Analysis
- max time kernel
150s - max time network
148s - platform
windows10_x64 - resource
win10v20201028 - submitted
31/03/2021, 07:12
Static task
static1
Behavioral task
behavioral1
Sample
Order Drawing.exe
Resource
win7v20201028
windows7_x64
General
- Target Order Drawing.exe
- Size 532KB
- Sample210331-eqk5v2hywa
- SHA256 68fa77befde4e147cc7bc2fb142306a94245adb49c4ccca175f12f29414ce3d1
- MD5 5ceb8db06412b0ba9a81fda8edbf7c6f
- SHA1 5bf7a8425a33b41f495c37b42dc8689ebed1cac8
- SHA512 3ae8355a14f82544b35b902ba159802cbb88ed8c8001e83845256ea57d77dd185ea595c7056c55bb87a0e0fc5ab5b0c1a751e5623e00ab585434102bdc65a23c
- MD5 SHA1 SHA512
Malware Config
Extracted
-
xloader
-
http://www.heartyhost.net/uerb/
-
crownedopulencepodcast.com
-
nanashiblog.info
-
kuppers.info
-
techlandy.com
-
katano-tetsuo.com
-
slatonresources2.com
-
havegamewilltravel.com
-
fingusid.com
-
hmcbeauty.com
-
floridaindustriallogistics.com
-
therxplug.com
-
jokerprime.com
-
matzinnovation.com
-
thenumnut.com
-
moneyhaus.info
-
cehoq.com
-
migaleriapanama.com
-
fengjin.net
-
hempiredublights.com
-
eadseconcibrasil.com
-
grooveperiod.com
-
scyihai.net
-
razecollections.com
-
onetwatrlp.online
-
alanalajoieomalley.com
-
eclatworld.net
-
fklabo.xyz
-
zenkinnsfood.com
-
1998kai.com
-
pubgrewardcenter.com
-
successfullegacy.com
-
lynkfly.com
-
unievrsityhealthplans.com
-
tebarsejutaalquran.com
-
alliancefb.com
-
liveoppsnow.com
-
cchubs.com
-
haemhq.com
-
fashionedway.com
-
nexiou.com
-
waterprooflouisville.com
-
mortgagesolutionstporates.net
-
bigstinkycat.com
-
crystalhollowshop.com
-
goodfurn.com
-
spacetasks.com
-
kevinsheepdoghull.com
-
antgroupco.ltd
-
solutions-corder.com
-
corporationoftron.site
-
comfyfurry.com
-
lcrpro.com
-
i-sellandbuy.com
-
saffronmackie.com
-
44ay54al.cloud
-
hyvizli.net
-
figurebay.net
-
parkhomeinsulation.com
-
manxiangcha.com
-
amsterdamdistrict.com
-
technowire.tech
-
banglaislam.net
-
alexiamanager.com
-
samegoods.com
Signatures
- Xloader Payload 1 IoCs
resource yara_rule behavioral2/memory/2920-9-0x0000000002720000-0x0000000002748000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 740 set thread context of 2384 740 Order Drawing.exe 78 PID 2384 set thread context of 3016 2384 Order Drawing.exe 23 PID 2920 set thread context of 3016 2920 mstsc.exe 23 - Suspicious behavior: EnumeratesProcesses 56 IoCs
pid Process 2384 Order Drawing.exe 2384 Order Drawing.exe 2384 Order Drawing.exe 2384 Order Drawing.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe 2920 mstsc.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2384 Order Drawing.exe 2384 Order Drawing.exe 2384 Order Drawing.exe 2920 mstsc.exe 2920 mstsc.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2384 Order Drawing.exe Token: SeDebugPrivilege 2920 mstsc.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 740 Order Drawing.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3016 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 740 wrote to memory of 2384 740 Order Drawing.exe 78 PID 740 wrote to memory of 2384 740 Order Drawing.exe 78 PID 740 wrote to memory of 2384 740 Order Drawing.exe 78 PID 740 wrote to memory of 2384 740 Order Drawing.exe 78 PID 3016 wrote to memory of 2920 3016 Explorer.EXE 79 PID 3016 wrote to memory of 2920 3016 Explorer.EXE 79 PID 3016 wrote to memory of 2920 3016 Explorer.EXE 79 PID 2920 wrote to memory of 992 2920 mstsc.exe 80 PID 2920 wrote to memory of 992 2920 mstsc.exe 80 PID 2920 wrote to memory of 992 2920 mstsc.exe 80
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\Order Drawing.exe"C:\Users\Admin\AppData\Local\Temp\Order Drawing.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\Order Drawing.exe"C:\Users\Admin\AppData\Local\Temp\Order Drawing.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order Drawing.exe"3⤵PID:992
-
-