exe PID 2952 wrote to memory of 1928 2952 help.exe cmd.exe PID 2952 wrote to memory of 1928 2952 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Scan Document 01.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1928-10-0x0000000000000000-mapping.dmp
-
memory/2892-2-0x0000000000500000-0x0000000000529000-memory.dmpFilesize
164KB
-
memory/2892-3-0x000000000051D0E0-mapping.dmp
-
memory/2952-7-0x0000000000000000-mapping.dmp
-
memory/2952-8-0x0000000000800000-0x0000000000807000-memory.dmpFilesize
28KB
-
memory/2952-9-0x0000000000800000-0x0000000000807000-memory.dmpFilesize
28KB
-
memory/2952-11-0x0000000005640000-0x0000000005788000-memory.dmpFilesize
1.3MB