Analysis
-
max time kernel
151s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-01-2021 18:15
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Documents PL&BL Draft.scr
Resource
win7v20201028
General
-
Target
Shipping Documents PL&BL Draft.scr
-
Size
449KB
-
MD5
683ec5541b3901533bf82d5df00dcde2
-
SHA1
c3dc36ffb0efaf7aad512b8a82c43678b7314f38
-
SHA256
040e512b75bacd0ed6e0e13efa13f6ea92ebd47c214112b5371425009909c842
-
SHA512
f17861a053bb7646911aa3b9b67b5918c6cefd09a91e28cb11fd2a6d549f4e279ca345403e0e32f9ed6a3b15c29fb2a25a885b4bb845d42c8b8dbfad47165134
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
thefinleyshow.com
basalmeals.com
esurpluss.com
hrbjczsfs.com
tourphuquocnguyenhien.com
mxprographics.com
themetaphysicalmaster.net
directorystar.asia
thehomeofdiamonds.com
riqinxin.com
covicio.com
sciineurope.com
womensportclothes.com
celestialchimes.net
lotsmen.com
hi-rescloud.net
lewisnathaniel.com
ageonward.com
eyetownglasses.com
bingent.info
matildealvaradovera.com
otorrinonews.com
cdeg898.com
lexingtoncoorgresort.com
minidachshundpups.com
tools365-shop.com
romancingtheeras.com
residentmining.com
aquaflowsprinklers.com
crackapks.com
caffeinatedeverafter.com
sureyyapasa.net
strawberryhearts.com
ptgo.net
devyshkam.com
thethrottletherapy.com
givelyrics.com
signaturepsinc.com
mersinsudunyasi.com
fivedayskitchen.com
fefebeauty.com
long0001.com
hmm40.com
claracarbon.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1280-4-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1932-10-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1528 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipping Documents PL&BL Draft.scrShipping Documents PL&BL Draft.scrwuapp.exedescription pid process target process PID 1096 set thread context of 1280 1096 Shipping Documents PL&BL Draft.scr Shipping Documents PL&BL Draft.scr PID 1280 set thread context of 1356 1280 Shipping Documents PL&BL Draft.scr Explorer.EXE PID 1932 set thread context of 1356 1932 wuapp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
Shipping Documents PL&BL Draft.scrwuapp.exepid process 1280 Shipping Documents PL&BL Draft.scr 1280 Shipping Documents PL&BL Draft.scr 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe 1932 wuapp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1356 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Shipping Documents PL&BL Draft.scrShipping Documents PL&BL Draft.scrwuapp.exepid process 1096 Shipping Documents PL&BL Draft.scr 1280 Shipping Documents PL&BL Draft.scr 1280 Shipping Documents PL&BL Draft.scr 1280 Shipping Documents PL&BL Draft.scr 1932 wuapp.exe 1932 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
Shipping Documents PL&BL Draft.scrwuapp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1280 Shipping Documents PL&BL Draft.scr Token: SeDebugPrivilege 1932 wuapp.exe Token: SeShutdownPrivilege 1356 Explorer.EXE Token: SeShutdownPrivilege 1356 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1356 Explorer.EXE 1356 Explorer.EXE 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1356 Explorer.EXE 1356 Explorer.EXE 1356 Explorer.EXE 1356 Explorer.EXE -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Shipping Documents PL&BL Draft.scrExplorer.EXEwuapp.exedescription pid process target process PID 1096 wrote to memory of 1280 1096 Shipping Documents PL&BL Draft.scr Shipping Documents PL&BL Draft.scr PID 1096 wrote to memory of 1280 1096 Shipping Documents PL&BL Draft.scr Shipping Documents PL&BL Draft.scr PID 1096 wrote to memory of 1280 1096 Shipping Documents PL&BL Draft.scr Shipping Documents PL&BL Draft.scr PID 1096 wrote to memory of 1280 1096 Shipping Documents PL&BL Draft.scr Shipping Documents PL&BL Draft.scr PID 1096 wrote to memory of 1280 1096 Shipping Documents PL&BL Draft.scr Shipping Documents PL&BL Draft.scr PID 1356 wrote to memory of 1932 1356 Explorer.EXE wuapp.exe PID 1356 wrote to memory of 1932 1356 Explorer.EXE wuapp.exe PID 1356 wrote to memory of 1932 1356 Explorer.EXE wuapp.exe PID 1356 wrote to memory of 1932 1356 Explorer.EXE wuapp.exe PID 1356 wrote to memory of 1932 1356 Explorer.EXE wuapp.exe PID 1356 wrote to memory of 1932 1356 Explorer.EXE wuapp.exe PID 1356 wrote to memory of 1932 1356 Explorer.EXE wuapp.exe PID 1932 wrote to memory of 1528 1932 wuapp.exe cmd.exe PID 1932 wrote to memory of 1528 1932 wuapp.exe cmd.exe PID 1932 wrote to memory of 1528 1932 wuapp.exe cmd.exe PID 1932 wrote to memory of 1528 1932 wuapp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr"C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr" /S2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr"C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr" /S3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Documents PL&BL Draft.scr"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-2-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/1280-3-0x000000000041D0E0-mapping.dmp
-
memory/1280-4-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1280-5-0x0000000000160000-0x0000000000170000-memory.dmpFilesize
64KB
-
memory/1280-7-0x0000000000950000-0x0000000000C53000-memory.dmpFilesize
3.0MB
-
memory/1356-6-0x0000000004290000-0x0000000004389000-memory.dmpFilesize
996KB
-
memory/1356-14-0x0000000006AB0000-0x0000000006BE8000-memory.dmpFilesize
1.2MB
-
memory/1528-12-0x0000000000000000-mapping.dmp
-
memory/1932-8-0x0000000000000000-mapping.dmp
-
memory/1932-11-0x0000000002270000-0x0000000002573000-memory.dmpFilesize
3.0MB
-
memory/1932-10-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/1932-13-0x0000000000890000-0x000000000091F000-memory.dmpFilesize
572KB
-
memory/1932-9-0x0000000000E60000-0x0000000000E6B000-memory.dmpFilesize
44KB