Analysis
-
max time kernel
110s -
max time network
14s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 18:24
Static task
static1
Behavioral task
behavioral1
Sample
F2123122_quantity_increased,pdf.exe
Resource
win7v20210410
General
-
Target
F2123122_quantity_increased,pdf.exe
-
Size
790KB
-
MD5
d973b6745ca038d514b04f5495348027
-
SHA1
23a7a5dd2bad6931c491e15244bffb19e6d975fa
-
SHA256
d390d8a528c62a458cb66745b0245eaf4721c9e3f3cea7ba75d16fae31a392b4
-
SHA512
6869f55bcbc8259360c3a967a627c61bfbb872d2504258c39c4f22043ac1d04e954bb250a7fcba035dce5e486d689dfe985bafd07dd4ae0a32e90e68b7e5b72e
Malware Config
Extracted
xloader
2.3
http://www.liancaiwangv5.com/oerg/
brightly-common.com
petwellness.pet
oldhamluxury.com
cmpembroidery.com
physicalrobot.com
irynazumba.com
testyourself11.com
theblacksportswoman.com
mottestertraining.agency
confrontinghate.info
tamiigun.com
pod14.club
implementnowsolutions.net
letsdance.website
cashforkeysdz.net
grupoprotecsasac.com
kol-lek-tiv.net
funeralhomesmaroail.com
lwfunding.com
junkglobal.com
planbeee.com
cloudfoodz.com
jalilvandconsulting.com
dsheatpumps.com
loisirdefense.com
kitchensavershop.com
smarthealthubclub.com
happyupa.com
hellonetworker.com
sparkyspizzaor.com
avenew.pro
onlineregular.com
lateliersensible.com
nhietluyen.com
magicclass.ltd
cactusrootspalmsprings.com
bodascivileshouston.com
manicolada.com
tabernacleenterprise.com
pbpurchase.com
senmec23.com
assetnj.com
eveningtaxservice.com
gufobardo.com
ertcfdg.xyz
sky-odhner.com
ventures-sellers.com
anquanbx.com
proteccare.com
imprussts.com
solentplanning.com
eskisla.com
sparktheblogbycirque.com
retailala.com
freeglobe.life
business247.space
rentwithdex.com
clipsq.com
taratakeson.com
mkdepannage.run
kjfdjdjkfkjejfdre.com
fayd000.icu
freejobsalertpk.com
innovision3d.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/532-64-0x000000000041D050-mapping.dmp xloader behavioral1/memory/532-63-0x0000000000400000-0x0000000000428000-memory.dmp xloader -
Suspicious use of SetThreadContext 1 IoCs
Processes:
F2123122_quantity_increased,pdf.exedescription pid process target process PID 768 set thread context of 532 768 F2123122_quantity_increased,pdf.exe F2123122_quantity_increased,pdf.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
F2123122_quantity_increased,pdf.exepid process 532 F2123122_quantity_increased,pdf.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
F2123122_quantity_increased,pdf.exedescription pid process target process PID 768 wrote to memory of 532 768 F2123122_quantity_increased,pdf.exe F2123122_quantity_increased,pdf.exe PID 768 wrote to memory of 532 768 F2123122_quantity_increased,pdf.exe F2123122_quantity_increased,pdf.exe PID 768 wrote to memory of 532 768 F2123122_quantity_increased,pdf.exe F2123122_quantity_increased,pdf.exe PID 768 wrote to memory of 532 768 F2123122_quantity_increased,pdf.exe F2123122_quantity_increased,pdf.exe PID 768 wrote to memory of 532 768 F2123122_quantity_increased,pdf.exe F2123122_quantity_increased,pdf.exe PID 768 wrote to memory of 532 768 F2123122_quantity_increased,pdf.exe F2123122_quantity_increased,pdf.exe PID 768 wrote to memory of 532 768 F2123122_quantity_increased,pdf.exe F2123122_quantity_increased,pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\F2123122_quantity_increased,pdf.exe"C:\Users\Admin\AppData\Local\Temp\F2123122_quantity_increased,pdf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F2123122_quantity_increased,pdf.exe"C:\Users\Admin\AppData\Local\Temp\F2123122_quantity_increased,pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-64-0x000000000041D050-mapping.dmp
-
memory/532-63-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/532-66-0x0000000000850000-0x0000000000B53000-memory.dmpFilesize
3.0MB
-
memory/768-60-0x0000000075EF1000-0x0000000075EF3000-memory.dmpFilesize
8KB
-
memory/768-61-0x00000000002E0000-0x00000000002E1000-memory.dmpFilesize
4KB
-
memory/768-62-0x00000000002E1000-0x00000000002E2000-memory.dmpFilesize
4KB