Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:33
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order_80976678_pdf.exe
Resource
win7v20201028
General
-
Target
Purchase Order_80976678_pdf.exe
-
Size
351KB
-
MD5
a709f543a19335dd25778eb0dfe66cb4
-
SHA1
16f5f3c6cdefa863184ee9081a32af736e07eefa
-
SHA256
f45429329da30ae0032b202f9e9165b0a6b3bba97389590026c17b8c71f03f11
-
SHA512
3cde3c37daa1a347ec0d76acfe6bd1537c5c32963446e8bddef8ceca79cbe12af36a0b77baf89785b246cdd88bcbba5e3c9ce9d4f1f1a1df19a3a77f4a6587b3
Malware Config
Extracted
formbook
http://www.chuanxingtong.com/j5an/
xwwgj.com
release-paypal.com
investorshighway.com
maglex.info
chenangopistolpermit.com
thebihareye.com
sanjosemasks.com
foremanmotors.com
stadtstreicherin.com
9247pf.com
erenvincplatform.xyz
cushcaps.com
flatisteam.com
kojyouibennto.com
rahmatsuparman.com
vallyfades.online
metropitstop.com
shopasha.com
windycitycreditsolutions.com
uproxysite.com
californiabilling.com
theexgirlfriendpics.com
arnoldnaturalresources.com
gfeets.com
streamelemeants.com
academiadacocriacao.com
nselife.com
maratinsaat.info
deviurg.com
mrbalumba.com
joyfinancialservices.com
retriever-home.com
paydayonlineloanapplication.com
dchasers.net
mct.ltd
geisshaven.com
mdejgqbp.icu
mercifulhandshc.com
bmtxm.com
aulbalu.com
globuswarming.com
wolfpacktowingrecovery.com
empireofconsciousness.com
yosyoshop.com
l7zexitam.xyz
lendtitle.com
charmedlifeinteriors.com
aimtopshop.com
teramareprime.com
muenker.world
just-embrace.com
amazon-co-jp.world
fsjinhua.net
lungi.cloud
mysinglecam.com
hortenserolland.com
grouptripinsurance.com
aspiringeyephotos.com
shoesiin.com
oodi.club
shakhriyarmamedyarov.com
musiklotteriet.com
germanystablecoin.com
land-il.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/768-8-0x0000000002AE0000-0x0000000002B09000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order_80976678_pdf.exePurchase Order_80976678_pdf.exeNETSTAT.EXEdescription pid process target process PID 4776 set thread context of 2096 4776 Purchase Order_80976678_pdf.exe Purchase Order_80976678_pdf.exe PID 2096 set thread context of 2576 2096 Purchase Order_80976678_pdf.exe Explorer.EXE PID 768 set thread context of 2576 768 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 768 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Purchase Order_80976678_pdf.exeNETSTAT.EXEpid process 2096 Purchase Order_80976678_pdf.exe 2096 Purchase Order_80976678_pdf.exe 2096 Purchase Order_80976678_pdf.exe 2096 Purchase Order_80976678_pdf.exe 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE 768 NETSTAT.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Purchase Order_80976678_pdf.exePurchase Order_80976678_pdf.exeNETSTAT.EXEpid process 4776 Purchase Order_80976678_pdf.exe 4776 Purchase Order_80976678_pdf.exe 2096 Purchase Order_80976678_pdf.exe 2096 Purchase Order_80976678_pdf.exe 2096 Purchase Order_80976678_pdf.exe 768 NETSTAT.EXE 768 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
Purchase Order_80976678_pdf.exeExplorer.EXENETSTAT.EXEdescription pid process Token: SeDebugPrivilege 2096 Purchase Order_80976678_pdf.exe Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeShutdownPrivilege 2576 Explorer.EXE Token: SeCreatePagefilePrivilege 2576 Explorer.EXE Token: SeDebugPrivilege 768 NETSTAT.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2576 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Purchase Order_80976678_pdf.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 4776 wrote to memory of 2096 4776 Purchase Order_80976678_pdf.exe Purchase Order_80976678_pdf.exe PID 4776 wrote to memory of 2096 4776 Purchase Order_80976678_pdf.exe Purchase Order_80976678_pdf.exe PID 4776 wrote to memory of 2096 4776 Purchase Order_80976678_pdf.exe Purchase Order_80976678_pdf.exe PID 4776 wrote to memory of 2096 4776 Purchase Order_80976678_pdf.exe Purchase Order_80976678_pdf.exe PID 2576 wrote to memory of 768 2576 Explorer.EXE NETSTAT.EXE PID 2576 wrote to memory of 768 2576 Explorer.EXE NETSTAT.EXE PID 2576 wrote to memory of 768 2576 Explorer.EXE NETSTAT.EXE PID 768 wrote to memory of 3096 768 NETSTAT.EXE cmd.exe PID 768 wrote to memory of 3096 768 NETSTAT.EXE cmd.exe PID 768 wrote to memory of 3096 768 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order_80976678_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_80976678_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order_80976678_pdf.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order_80976678_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order_80976678_pdf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/768-6-0x0000000000000000-mapping.dmp
-
memory/768-8-0x0000000002AE0000-0x0000000002B09000-memory.dmpFilesize
164KB
-
memory/768-7-0x0000000000A70000-0x0000000000A7B000-memory.dmpFilesize
44KB
-
memory/768-9-0x00000000035B0000-0x00000000038D0000-memory.dmpFilesize
3.1MB
-
memory/768-12-0x0000000003270000-0x0000000003300000-memory.dmpFilesize
576KB
-
memory/2096-2-0x00000000005DD070-mapping.dmp
-
memory/2096-3-0x0000000000FF0000-0x0000000001310000-memory.dmpFilesize
3.1MB
-
memory/2096-4-0x0000000000ED0000-0x0000000000EE1000-memory.dmpFilesize
68KB
-
memory/2576-5-0x0000000004CE0000-0x0000000004DB6000-memory.dmpFilesize
856KB
-
memory/2576-13-0x0000000004E00000-0x0000000004F2E000-memory.dmpFilesize
1.2MB
-
memory/3096-10-0x0000000000000000-mapping.dmp