Analysis
- max time kernel
147s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
18/01/2021, 09:44
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order_pdf.exe
Resource
win7v20201028
windows7_x64
General
- Target Purchase Order_pdf.exe
- Size 519KB
- Sample210118-3s18le8btx
- SHA256 f73c1a2549b119a5de3964cdcbbdbefbaca205e1f149b4d77688a92285b4d20b
- MD5 b5e5802e37b01b3aa324090e4fc0af3a
- SHA1 ad98482ee1e4c90d5ffc19b3ec4720a332f0800a
- SHA512 53fb3b2ed4552302ad3d24cf437bf8ed95a593fe2242bec5392983e64c1b602d45fca3d71033fbc0113b7fefb4a2f0d67b0d9a66bf5ada7da5c485e1ef64517b
- MD5 SHA1 SHA512
Malware Config
Extracted
-
formbook
-
http://www.chuanxingtong.com/j5an/
-
xwwgj.com
-
release-paypal.com
-
investorshighway.com
-
maglex.info
-
chenangopistolpermit.com
-
thebihareye.com
-
sanjosemasks.com
-
foremanmotors.com
-
stadtstreicherin.com
-
9247pf.com
-
erenvincplatform.xyz
-
cushcaps.com
-
flatisteam.com
-
kojyouibennto.com
-
rahmatsuparman.com
-
vallyfades.online
-
metropitstop.com
-
shopasha.com
-
windycitycreditsolutions.com
-
uproxysite.com
-
californiabilling.com
-
theexgirlfriendpics.com
-
arnoldnaturalresources.com
-
gfeets.com
-
streamelemeants.com
-
academiadacocriacao.com
-
nselife.com
-
maratinsaat.info
-
deviurg.com
-
mrbalumba.com
-
joyfinancialservices.com
-
retriever-home.com
-
paydayonlineloanapplication.com
-
dchasers.net
-
mct.ltd
-
geisshaven.com
-
mdejgqbp.icu
-
mercifulhandshc.com
-
bmtxm.com
-
aulbalu.com
-
globuswarming.com
-
wolfpacktowingrecovery.com
-
empireofconsciousness.com
-
yosyoshop.com
-
l7zexitam.xyz
-
lendtitle.com
-
charmedlifeinteriors.com
-
aimtopshop.com
-
teramareprime.com
-
muenker.world
-
just-embrace.com
-
amazon-co-jp.world
-
fsjinhua.net
-
lungi.cloud
-
mysinglecam.com
-
hortenserolland.com
-
grouptripinsurance.com
-
aspiringeyephotos.com
-
shoesiin.com
-
oodi.club
-
shakhriyarmamedyarov.com
-
musiklotteriet.com
-
germanystablecoin.com
-
land-il.com
Signatures
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/724-3-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4404-10-0x0000000000E00000-0x0000000000E29000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4772 set thread context of 724 4772 Purchase Order_pdf.exe 75 PID 724 set thread context of 2576 724 Purchase Order_pdf.exe 57 PID 4404 set thread context of 2576 4404 netsh.exe 57 - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 724 Purchase Order_pdf.exe 724 Purchase Order_pdf.exe 724 Purchase Order_pdf.exe 724 Purchase Order_pdf.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe 4404 netsh.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4772 Purchase Order_pdf.exe 724 Purchase Order_pdf.exe 724 Purchase Order_pdf.exe 724 Purchase Order_pdf.exe 4404 netsh.exe 4404 netsh.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 724 Purchase Order_pdf.exe Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeDebugPrivilege 4404 netsh.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2576 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 4772 wrote to memory of 724 4772 Purchase Order_pdf.exe 75 PID 4772 wrote to memory of 724 4772 Purchase Order_pdf.exe 75 PID 4772 wrote to memory of 724 4772 Purchase Order_pdf.exe 75 PID 4772 wrote to memory of 724 4772 Purchase Order_pdf.exe 75 PID 2576 wrote to memory of 4404 2576 Explorer.EXE 76 PID 2576 wrote to memory of 4404 2576 Explorer.EXE 76 PID 2576 wrote to memory of 4404 2576 Explorer.EXE 76 PID 4404 wrote to memory of 4336 4404 netsh.exe 80 PID 4404 wrote to memory of 4336 4404 netsh.exe 80 PID 4404 wrote to memory of 4336 4404 netsh.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\Purchase Order_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:724
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order_pdf.exe"3⤵PID:4336
-
-