Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-06-2021 12:07
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7v20210408
General
-
Target
Purchase Order.exe
-
Size
1.5MB
-
MD5
0de7e23489e8526f010e7ebf3597acde
-
SHA1
a29d564a3ffa196f8d78b832e95a65cbd726ab1a
-
SHA256
2348867be2e6f27aa4cd8d07826357169e66667108b4784ae3144576e2e16377
-
SHA512
d2ad2442df048d303a77bdcbcbef6c2755b7f024ce400bbb79d58cd91242f26e4df1e2054bc9cebd0a317c584611df49fa4cea1c288f683135669b94c7d2e3dd
Malware Config
Extracted
xloader
2.3
http://www.shhxqg.com/xfts/
dailiesplatform.com
krlanka.com
koms.info
chesslearner.com
softwarefully.com
yogiplayground.com
learhee.com
faithbook.info
pepperrefo.com
kratochvil-elektro.com
artbyg2.com
123-e.com
levelupyourbody.info
ecommercebusinessowner.com
floraseriestrilogy.com
sdyykt.com
swchof.com
huaxinhui.tech
sems-iress2016.com
vasudhalibrary.com
chummakizhi.com
gosleep-vietnam.com
plafon.one
sneakyhenry.com
x1699.com
flora4me.com
goofballtheclown.com
luckysevenboxesdesign.com
bioseefit-genuine.com
rjuanca.com
projectorcity.net
sustainablemedia.global
autoimmuneanswers.net
lessismoreee.com
xn--80aabjg7ciie7f.xn--p1acf
yourmoneyfuther.com
theatricsvirtual.com
appalachianholisticdentist.com
blaxies3.com
partycc.com
for-all-dream.com
szrhyl.com
databolism.com
loyalimportados.com
burnvioletinternational.com
graceinperspective.life
artsandfoodnyc.recipes
design4sys.com
medicalscreech.life
seeyouseeme.net
cernerarchive.net
ketamineinfusioncalgary.com
leagueofconsciouscreatives.com
triggerfishgroup.com
de-la-platiada.info
whatsmycurrency.com
stainset.com
museanimations.com
vip-5.com
corollabeachsetups.com
arcpest.com
kusamac.com
mustaphaswinga.com
dofreemovies.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1492-65-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1492-66-0x000000000041D080-mapping.dmp xloader behavioral1/memory/1520-75-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 316 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Purchase Order.exePurchase Order.exemsiexec.exedescription pid process target process PID 940 set thread context of 1492 940 Purchase Order.exe Purchase Order.exe PID 1492 set thread context of 1200 1492 Purchase Order.exe Explorer.EXE PID 1520 set thread context of 1200 1520 msiexec.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
Purchase Order.exePurchase Order.exemsiexec.exepid process 940 Purchase Order.exe 940 Purchase Order.exe 940 Purchase Order.exe 1492 Purchase Order.exe 1492 Purchase Order.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe 1520 msiexec.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Purchase Order.exemsiexec.exepid process 1492 Purchase Order.exe 1492 Purchase Order.exe 1492 Purchase Order.exe 1520 msiexec.exe 1520 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Purchase Order.exePurchase Order.exemsiexec.exedescription pid process Token: SeDebugPrivilege 940 Purchase Order.exe Token: SeDebugPrivilege 1492 Purchase Order.exe Token: SeDebugPrivilege 1520 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
Purchase Order.exeExplorer.EXEmsiexec.exedescription pid process target process PID 940 wrote to memory of 1492 940 Purchase Order.exe Purchase Order.exe PID 940 wrote to memory of 1492 940 Purchase Order.exe Purchase Order.exe PID 940 wrote to memory of 1492 940 Purchase Order.exe Purchase Order.exe PID 940 wrote to memory of 1492 940 Purchase Order.exe Purchase Order.exe PID 940 wrote to memory of 1492 940 Purchase Order.exe Purchase Order.exe PID 940 wrote to memory of 1492 940 Purchase Order.exe Purchase Order.exe PID 940 wrote to memory of 1492 940 Purchase Order.exe Purchase Order.exe PID 1200 wrote to memory of 1520 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1520 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1520 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1520 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1520 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1520 1200 Explorer.EXE msiexec.exe PID 1200 wrote to memory of 1520 1200 Explorer.EXE msiexec.exe PID 1520 wrote to memory of 316 1520 msiexec.exe cmd.exe PID 1520 wrote to memory of 316 1520 msiexec.exe cmd.exe PID 1520 wrote to memory of 316 1520 msiexec.exe cmd.exe PID 1520 wrote to memory of 316 1520 msiexec.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-73-0x0000000000000000-mapping.dmp
-
memory/940-64-0x0000000000C90000-0x0000000000CBB000-memory.dmpFilesize
172KB
-
memory/940-63-0x00000000085F0000-0x000000000866A000-memory.dmpFilesize
488KB
-
memory/940-59-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/940-61-0x0000000000510000-0x0000000000511000-memory.dmpFilesize
4KB
-
memory/940-62-0x00000000005A0000-0x00000000005A2000-memory.dmpFilesize
8KB
-
memory/1200-78-0x0000000004ED0000-0x0000000005020000-memory.dmpFilesize
1.3MB
-
memory/1200-70-0x0000000006FB0000-0x0000000007154000-memory.dmpFilesize
1.6MB
-
memory/1492-65-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1492-68-0x00000000009E0000-0x0000000000CE3000-memory.dmpFilesize
3.0MB
-
memory/1492-66-0x000000000041D080-mapping.dmp
-
memory/1492-69-0x0000000000150000-0x0000000000161000-memory.dmpFilesize
68KB
-
memory/1520-72-0x0000000075051000-0x0000000075053000-memory.dmpFilesize
8KB
-
memory/1520-71-0x0000000000000000-mapping.dmp
-
memory/1520-75-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1520-74-0x0000000000530000-0x0000000000544000-memory.dmpFilesize
80KB
-
memory/1520-76-0x00000000023A0000-0x00000000026A3000-memory.dmpFilesize
3.0MB
-
memory/1520-77-0x0000000000D50000-0x0000000000DE0000-memory.dmpFilesize
576KB