Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 15:52
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Document PL&BL Draft.exe
Resource
win7v20201028
General
-
Target
Shipping Document PL&BL Draft.exe
-
Size
329KB
-
MD5
9a35a8f3f77ce5b039c3a8c2763270cd
-
SHA1
b72765fb0cc02184cfe77401addef4305315e50c
-
SHA256
58b012a7c77564704af9bc88d272f1aa68c6789c84a146d0f566304c370bc89a
-
SHA512
91897cdbeda39e71b588ca38a22c58fecbbb95d791886df668f57a5f31db0d9fe0e9c610a5a4b2817df1bbe69c43639ba376402d898fc6125866efe654643b99
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
thefinleyshow.com
basalmeals.com
esurpluss.com
hrbjczsfs.com
tourphuquocnguyenhien.com
mxprographics.com
themetaphysicalmaster.net
directorystar.asia
thehomeofdiamonds.com
riqinxin.com
covicio.com
sciineurope.com
womensportclothes.com
celestialchimes.net
lotsmen.com
hi-rescloud.net
lewisnathaniel.com
ageonward.com
eyetownglasses.com
bingent.info
matildealvaradovera.com
otorrinonews.com
cdeg898.com
lexingtoncoorgresort.com
minidachshundpups.com
tools365-shop.com
romancingtheeras.com
residentmining.com
aquaflowsprinklers.com
crackapks.com
caffeinatedeverafter.com
sureyyapasa.net
strawberryhearts.com
ptgo.net
devyshkam.com
thethrottletherapy.com
givelyrics.com
signaturepsinc.com
mersinsudunyasi.com
fivedayskitchen.com
fefebeauty.com
long0001.com
hmm40.com
claracarbon.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3596-4-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3596-5-0x000000000041D0E0-mapping.dmp xloader behavioral2/memory/3768-8-0x0000000000000000-mapping.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipping Document PL&BL Draft.exeShipping Document PL&BL Draft.exechkdsk.exedescription pid process target process PID 580 set thread context of 3596 580 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 3596 set thread context of 3040 3596 Shipping Document PL&BL Draft.exe Explorer.EXE PID 3768 set thread context of 3040 3768 chkdsk.exe Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Shipping Document PL&BL Draft.exechkdsk.exepid process 3596 Shipping Document PL&BL Draft.exe 3596 Shipping Document PL&BL Draft.exe 3596 Shipping Document PL&BL Draft.exe 3596 Shipping Document PL&BL Draft.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe 3768 chkdsk.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Shipping Document PL&BL Draft.exeShipping Document PL&BL Draft.exechkdsk.exepid process 580 Shipping Document PL&BL Draft.exe 3596 Shipping Document PL&BL Draft.exe 3596 Shipping Document PL&BL Draft.exe 3596 Shipping Document PL&BL Draft.exe 3768 chkdsk.exe 3768 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
Shipping Document PL&BL Draft.exeExplorer.EXEchkdsk.exedescription pid process Token: SeDebugPrivilege 3596 Shipping Document PL&BL Draft.exe Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeDebugPrivilege 3768 chkdsk.exe Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Shipping Document PL&BL Draft.exeExplorer.EXEchkdsk.exedescription pid process target process PID 580 wrote to memory of 3924 580 Shipping Document PL&BL Draft.exe cmd.exe PID 580 wrote to memory of 3924 580 Shipping Document PL&BL Draft.exe cmd.exe PID 580 wrote to memory of 3924 580 Shipping Document PL&BL Draft.exe cmd.exe PID 580 wrote to memory of 736 580 Shipping Document PL&BL Draft.exe cmd.exe PID 580 wrote to memory of 736 580 Shipping Document PL&BL Draft.exe cmd.exe PID 580 wrote to memory of 736 580 Shipping Document PL&BL Draft.exe cmd.exe PID 580 wrote to memory of 3596 580 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 580 wrote to memory of 3596 580 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 580 wrote to memory of 3596 580 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 580 wrote to memory of 3596 580 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 3040 wrote to memory of 3768 3040 Explorer.EXE chkdsk.exe PID 3040 wrote to memory of 3768 3040 Explorer.EXE chkdsk.exe PID 3040 wrote to memory of 3768 3040 Explorer.EXE chkdsk.exe PID 3768 wrote to memory of 2316 3768 chkdsk.exe cmd.exe PID 3768 wrote to memory of 2316 3768 chkdsk.exe cmd.exe PID 3768 wrote to memory of 2316 3768 chkdsk.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c cls3⤵
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/736-3-0x0000000000000000-mapping.dmp
-
memory/2316-11-0x0000000000000000-mapping.dmp
-
memory/3596-4-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3596-5-0x000000000041D0E0-mapping.dmp
-
memory/3768-8-0x0000000000000000-mapping.dmp
-
memory/3768-9-0x00000000002E0000-0x00000000002EA000-memory.dmpFilesize
40KB
-
memory/3768-10-0x00000000002E0000-0x00000000002EA000-memory.dmpFilesize
40KB
-
memory/3768-12-0x0000000006EF0000-0x000000000706E000-memory.dmpFilesize
1.5MB
-
memory/3924-2-0x0000000000000000-mapping.dmp