Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:33
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order_80976678_pdf.exe
Resource
win7v20201028
General
-
Target
Purchase Order_80976678_pdf.exe
-
Size
351KB
-
MD5
a709f543a19335dd25778eb0dfe66cb4
-
SHA1
16f5f3c6cdefa863184ee9081a32af736e07eefa
-
SHA256
f45429329da30ae0032b202f9e9165b0a6b3bba97389590026c17b8c71f03f11
-
SHA512
3cde3c37daa1a347ec0d76acfe6bd1537c5c32963446e8bddef8ceca79cbe12af36a0b77baf89785b246cdd88bcbba5e3c9ce9d4f1f1a1df19a3a77f4a6587b3
Malware Config
Extracted
formbook
http://www.chuanxingtong.com/j5an/
xwwgj.com
release-paypal.com
investorshighway.com
maglex.info
chenangopistolpermit.com
thebihareye.com
sanjosemasks.com
foremanmotors.com
stadtstreicherin.com
9247pf.com
erenvincplatform.xyz
cushcaps.com
flatisteam.com
kojyouibennto.com
rahmatsuparman.com
vallyfades.online
metropitstop.com
shopasha.com
windycitycreditsolutions.com
uproxysite.com
californiabilling.com
theexgirlfriendpics.com
arnoldnaturalresources.com
gfeets.com
streamelemeants.com
academiadacocriacao.com
nselife.com
maratinsaat.info
deviurg.com
mrbalumba.com
joyfinancialservices.com
retriever-home.com
paydayonlineloanapplication.com
dchasers.net
mct.ltd
geisshaven.com
mdejgqbp.icu
mercifulhandshc.com
bmtxm.com
aulbalu.com
globuswarming.com
wolfpacktowingrecovery.com
empireofconsciousness.com
yosyoshop.com
l7zexitam.xyz
lendtitle.com
charmedlifeinteriors.com
aimtopshop.com
teramareprime.com
muenker.world
just-embrace.com
amazon-co-jp.world
fsjinhua.net
lungi.cloud
mysinglecam.com
hortenserolland.com
grouptripinsurance.com
aspiringeyephotos.com
shoesiin.com
oodi.club
shakhriyarmamedyarov.com
musiklotteriet.com
germanystablecoin.com
land-il.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1176-3-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/848-10-0x0000000000070000-0x0000000000099000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1768 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order_80976678_pdf.exePurchase Order_80976678_pdf.execscript.exedescription pid process target process PID 1872 set thread context of 1176 1872 Purchase Order_80976678_pdf.exe Purchase Order_80976678_pdf.exe PID 1176 set thread context of 1220 1176 Purchase Order_80976678_pdf.exe Explorer.EXE PID 848 set thread context of 1220 848 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
Purchase Order_80976678_pdf.execscript.exepid process 1176 Purchase Order_80976678_pdf.exe 1176 Purchase Order_80976678_pdf.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe 848 cscript.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Purchase Order_80976678_pdf.exePurchase Order_80976678_pdf.execscript.exepid process 1872 Purchase Order_80976678_pdf.exe 1176 Purchase Order_80976678_pdf.exe 1176 Purchase Order_80976678_pdf.exe 1176 Purchase Order_80976678_pdf.exe 848 cscript.exe 848 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Purchase Order_80976678_pdf.execscript.exedescription pid process Token: SeDebugPrivilege 1176 Purchase Order_80976678_pdf.exe Token: SeDebugPrivilege 848 cscript.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Purchase Order_80976678_pdf.exeExplorer.EXEcscript.exedescription pid process target process PID 1872 wrote to memory of 1176 1872 Purchase Order_80976678_pdf.exe Purchase Order_80976678_pdf.exe PID 1872 wrote to memory of 1176 1872 Purchase Order_80976678_pdf.exe Purchase Order_80976678_pdf.exe PID 1872 wrote to memory of 1176 1872 Purchase Order_80976678_pdf.exe Purchase Order_80976678_pdf.exe PID 1872 wrote to memory of 1176 1872 Purchase Order_80976678_pdf.exe Purchase Order_80976678_pdf.exe PID 1872 wrote to memory of 1176 1872 Purchase Order_80976678_pdf.exe Purchase Order_80976678_pdf.exe PID 1220 wrote to memory of 848 1220 Explorer.EXE cscript.exe PID 1220 wrote to memory of 848 1220 Explorer.EXE cscript.exe PID 1220 wrote to memory of 848 1220 Explorer.EXE cscript.exe PID 1220 wrote to memory of 848 1220 Explorer.EXE cscript.exe PID 848 wrote to memory of 1768 848 cscript.exe cmd.exe PID 848 wrote to memory of 1768 848 cscript.exe cmd.exe PID 848 wrote to memory of 1768 848 cscript.exe cmd.exe PID 848 wrote to memory of 1768 848 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order_80976678_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_80976678_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order_80976678_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_80976678_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order_80976678_pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/848-7-0x0000000000000000-mapping.dmp
-
memory/848-10-0x0000000000070000-0x0000000000099000-memory.dmpFilesize
164KB
-
memory/848-9-0x0000000000E40000-0x0000000000E62000-memory.dmpFilesize
136KB
-
memory/848-11-0x0000000000A70000-0x0000000000D73000-memory.dmpFilesize
3.0MB
-
memory/848-12-0x0000000000990000-0x0000000000A20000-memory.dmpFilesize
576KB
-
memory/1176-2-0x000000000041D070-mapping.dmp
-
memory/1176-4-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/1176-3-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1176-5-0x0000000000130000-0x0000000000141000-memory.dmpFilesize
68KB
-
memory/1220-6-0x00000000077A0000-0x0000000007934000-memory.dmpFilesize
1.6MB
-
memory/1220-13-0x00000000094A0000-0x0000000009602000-memory.dmpFilesize
1.4MB
-
memory/1768-8-0x0000000000000000-mapping.dmp