Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 15:52
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Document PL&BL Draft.exe
Resource
win7v20201028
General
-
Target
Shipping Document PL&BL Draft.exe
-
Size
329KB
-
MD5
9a35a8f3f77ce5b039c3a8c2763270cd
-
SHA1
b72765fb0cc02184cfe77401addef4305315e50c
-
SHA256
58b012a7c77564704af9bc88d272f1aa68c6789c84a146d0f566304c370bc89a
-
SHA512
91897cdbeda39e71b588ca38a22c58fecbbb95d791886df668f57a5f31db0d9fe0e9c610a5a4b2817df1bbe69c43639ba376402d898fc6125866efe654643b99
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
thefinleyshow.com
basalmeals.com
esurpluss.com
hrbjczsfs.com
tourphuquocnguyenhien.com
mxprographics.com
themetaphysicalmaster.net
directorystar.asia
thehomeofdiamonds.com
riqinxin.com
covicio.com
sciineurope.com
womensportclothes.com
celestialchimes.net
lotsmen.com
hi-rescloud.net
lewisnathaniel.com
ageonward.com
eyetownglasses.com
bingent.info
matildealvaradovera.com
otorrinonews.com
cdeg898.com
lexingtoncoorgresort.com
minidachshundpups.com
tools365-shop.com
romancingtheeras.com
residentmining.com
aquaflowsprinklers.com
crackapks.com
caffeinatedeverafter.com
sureyyapasa.net
strawberryhearts.com
ptgo.net
devyshkam.com
thethrottletherapy.com
givelyrics.com
signaturepsinc.com
mersinsudunyasi.com
fivedayskitchen.com
fefebeauty.com
long0001.com
hmm40.com
claracarbon.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1540-4-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1540-5-0x000000000041D0E0-mapping.dmp xloader behavioral1/memory/640-8-0x0000000000000000-mapping.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 584 cmd.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Shipping Document PL&BL Draft.exeShipping Document PL&BL Draft.execolorcpl.exedescription pid process target process PID 1972 set thread context of 1540 1972 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 1540 set thread context of 1388 1540 Shipping Document PL&BL Draft.exe Explorer.EXE PID 1540 set thread context of 1388 1540 Shipping Document PL&BL Draft.exe Explorer.EXE PID 640 set thread context of 1388 640 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Shipping Document PL&BL Draft.execolorcpl.exepid process 1540 Shipping Document PL&BL Draft.exe 1540 Shipping Document PL&BL Draft.exe 1540 Shipping Document PL&BL Draft.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe 640 colorcpl.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Shipping Document PL&BL Draft.exeShipping Document PL&BL Draft.execolorcpl.exepid process 1972 Shipping Document PL&BL Draft.exe 1540 Shipping Document PL&BL Draft.exe 1540 Shipping Document PL&BL Draft.exe 1540 Shipping Document PL&BL Draft.exe 1540 Shipping Document PL&BL Draft.exe 640 colorcpl.exe 640 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Shipping Document PL&BL Draft.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1540 Shipping Document PL&BL Draft.exe Token: SeDebugPrivilege 640 colorcpl.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1388 Explorer.EXE 1388 Explorer.EXE 1388 Explorer.EXE 1388 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1388 Explorer.EXE 1388 Explorer.EXE 1388 Explorer.EXE 1388 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Shipping Document PL&BL Draft.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1972 wrote to memory of 1476 1972 Shipping Document PL&BL Draft.exe cmd.exe PID 1972 wrote to memory of 1476 1972 Shipping Document PL&BL Draft.exe cmd.exe PID 1972 wrote to memory of 1476 1972 Shipping Document PL&BL Draft.exe cmd.exe PID 1972 wrote to memory of 1476 1972 Shipping Document PL&BL Draft.exe cmd.exe PID 1972 wrote to memory of 1496 1972 Shipping Document PL&BL Draft.exe cmd.exe PID 1972 wrote to memory of 1496 1972 Shipping Document PL&BL Draft.exe cmd.exe PID 1972 wrote to memory of 1496 1972 Shipping Document PL&BL Draft.exe cmd.exe PID 1972 wrote to memory of 1496 1972 Shipping Document PL&BL Draft.exe cmd.exe PID 1972 wrote to memory of 1540 1972 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 1972 wrote to memory of 1540 1972 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 1972 wrote to memory of 1540 1972 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 1972 wrote to memory of 1540 1972 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 1972 wrote to memory of 1540 1972 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 1388 wrote to memory of 640 1388 Explorer.EXE colorcpl.exe PID 1388 wrote to memory of 640 1388 Explorer.EXE colorcpl.exe PID 1388 wrote to memory of 640 1388 Explorer.EXE colorcpl.exe PID 1388 wrote to memory of 640 1388 Explorer.EXE colorcpl.exe PID 640 wrote to memory of 584 640 colorcpl.exe cmd.exe PID 640 wrote to memory of 584 640 colorcpl.exe cmd.exe PID 640 wrote to memory of 584 640 colorcpl.exe cmd.exe PID 640 wrote to memory of 584 640 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/584-10-0x0000000000000000-mapping.dmp
-
memory/640-8-0x0000000000000000-mapping.dmp
-
memory/640-9-0x0000000000E60000-0x0000000000E78000-memory.dmpFilesize
96KB
-
memory/640-11-0x00000000042E0000-0x00000000043D7000-memory.dmpFilesize
988KB
-
memory/1388-7-0x0000000006D40000-0x0000000006E83000-memory.dmpFilesize
1.3MB
-
memory/1476-2-0x0000000000000000-mapping.dmp
-
memory/1496-3-0x0000000000000000-mapping.dmp
-
memory/1540-4-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1540-5-0x000000000041D0E0-mapping.dmp