Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-01-2021 09:43
Static task
static1
Behavioral task
behavioral1
Sample
Consignment Details&BL Draft.exe
Resource
win7v20201028
General
-
Target
Consignment Details&BL Draft.exe
-
Size
663KB
-
MD5
bbcdacdde22b8bab6d71f543c36c9b2f
-
SHA1
f4752b9407c50396ca6ca1fef1a50827eb5cbc10
-
SHA256
6fbc3e54a04aeadf268907b5041bdaf5af8980d76eafce3bc5d995c0fa779fd8
-
SHA512
37c504b110e85656398ca91c4ed67e2854252b5402ca1b60cd8a24fa38c4e67c9346a8b4dc14005a44cdab708488bfe8b58f52e36449a4467de928591cbc6919
Malware Config
Extracted
formbook
http://www.mwavpn.com/9bwn/
italiancoastal.com
shareandfit.com
ibexacademia.com
guejek.com
vitalbizdev.com
connemaracomputers.com
surf-livre.com
styleforwoman.com
costcopaysecure.com
kingdomandqueendom.com
www-societegenerale.com
radiokerbfm.com
marylandstars.net
thechampionsday.com
beertenderb95.com
iybbshop.com
maglex.info
vh3g.asia
zaairobot.online
ryderhydros.com
gamedaigia.pro
online-termin-vereinbarung.info
essential-nature.com
parkwoodmeadowsseniorliving.com
lastenmedia.net
yaprs.com
redpinepainting.com
glensideautosales.net
gicirmotor.com
goblissyourself.com
depotresort.com
survivalrunfotografen.com
natursteinteppiche.com
hungr.website
njcantonpalece.com
huellatinta.com
solbesiktning.com
finanka.website
cleanworkstations.com
thedivinegifts.com
thefinalverdict.net
amsco-ems.com
bloomsfromtheheart.com
elgantlamps.com
theofficialcookiejar.com
maucay.com
domains4me.net
takedaitos.com
tmlforums.com
electricdrumadvisor.com
pottydiaper.com
yup.network
anchorconcretesolutions.com
eroerolibrary.com
hammocksrehab.com
naya-bazar.com
metamorphosiswei.com
indravision.net
libreriapapeleriacaniles.com
jims-info.com
teenporncup.com
yoshinaga-dentalclinic.com
mygreatordinarylife.com
sallanvarkki.net
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2704-3-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3308-9-0x0000000000C30000-0x0000000000C58000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Consignment Details&BL Draft.exeConsignment Details&BL Draft.exeipconfig.exedescription pid process target process PID 648 set thread context of 2704 648 Consignment Details&BL Draft.exe Consignment Details&BL Draft.exe PID 2704 set thread context of 2968 2704 Consignment Details&BL Draft.exe Explorer.EXE PID 3308 set thread context of 2968 3308 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 3308 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Consignment Details&BL Draft.exeipconfig.exepid process 2704 Consignment Details&BL Draft.exe 2704 Consignment Details&BL Draft.exe 2704 Consignment Details&BL Draft.exe 2704 Consignment Details&BL Draft.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe 3308 ipconfig.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Consignment Details&BL Draft.exeConsignment Details&BL Draft.exeipconfig.exepid process 648 Consignment Details&BL Draft.exe 2704 Consignment Details&BL Draft.exe 2704 Consignment Details&BL Draft.exe 2704 Consignment Details&BL Draft.exe 3308 ipconfig.exe 3308 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Consignment Details&BL Draft.exeipconfig.exedescription pid process Token: SeDebugPrivilege 2704 Consignment Details&BL Draft.exe Token: SeDebugPrivilege 3308 ipconfig.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2968 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Consignment Details&BL Draft.exeExplorer.EXEipconfig.exedescription pid process target process PID 648 wrote to memory of 2704 648 Consignment Details&BL Draft.exe Consignment Details&BL Draft.exe PID 648 wrote to memory of 2704 648 Consignment Details&BL Draft.exe Consignment Details&BL Draft.exe PID 648 wrote to memory of 2704 648 Consignment Details&BL Draft.exe Consignment Details&BL Draft.exe PID 648 wrote to memory of 2704 648 Consignment Details&BL Draft.exe Consignment Details&BL Draft.exe PID 2968 wrote to memory of 3308 2968 Explorer.EXE ipconfig.exe PID 2968 wrote to memory of 3308 2968 Explorer.EXE ipconfig.exe PID 2968 wrote to memory of 3308 2968 Explorer.EXE ipconfig.exe PID 3308 wrote to memory of 2920 3308 ipconfig.exe cmd.exe PID 3308 wrote to memory of 2920 3308 ipconfig.exe cmd.exe PID 3308 wrote to memory of 2920 3308 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details&BL Draft.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Consignment Details&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Details&BL Draft.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Consignment Details&BL Draft.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2704-2-0x000000000041D050-mapping.dmp
-
memory/2704-4-0x0000000001110000-0x0000000001430000-memory.dmpFilesize
3.1MB
-
memory/2704-3-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2704-5-0x0000000000B10000-0x0000000000B20000-memory.dmpFilesize
64KB
-
memory/2920-10-0x0000000000000000-mapping.dmp
-
memory/2968-6-0x0000000004CB0000-0x0000000004D98000-memory.dmpFilesize
928KB
-
memory/2968-13-0x0000000004DA0000-0x0000000004EF1000-memory.dmpFilesize
1.3MB
-
memory/3308-7-0x0000000000000000-mapping.dmp
-
memory/3308-9-0x0000000000C30000-0x0000000000C58000-memory.dmpFilesize
160KB
-
memory/3308-8-0x0000000000D30000-0x0000000000D3B000-memory.dmpFilesize
44KB
-
memory/3308-11-0x0000000003430000-0x0000000003750000-memory.dmpFilesize
3.1MB
-
memory/3308-12-0x00000000032B0000-0x000000000333F000-memory.dmpFilesize
572KB