Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-06-2021 12:07
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order.exe
Resource
win7v20210408
General
-
Target
Purchase Order.exe
-
Size
1.5MB
-
MD5
0de7e23489e8526f010e7ebf3597acde
-
SHA1
a29d564a3ffa196f8d78b832e95a65cbd726ab1a
-
SHA256
2348867be2e6f27aa4cd8d07826357169e66667108b4784ae3144576e2e16377
-
SHA512
d2ad2442df048d303a77bdcbcbef6c2755b7f024ce400bbb79d58cd91242f26e4df1e2054bc9cebd0a317c584611df49fa4cea1c288f683135669b94c7d2e3dd
Malware Config
Extracted
xloader
2.3
http://www.shhxqg.com/xfts/
dailiesplatform.com
krlanka.com
koms.info
chesslearner.com
softwarefully.com
yogiplayground.com
learhee.com
faithbook.info
pepperrefo.com
kratochvil-elektro.com
artbyg2.com
123-e.com
levelupyourbody.info
ecommercebusinessowner.com
floraseriestrilogy.com
sdyykt.com
swchof.com
huaxinhui.tech
sems-iress2016.com
vasudhalibrary.com
chummakizhi.com
gosleep-vietnam.com
plafon.one
sneakyhenry.com
x1699.com
flora4me.com
goofballtheclown.com
luckysevenboxesdesign.com
bioseefit-genuine.com
rjuanca.com
projectorcity.net
sustainablemedia.global
autoimmuneanswers.net
lessismoreee.com
xn--80aabjg7ciie7f.xn--p1acf
yourmoneyfuther.com
theatricsvirtual.com
appalachianholisticdentist.com
blaxies3.com
partycc.com
for-all-dream.com
szrhyl.com
databolism.com
loyalimportados.com
burnvioletinternational.com
graceinperspective.life
artsandfoodnyc.recipes
design4sys.com
medicalscreech.life
seeyouseeme.net
cernerarchive.net
ketamineinfusioncalgary.com
leagueofconsciouscreatives.com
triggerfishgroup.com
de-la-platiada.info
whatsmycurrency.com
stainset.com
museanimations.com
vip-5.com
corollabeachsetups.com
arcpest.com
kusamac.com
mustaphaswinga.com
dofreemovies.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3840-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3840-125-0x000000000041D080-mapping.dmp xloader behavioral2/memory/3564-134-0x00000000030C0000-0x00000000030E9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Purchase Order.exePurchase Order.exesystray.exedescription pid process target process PID 3100 set thread context of 3840 3100 Purchase Order.exe Purchase Order.exe PID 3840 set thread context of 3064 3840 Purchase Order.exe Explorer.EXE PID 3840 set thread context of 3064 3840 Purchase Order.exe Explorer.EXE PID 3564 set thread context of 3064 3564 systray.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
Purchase Order.exePurchase Order.exesystray.exepid process 3100 Purchase Order.exe 3100 Purchase Order.exe 3100 Purchase Order.exe 3100 Purchase Order.exe 3840 Purchase Order.exe 3840 Purchase Order.exe 3840 Purchase Order.exe 3840 Purchase Order.exe 3840 Purchase Order.exe 3840 Purchase Order.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe 3564 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3064 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Purchase Order.exesystray.exepid process 3840 Purchase Order.exe 3840 Purchase Order.exe 3840 Purchase Order.exe 3840 Purchase Order.exe 3564 systray.exe 3564 systray.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
Purchase Order.exePurchase Order.exesystray.exedescription pid process Token: SeDebugPrivilege 3100 Purchase Order.exe Token: SeDebugPrivilege 3840 Purchase Order.exe Token: SeDebugPrivilege 3564 systray.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3064 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Purchase Order.exeExplorer.EXEsystray.exedescription pid process target process PID 3100 wrote to memory of 3840 3100 Purchase Order.exe Purchase Order.exe PID 3100 wrote to memory of 3840 3100 Purchase Order.exe Purchase Order.exe PID 3100 wrote to memory of 3840 3100 Purchase Order.exe Purchase Order.exe PID 3100 wrote to memory of 3840 3100 Purchase Order.exe Purchase Order.exe PID 3100 wrote to memory of 3840 3100 Purchase Order.exe Purchase Order.exe PID 3100 wrote to memory of 3840 3100 Purchase Order.exe Purchase Order.exe PID 3064 wrote to memory of 3564 3064 Explorer.EXE systray.exe PID 3064 wrote to memory of 3564 3064 Explorer.EXE systray.exe PID 3064 wrote to memory of 3564 3064 Explorer.EXE systray.exe PID 3564 wrote to memory of 3708 3564 systray.exe cmd.exe PID 3564 wrote to memory of 3708 3564 systray.exe cmd.exe PID 3564 wrote to memory of 3708 3564 systray.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3064-129-0x0000000004DB0000-0x0000000004F52000-memory.dmpFilesize
1.6MB
-
memory/3064-138-0x0000000005F90000-0x00000000060A2000-memory.dmpFilesize
1.1MB
-
memory/3064-131-0x0000000005E40000-0x0000000005F87000-memory.dmpFilesize
1.3MB
-
memory/3100-120-0x0000000007960000-0x0000000007962000-memory.dmpFilesize
8KB
-
memory/3100-118-0x00000000076C0000-0x00000000076C1000-memory.dmpFilesize
4KB
-
memory/3100-114-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/3100-121-0x0000000007290000-0x0000000007291000-memory.dmpFilesize
4KB
-
memory/3100-122-0x0000000009310000-0x000000000938A000-memory.dmpFilesize
488KB
-
memory/3100-123-0x00000000047C0000-0x00000000047EB000-memory.dmpFilesize
172KB
-
memory/3100-116-0x00000000079A0000-0x00000000079A1000-memory.dmpFilesize
4KB
-
memory/3100-117-0x0000000007580000-0x0000000007581000-memory.dmpFilesize
4KB
-
memory/3100-119-0x0000000007560000-0x0000000007561000-memory.dmpFilesize
4KB
-
memory/3564-132-0x0000000000000000-mapping.dmp
-
memory/3564-133-0x0000000000840000-0x0000000000846000-memory.dmpFilesize
24KB
-
memory/3564-134-0x00000000030C0000-0x00000000030E9000-memory.dmpFilesize
164KB
-
memory/3564-136-0x00000000045F0000-0x0000000004910000-memory.dmpFilesize
3.1MB
-
memory/3564-137-0x00000000049A0000-0x0000000004A30000-memory.dmpFilesize
576KB
-
memory/3708-135-0x0000000000000000-mapping.dmp
-
memory/3840-127-0x0000000001AA0000-0x0000000001AB1000-memory.dmpFilesize
68KB
-
memory/3840-128-0x00000000015B0000-0x00000000018D0000-memory.dmpFilesize
3.1MB
-
memory/3840-130-0x00000000033D0000-0x00000000033E1000-memory.dmpFilesize
68KB
-
memory/3840-125-0x000000000041D080-mapping.dmp
-
memory/3840-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB