Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 07:26
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Document PL&BL Draft.exe
Resource
win7v20201028
General
-
Target
Shipping Document PL&BL Draft.exe
-
Size
461KB
-
MD5
0b0bc1d258eccd5ad935dcfcef673a4c
-
SHA1
ac43bc1de991c416c13acdd488518ff5038f1e48
-
SHA256
86879b01844ab067722fd2ca12bf5a666136348ca9a7f72a33ca42d9707e84d0
-
SHA512
d96fbf2b7bbce548e09b90c41526f90faefb12c8f6b6e5fab6489cb640223ac1dc3469d17d27ccd49f9cc77d1278a724e6a29611d0c21292b79178110aa19fa3
Malware Config
Extracted
formbook
http://www.elevatedenterprizes.com/h3qo/
dhflow.com
jyindex.com
ezcleanhandle.com
trungtamcongdong.online
simsprotectionagency.com
easylivemeet.com
blackvikingfashionhouse.com
52banxue.com
girlsinit.com
drhemo.com
freethefarmers.com
velvetrosephotography.com
geometricbotaniclas.com
skyandspirit.com
deltacomunicacao.com
mucademy.com
jaboilfieldsolutions.net
howtowinatblackjacknow.com
anytimegrowth.com
simranluthra.com
thefinleyshow.com
basalmeals.com
esurpluss.com
hrbjczsfs.com
tourphuquocnguyenhien.com
mxprographics.com
themetaphysicalmaster.net
directorystar.asia
thehomeofdiamonds.com
riqinxin.com
covicio.com
sciineurope.com
womensportclothes.com
celestialchimes.net
lotsmen.com
hi-rescloud.net
lewisnathaniel.com
ageonward.com
eyetownglasses.com
bingent.info
matildealvaradovera.com
otorrinonews.com
cdeg898.com
lexingtoncoorgresort.com
minidachshundpups.com
tools365-shop.com
romancingtheeras.com
residentmining.com
aquaflowsprinklers.com
crackapks.com
caffeinatedeverafter.com
sureyyapasa.net
strawberryhearts.com
ptgo.net
devyshkam.com
thethrottletherapy.com
givelyrics.com
signaturepsinc.com
mersinsudunyasi.com
fivedayskitchen.com
fefebeauty.com
long0001.com
hmm40.com
claracarbon.com
Signatures
-
Xloader Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3144-8-0x0000000002D00000-0x0000000002D29000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipping Document PL&BL Draft.exeShipping Document PL&BL Draft.execscript.exedescription pid process target process PID 644 set thread context of 1680 644 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 1680 set thread context of 2580 1680 Shipping Document PL&BL Draft.exe Explorer.EXE PID 3144 set thread context of 2580 3144 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
Shipping Document PL&BL Draft.execscript.exepid process 1680 Shipping Document PL&BL Draft.exe 1680 Shipping Document PL&BL Draft.exe 1680 Shipping Document PL&BL Draft.exe 1680 Shipping Document PL&BL Draft.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe 3144 cscript.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Shipping Document PL&BL Draft.exeShipping Document PL&BL Draft.execscript.exepid process 644 Shipping Document PL&BL Draft.exe 644 Shipping Document PL&BL Draft.exe 1680 Shipping Document PL&BL Draft.exe 1680 Shipping Document PL&BL Draft.exe 1680 Shipping Document PL&BL Draft.exe 3144 cscript.exe 3144 cscript.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Shipping Document PL&BL Draft.execscript.exedescription pid process Token: SeDebugPrivilege 1680 Shipping Document PL&BL Draft.exe Token: SeDebugPrivilege 3144 cscript.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2580 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
Shipping Document PL&BL Draft.exeExplorer.EXEcscript.exedescription pid process target process PID 644 wrote to memory of 1680 644 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 644 wrote to memory of 1680 644 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 644 wrote to memory of 1680 644 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 644 wrote to memory of 1680 644 Shipping Document PL&BL Draft.exe Shipping Document PL&BL Draft.exe PID 2580 wrote to memory of 3144 2580 Explorer.EXE cscript.exe PID 2580 wrote to memory of 3144 2580 Explorer.EXE cscript.exe PID 2580 wrote to memory of 3144 2580 Explorer.EXE cscript.exe PID 3144 wrote to memory of 204 3144 cscript.exe cmd.exe PID 3144 wrote to memory of 204 3144 cscript.exe cmd.exe PID 3144 wrote to memory of 204 3144 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Document PL&BL Draft.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/204-9-0x0000000000000000-mapping.dmp
-
memory/1680-2-0x000000000075D0E0-mapping.dmp
-
memory/1680-4-0x0000000000390000-0x00000000003A0000-memory.dmpFilesize
64KB
-
memory/1680-3-0x0000000000AB0000-0x0000000000DD0000-memory.dmpFilesize
3.1MB
-
memory/2580-5-0x0000000005210000-0x0000000005338000-memory.dmpFilesize
1.2MB
-
memory/2580-12-0x0000000002A20000-0x0000000002AEF000-memory.dmpFilesize
828KB
-
memory/3144-6-0x0000000000000000-mapping.dmp
-
memory/3144-7-0x0000000000290000-0x00000000002B7000-memory.dmpFilesize
156KB
-
memory/3144-8-0x0000000002D00000-0x0000000002D29000-memory.dmpFilesize
164KB
-
memory/3144-10-0x0000000004880000-0x0000000004BA0000-memory.dmpFilesize
3.1MB
-
memory/3144-11-0x00000000045D0000-0x000000000465F000-memory.dmpFilesize
572KB