Analysis
-
max time kernel
150s -
max time network
166s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-06-2021 12:05
Static task
static1
Behavioral task
behavioral1
Sample
PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe
Resource
win7v20210410
General
-
Target
PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe
-
Size
923KB
-
MD5
8eb4085101f4cc1f78bde6323c2cf954
-
SHA1
2162c6fa8a2c278b2a6aeea2491ea62eea56e5c4
-
SHA256
00139ffbc60ffd8c46045238f984371a7cd5dd8a9c0f39af10eb0512bb82a40a
-
SHA512
56b1a44c974d1635e0daf84b7038ab8e6672b0dc74eb41609c2467a09e2f22b59bb34be7ba0c92623685d845228874c5378d157c299bdc7081aef60bf7919e03
Malware Config
Extracted
xloader
2.3
http://www.xgegqs.com/gscc/
digdeepalways.com
medicaidcovidsurvey.com
thebranchfellowship.com
trillionairebigboysclub.com
pointsvalidation.com
thatcomfortableplace.com
stretchingchic.com
tabletadigital.online
xkg.xyz
merlin-hygieneforce.com
mockexamsonline.com
mortgagemegloans.com
fraudcast.net
bexleyheathdmcc.xyz
shop77c.club
blueathue.com
bjzxsd.com
8metode.com
ravexim3.com
kratiemthaicuisine.com
haras-dors.com
a4biznesscenter.com
beckerconta.com
thebankofamericaservices.com
av101.pro
glenndadestateteam.com
themaconsandfamily.com
albertjeun.com
homeworkkiller.info
watsonep.com
chinaouhao.com
amandayumi.com
spidersolitaire.club
cgxxka.com
theasiahub.com
webersarmy.com
2manyads.com
utrexpress.com
fourcornersfreight.com
rkl123.com
yournetresult.com
o2way.com
thenepalisong.com
silkbeast.com
alanalevittstudio.com
cybrrater.com
nguyenanhonhunguyet.net
twinlifemusicgroup.com
homesbymariet.com
theeasyfile.com
gor.xyz
sartservices.com
dianesproperties.com
reddog-games.com
whateversthought.com
easydigitalzone.com
merchant-compass.com
travelaise.com
mamiya-mould.com
freesolorv.net
thehealthyfoodkitchen.com
studiocerboni.com
petermarmureanu.com
brendadesignm.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/736-126-0x000000000041D050-mapping.dmp xloader behavioral2/memory/736-125-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3476-134-0x0000000000D30000-0x0000000000D58000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PURCHASE CONTRACT #GJPL1202 2021-22PDF.exePURCHASE CONTRACT #GJPL1202 2021-22PDF.exemstsc.exedescription pid process target process PID 3892 set thread context of 736 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PID 736 set thread context of 3044 736 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe Explorer.EXE PID 3476 set thread context of 3044 3476 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 49 IoCs
Processes:
PURCHASE CONTRACT #GJPL1202 2021-22PDF.exePURCHASE CONTRACT #GJPL1202 2021-22PDF.exemstsc.exepid process 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 736 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 736 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 736 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 736 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe 3476 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3044 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PURCHASE CONTRACT #GJPL1202 2021-22PDF.exemstsc.exepid process 736 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 736 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 736 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe 3476 mstsc.exe 3476 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
PURCHASE CONTRACT #GJPL1202 2021-22PDF.exePURCHASE CONTRACT #GJPL1202 2021-22PDF.exemstsc.exedescription pid process Token: SeDebugPrivilege 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe Token: SeDebugPrivilege 736 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe Token: SeDebugPrivilege 3476 mstsc.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3044 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
PURCHASE CONTRACT #GJPL1202 2021-22PDF.exeExplorer.EXEmstsc.exedescription pid process target process PID 3892 wrote to memory of 3772 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PID 3892 wrote to memory of 3772 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PID 3892 wrote to memory of 3772 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PID 3892 wrote to memory of 736 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PID 3892 wrote to memory of 736 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PID 3892 wrote to memory of 736 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PID 3892 wrote to memory of 736 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PID 3892 wrote to memory of 736 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PID 3892 wrote to memory of 736 3892 PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe PID 3044 wrote to memory of 3476 3044 Explorer.EXE mstsc.exe PID 3044 wrote to memory of 3476 3044 Explorer.EXE mstsc.exe PID 3044 wrote to memory of 3476 3044 Explorer.EXE mstsc.exe PID 3476 wrote to memory of 3496 3476 mstsc.exe cmd.exe PID 3476 wrote to memory of 3496 3476 mstsc.exe cmd.exe PID 3476 wrote to memory of 3496 3476 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe"C:\Users\Admin\AppData\Local\Temp\PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PURCHASE CONTRACT #GJPL1202 2021-22PDF.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/736-126-0x000000000041D050-mapping.dmp
-
memory/736-129-0x0000000001210000-0x000000000135A000-memory.dmpFilesize
1.3MB
-
memory/736-128-0x0000000001760000-0x0000000001A80000-memory.dmpFilesize
3.1MB
-
memory/736-125-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3044-137-0x0000000003190000-0x0000000003251000-memory.dmpFilesize
772KB
-
memory/3044-130-0x00000000059E0000-0x0000000005ACD000-memory.dmpFilesize
948KB
-
memory/3476-131-0x0000000000000000-mapping.dmp
-
memory/3476-136-0x0000000005100000-0x000000000518F000-memory.dmpFilesize
572KB
-
memory/3476-135-0x00000000052B0000-0x00000000055D0000-memory.dmpFilesize
3.1MB
-
memory/3476-134-0x0000000000D30000-0x0000000000D58000-memory.dmpFilesize
160KB
-
memory/3476-133-0x0000000000D70000-0x000000000106C000-memory.dmpFilesize
3.0MB
-
memory/3496-132-0x0000000000000000-mapping.dmp
-
memory/3892-121-0x00000000078A0000-0x00000000078B0000-memory.dmpFilesize
64KB
-
memory/3892-118-0x00000000075D0000-0x00000000075D1000-memory.dmpFilesize
4KB
-
memory/3892-117-0x0000000007A30000-0x0000000007A31000-memory.dmpFilesize
4KB
-
memory/3892-114-0x0000000000310000-0x0000000000311000-memory.dmpFilesize
4KB
-
memory/3892-119-0x0000000007470000-0x0000000007471000-memory.dmpFilesize
4KB
-
memory/3892-120-0x0000000007730000-0x0000000007731000-memory.dmpFilesize
4KB
-
memory/3892-122-0x00000000071E0000-0x00000000071E1000-memory.dmpFilesize
4KB
-
memory/3892-124-0x0000000002570000-0x00000000025CE000-memory.dmpFilesize
376KB
-
memory/3892-123-0x0000000009A30000-0x0000000009AC4000-memory.dmpFilesize
592KB
-
memory/3892-116-0x0000000007490000-0x0000000007491000-memory.dmpFilesize
4KB