Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 07:32
Static task
static1
Behavioral task
behavioral1
Sample
Consignment Document PL&BL Draft.exe
Resource
win7v20201028
General
-
Target
Consignment Document PL&BL Draft.exe
-
Size
460KB
-
MD5
bf30d9af8aa63484e6fe1d73a184afd9
-
SHA1
cbc300068895405af8c9da413b7081cb0d281084
-
SHA256
c4527be43e6ad0e3eb7e8ca1bf26c120c0c5eef996716178a87bbe2b807efa57
-
SHA512
dc4bfa6810a1e9c4a33ae45088fc590b42c8ca6613d506ea5abc4b4b6bddac2165ee311d5ccd7058a4054ece2559df85e25c06f842e4e3f5f0e63322b02f3679
Malware Config
Extracted
formbook
http://www.mwavpn.com/9bwn/
italiancoastal.com
shareandfit.com
ibexacademia.com
guejek.com
vitalbizdev.com
connemaracomputers.com
surf-livre.com
styleforwoman.com
costcopaysecure.com
kingdomandqueendom.com
www-societegenerale.com
radiokerbfm.com
marylandstars.net
thechampionsday.com
beertenderb95.com
iybbshop.com
maglex.info
vh3g.asia
zaairobot.online
ryderhydros.com
gamedaigia.pro
online-termin-vereinbarung.info
essential-nature.com
parkwoodmeadowsseniorliving.com
lastenmedia.net
yaprs.com
redpinepainting.com
glensideautosales.net
gicirmotor.com
goblissyourself.com
depotresort.com
survivalrunfotografen.com
natursteinteppiche.com
hungr.website
njcantonpalece.com
huellatinta.com
solbesiktning.com
finanka.website
cleanworkstations.com
thedivinegifts.com
thefinalverdict.net
amsco-ems.com
bloomsfromtheheart.com
elgantlamps.com
theofficialcookiejar.com
maucay.com
domains4me.net
takedaitos.com
tmlforums.com
electricdrumadvisor.com
pottydiaper.com
yup.network
anchorconcretesolutions.com
eroerolibrary.com
hammocksrehab.com
naya-bazar.com
metamorphosiswei.com
indravision.net
libreriapapeleriacaniles.com
jims-info.com
teenporncup.com
yoshinaga-dentalclinic.com
mygreatordinarylife.com
sallanvarkki.net
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1836-3-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1968-10-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1064 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Consignment Document PL&BL Draft.exeConsignment Document PL&BL Draft.exewlanext.exedescription pid process target process PID 1724 set thread context of 1836 1724 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1836 set thread context of 1248 1836 Consignment Document PL&BL Draft.exe Explorer.EXE PID 1968 set thread context of 1248 1968 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
Consignment Document PL&BL Draft.exewlanext.exepid process 1836 Consignment Document PL&BL Draft.exe 1836 Consignment Document PL&BL Draft.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe 1968 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Consignment Document PL&BL Draft.exeConsignment Document PL&BL Draft.exewlanext.exepid process 1724 Consignment Document PL&BL Draft.exe 1836 Consignment Document PL&BL Draft.exe 1836 Consignment Document PL&BL Draft.exe 1836 Consignment Document PL&BL Draft.exe 1968 wlanext.exe 1968 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Consignment Document PL&BL Draft.exewlanext.exedescription pid process Token: SeDebugPrivilege 1836 Consignment Document PL&BL Draft.exe Token: SeDebugPrivilege 1968 wlanext.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
Explorer.EXEpid process 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE 1248 Explorer.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Consignment Document PL&BL Draft.exeExplorer.EXEwlanext.exedescription pid process target process PID 1724 wrote to memory of 1836 1724 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1724 wrote to memory of 1836 1724 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1724 wrote to memory of 1836 1724 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1724 wrote to memory of 1836 1724 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1724 wrote to memory of 1836 1724 Consignment Document PL&BL Draft.exe Consignment Document PL&BL Draft.exe PID 1248 wrote to memory of 1968 1248 Explorer.EXE wlanext.exe PID 1248 wrote to memory of 1968 1248 Explorer.EXE wlanext.exe PID 1248 wrote to memory of 1968 1248 Explorer.EXE wlanext.exe PID 1248 wrote to memory of 1968 1248 Explorer.EXE wlanext.exe PID 1968 wrote to memory of 1064 1968 wlanext.exe cmd.exe PID 1968 wrote to memory of 1064 1968 wlanext.exe cmd.exe PID 1968 wrote to memory of 1064 1968 wlanext.exe cmd.exe PID 1968 wrote to memory of 1064 1968 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1836 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Consignment Document PL&BL Draft.exe"3⤵
- Deletes itself
PID:1064
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1064-8-0x0000000000000000-mapping.dmp
-
memory/1248-6-0x0000000006C40000-0x0000000006DB0000-memory.dmpFilesize
1.4MB
-
memory/1248-13-0x00000000068A0000-0x00000000069B6000-memory.dmpFilesize
1.1MB
-
memory/1340-15-0x000007FEF7D90000-0x000007FEF800A000-memory.dmpFilesize
2.5MB
-
memory/1836-5-0x0000000000110000-0x0000000000120000-memory.dmpFilesize
64KB
-
memory/1836-2-0x000000000041D050-mapping.dmp
-
memory/1836-4-0x00000000008C0000-0x0000000000BC3000-memory.dmpFilesize
3.0MB
-
memory/1836-3-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1968-7-0x0000000000000000-mapping.dmp
-
memory/1968-9-0x0000000000B10000-0x0000000000B26000-memory.dmpFilesize
88KB
-
memory/1968-11-0x00000000020C0000-0x00000000023C3000-memory.dmpFilesize
3.0MB
-
memory/1968-10-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/1968-12-0x00000000008E0000-0x000000000096F000-memory.dmpFilesize
572KB
-
memory/1968-14-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB