Analysis
-
max time kernel
153s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-04-2021 15:03
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE B1020363.PDF.exe
Resource
win7v20210408
General
-
Target
QUOTE B1020363.PDF.exe
-
Size
598KB
-
MD5
ecc182f3b2feaedcd32a97c51f01f652
-
SHA1
2c5b57854e772c72f3410d3ee3a29e19b654af1d
-
SHA256
cc58e505c504c770a1031d30453615f7748b0618b872655ac79a059a072c194c
-
SHA512
a593ae7b7d81499589722f5b420d645a25b030c264b9ef490016cb7b9e6845cf674b0d25371670c8fef86b54b7716e3f34b70e44b7b084535d8963580e88050d
Malware Config
Extracted
xloader
2.3
http://www.huamxvcyq.icu/aepn/
noesos.com
partsus.xyz
manageordercentersupp.com
wickedwallart.com
hike4cash.com
theviragocircle.com
followthesharks.com
paradisevalleywines.com
unmetrolimpio.com
eurocarsnj.com
alvaroeliseo.com
bfc8.xyz
oldcourts.com
bkpef.info
mammately.com
agentcharles.com
wwwmichiganbulb.com
pensolid.info
hibiscushealthcare.com
mwanakbk.com
theafashions.com
fundolagosecreto.com
callusesremover.com
hyprepolymer.com
ferguson-home.com
greenfixfuel.com
nationalseniorsdeerpark.com
laurinwithhoney.com
asiancajundesign.com
ethereumaudit.com
danisco.sucks
avtobluz72.net
maymodel.net
heisenbrew.wine
wirebendersportfishing.com
syncblow.site
littleslumberparties.com
progmao.com
sarl-renov-bat.com
ngoclacntv.com
fand-sodan.com
parkourtrading.com
ladywhitecompany.com
theislamoscope.com
amarresdemas.com
playgymnastics.com
last-information-app-secure.com
myglowskins.com
chain-dynamics.net
mildinfra.com
wwwxilu.com
hunhu.net
inconel800.com
thumuavaigiacao.com
katsworlds.com
jewelsfleet.com
organichighqualitytwig.com
ocheapvrwdmall.com
alsiha2020.com
renttoownhomearizona.com
digitaldustbowl.net
xn----7sbbixkkqgmzjfi.xn--p1acf
downsizeandupsizeyourlife.info
senmec23.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1016-67-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1016-68-0x000000000041D070-mapping.dmp xloader behavioral1/memory/380-79-0x0000000000090000-0x00000000000B9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
QUOTE B1020363.PDF.exeRegSvcs.exerundll32.exedescription pid process target process PID 1828 set thread context of 1016 1828 QUOTE B1020363.PDF.exe RegSvcs.exe PID 1016 set thread context of 1208 1016 RegSvcs.exe Explorer.EXE PID 1016 set thread context of 1208 1016 RegSvcs.exe Explorer.EXE PID 380 set thread context of 1208 380 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
QUOTE B1020363.PDF.exeRegSvcs.exerundll32.exepid process 1828 QUOTE B1020363.PDF.exe 1828 QUOTE B1020363.PDF.exe 1016 RegSvcs.exe 1016 RegSvcs.exe 1016 RegSvcs.exe 380 rundll32.exe 380 rundll32.exe 380 rundll32.exe 380 rundll32.exe 380 rundll32.exe 380 rundll32.exe 380 rundll32.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
RegSvcs.exerundll32.exepid process 1016 RegSvcs.exe 1016 RegSvcs.exe 1016 RegSvcs.exe 1016 RegSvcs.exe 380 rundll32.exe 380 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
QUOTE B1020363.PDF.exeRegSvcs.exerundll32.exedescription pid process Token: SeDebugPrivilege 1828 QUOTE B1020363.PDF.exe Token: SeDebugPrivilege 1016 RegSvcs.exe Token: SeDebugPrivilege 380 rundll32.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
QUOTE B1020363.PDF.exeExplorer.EXErundll32.exedescription pid process target process PID 1828 wrote to memory of 1016 1828 QUOTE B1020363.PDF.exe RegSvcs.exe PID 1828 wrote to memory of 1016 1828 QUOTE B1020363.PDF.exe RegSvcs.exe PID 1828 wrote to memory of 1016 1828 QUOTE B1020363.PDF.exe RegSvcs.exe PID 1828 wrote to memory of 1016 1828 QUOTE B1020363.PDF.exe RegSvcs.exe PID 1828 wrote to memory of 1016 1828 QUOTE B1020363.PDF.exe RegSvcs.exe PID 1828 wrote to memory of 1016 1828 QUOTE B1020363.PDF.exe RegSvcs.exe PID 1828 wrote to memory of 1016 1828 QUOTE B1020363.PDF.exe RegSvcs.exe PID 1828 wrote to memory of 1016 1828 QUOTE B1020363.PDF.exe RegSvcs.exe PID 1828 wrote to memory of 1016 1828 QUOTE B1020363.PDF.exe RegSvcs.exe PID 1828 wrote to memory of 1016 1828 QUOTE B1020363.PDF.exe RegSvcs.exe PID 1208 wrote to memory of 380 1208 Explorer.EXE rundll32.exe PID 1208 wrote to memory of 380 1208 Explorer.EXE rundll32.exe PID 1208 wrote to memory of 380 1208 Explorer.EXE rundll32.exe PID 1208 wrote to memory of 380 1208 Explorer.EXE rundll32.exe PID 1208 wrote to memory of 380 1208 Explorer.EXE rundll32.exe PID 1208 wrote to memory of 380 1208 Explorer.EXE rundll32.exe PID 1208 wrote to memory of 380 1208 Explorer.EXE rundll32.exe PID 380 wrote to memory of 1652 380 rundll32.exe cmd.exe PID 380 wrote to memory of 1652 380 rundll32.exe cmd.exe PID 380 wrote to memory of 1652 380 rundll32.exe cmd.exe PID 380 wrote to memory of 1652 380 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTE B1020363.PDF.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE B1020363.PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/380-76-0x0000000075511000-0x0000000075513000-memory.dmpFilesize
8KB
-
memory/380-75-0x0000000000000000-mapping.dmp
-
memory/380-81-0x0000000001E30000-0x0000000001EC0000-memory.dmpFilesize
576KB
-
memory/380-80-0x0000000001FC0000-0x00000000022C3000-memory.dmpFilesize
3.0MB
-
memory/380-79-0x0000000000090000-0x00000000000B9000-memory.dmpFilesize
164KB
-
memory/380-78-0x0000000000160000-0x000000000016E000-memory.dmpFilesize
56KB
-
memory/1016-67-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1016-68-0x000000000041D070-mapping.dmp
-
memory/1016-70-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/1016-71-0x0000000000290000-0x00000000002A1000-memory.dmpFilesize
68KB
-
memory/1016-73-0x0000000000360000-0x0000000000371000-memory.dmpFilesize
68KB
-
memory/1208-72-0x0000000006150000-0x00000000062CF000-memory.dmpFilesize
1.5MB
-
memory/1208-74-0x00000000070E0000-0x0000000007287000-memory.dmpFilesize
1.7MB
-
memory/1208-82-0x0000000005FA0000-0x0000000006097000-memory.dmpFilesize
988KB
-
memory/1652-77-0x0000000000000000-mapping.dmp
-
memory/1828-60-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/1828-66-0x00000000045B0000-0x00000000045DE000-memory.dmpFilesize
184KB
-
memory/1828-65-0x00000000050C0000-0x0000000005133000-memory.dmpFilesize
460KB
-
memory/1828-64-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1828-63-0x0000000001E60000-0x0000000001E69000-memory.dmpFilesize
36KB
-
memory/1828-62-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB