Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-04-2021 13:01
Static task
static1
Behavioral task
behavioral1
Sample
RE New order.exe
Resource
win7v20210408
General
-
Target
RE New order.exe
-
Size
774KB
-
MD5
752c086496f2301ef7e95cc0a710c786
-
SHA1
9cb8456136462d69dfd073b43707fa9eee7d09a7
-
SHA256
beb1862a3b194a840605b7f030f0285fff18fadfc4199c3da007f44b7ad19292
-
SHA512
d9a4a2bce07b613ce55f1cfe085faa5a1381cb0fb60f7d80c0eb7c279bbadb5e2f949adab5ed488ffaf238f5963b3978d4483bca40dac556ccb1aed4f2002a39
Malware Config
Extracted
xloader
2.3
http://www.mipecvinh-heritage.com/bfak/
beautifulhairbabe.com
smartlegal.info
posgradeadunica.com
suitefleetdms.com
dlxlcarbon.com
wongtangstore9.host
saintsimonsparkneighborhood.com
racevx.xyz
mooniswap.farm
healthymantra.store
igualandocaminos.com
eclecticblerd.com
reasonofsmilefoundation.com
thechallenge.party
smallbusinessesforgolden.com
yihuyifu.com
escalategear.com
lnanhhealthcareers.com
makeupkacie.com
gccrewauction.com
kcosmoprof.com
dreamfocuslove.com
smsstm.com
warwickhouseofpizzamenu.com
comfortplusindia.com
defiswaponline.com
soundbathclass.com
lazyfears.com
canopus-strategy.com
terreatoir.com
efficiencyexpertstt.com
environmentologyblog.com
ogdenbankruptcylawyer.com
9iyg.com
miawezon.com
anjuliesmusic.com
trucksinrochester.com
para-learning.com
1frivgames.com
citii-groupss.site
doesthecatdie.com
suckhoevangnvp.site
connectionsacademy.sucks
caminosviajeros.com
acadiananetwork.com
longlife.online
rattankw.com
campoyabolivia.com
mymindismyown.com
hansa-logistics.com
1transformationstation.com
prometheumcapital.com
artagayne.com
faneciecloset.com
tarynlaakso.com
jevcic.com
t2t-hprc-2020conference.com
arsitastudio.com
ahoradoacs.com
keyboarding-typing.com
acgtea.club
thehouseluxury.com
eatmybet.com
sakshamsacademy.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/524-67-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/524-68-0x000000000041D100-mapping.dmp xloader behavioral1/memory/976-76-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 924 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
RE New order.exeRE New order.exerundll32.exedescription pid process target process PID 1640 set thread context of 524 1640 RE New order.exe RE New order.exe PID 524 set thread context of 1192 524 RE New order.exe Explorer.EXE PID 976 set thread context of 1192 976 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
RE New order.exerundll32.exepid process 524 RE New order.exe 524 RE New order.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe 976 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
RE New order.exerundll32.exepid process 524 RE New order.exe 524 RE New order.exe 524 RE New order.exe 976 rundll32.exe 976 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RE New order.exerundll32.exedescription pid process Token: SeDebugPrivilege 524 RE New order.exe Token: SeDebugPrivilege 976 rundll32.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE 1192 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
RE New order.exeExplorer.EXErundll32.exedescription pid process target process PID 1640 wrote to memory of 524 1640 RE New order.exe RE New order.exe PID 1640 wrote to memory of 524 1640 RE New order.exe RE New order.exe PID 1640 wrote to memory of 524 1640 RE New order.exe RE New order.exe PID 1640 wrote to memory of 524 1640 RE New order.exe RE New order.exe PID 1640 wrote to memory of 524 1640 RE New order.exe RE New order.exe PID 1640 wrote to memory of 524 1640 RE New order.exe RE New order.exe PID 1640 wrote to memory of 524 1640 RE New order.exe RE New order.exe PID 1192 wrote to memory of 976 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 976 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 976 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 976 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 976 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 976 1192 Explorer.EXE rundll32.exe PID 1192 wrote to memory of 976 1192 Explorer.EXE rundll32.exe PID 976 wrote to memory of 924 976 rundll32.exe cmd.exe PID 976 wrote to memory of 924 976 rundll32.exe cmd.exe PID 976 wrote to memory of 924 976 rundll32.exe cmd.exe PID 976 wrote to memory of 924 976 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\RE New order.exe"C:\Users\Admin\AppData\Local\Temp\RE New order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\RE New order.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:524 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RE New order.exe"3⤵
- Deletes itself
PID:924
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/524-67-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/524-70-0x0000000000A20000-0x0000000000D23000-memory.dmpFilesize
3.0MB
-
memory/524-71-0x0000000000080000-0x0000000000090000-memory.dmpFilesize
64KB
-
memory/524-68-0x000000000041D100-mapping.dmp
-
memory/924-77-0x0000000000000000-mapping.dmp
-
memory/976-74-0x00000000769B1000-0x00000000769B3000-memory.dmpFilesize
8KB
-
memory/976-75-0x0000000000EF0000-0x0000000000EFE000-memory.dmpFilesize
56KB
-
memory/976-79-0x00000000009D0000-0x0000000000A5F000-memory.dmpFilesize
572KB
-
memory/976-78-0x0000000002300000-0x0000000002603000-memory.dmpFilesize
3.0MB
-
memory/976-73-0x0000000000000000-mapping.dmp
-
memory/976-76-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1192-80-0x00000000060F0000-0x0000000006275000-memory.dmpFilesize
1.5MB
-
memory/1192-72-0x0000000003D10000-0x0000000003DEA000-memory.dmpFilesize
872KB
-
memory/1640-60-0x0000000000EE0000-0x0000000000EE1000-memory.dmpFilesize
4KB
-
memory/1640-66-0x0000000000470000-0x00000000004DF000-memory.dmpFilesize
444KB
-
memory/1640-62-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/1640-63-0x00000000006B0000-0x00000000006B5000-memory.dmpFilesize
20KB
-
memory/1640-64-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1640-65-0x0000000009250000-0x000000000930D000-memory.dmpFilesize
756KB