Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 11:23
Static task
static1
Behavioral task
behavioral1
Sample
Sales Order.exe
Resource
win7v20210410
General
-
Target
Sales Order.exe
-
Size
1014KB
-
MD5
fd84eb337a51966294ba08722170bf46
-
SHA1
1f529d60e2dc50deaac59af322708039da33c3be
-
SHA256
8da806444010084307c77bf3a69f66ca36c15920bd7b9f60fdcf35fccd460701
-
SHA512
a522ba8c6daddbf69f711ef859c7e8fb79e2ab00372e6626af9119d82ef8cf22b0e2ebcc1897cd88810be5ee01b11e0950dbf0853ceb630de3e916ac3bacd847
Malware Config
Extracted
xloader
2.3
http://www.jantesetaccessoires.com/p6f2/
redsnews.com
vr859.com
postmasterstudios.com
hampsteadorganizer.com
hangshop.net
maheshwaramlawcollege.com
5156087.com
gtaaddict.com
faj.xyz
drivechicagoillinois.com
neerutech.com
b2brahmas.com
freshlookks.com
propertyparallel.tech
tlwbyads.com
sellektorkids.com
dexs.fyi
kileybrock.com
nervstudio.com
tosg-ltd.com
admibd.com
hilariousfakenews.com
lub-additive.com
securecloudinfo.com
xn--jde.com
andtheskywentred.com
nearestgreenbeverage.net
tipthemusician.com
koziolwojciech.com
ryosecurity.com
cosypromotion.com
qvvn.life
emcelt.com
ersatzair.com
blassmail.online
florianlecerf.com
shannonsmithcounseling.com
litorin.com
plusproduce.net
sandersonfarnns.com
medicservic.com
mostmegaproductions.com
eldorado88casino.com
hordlife.com
drgunjankumaribhagwat.com
iregentos.info
lifeonprimroselane.com
playstoreaddps.com
anacquiredtastepodcast.com
chinachaohuo.com
xn--80aafif4agv1ai.xn--p1acf
flmoisture.com
framebooth.net
wildhare.media
1000praises.com
tna.zone
kravmagatacticalacademy.com
jasonwang.online
suruyorum.com
concretepill.com
alfarouqco.com
reliefpaypal.com
xn--fujtherma-xpb.com
petgsafetyseal.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3792-125-0x000000000041D050-mapping.dmp xloader behavioral2/memory/3792-124-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/200-132-0x0000000003200000-0x0000000003228000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Sales Order.exeSales Order.execolorcpl.exedescription pid process target process PID 1852 set thread context of 3792 1852 Sales Order.exe Sales Order.exe PID 3792 set thread context of 2680 3792 Sales Order.exe Explorer.EXE PID 200 set thread context of 2680 200 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Sales Order.exeSales Order.execolorcpl.exepid process 1852 Sales Order.exe 1852 Sales Order.exe 3792 Sales Order.exe 3792 Sales Order.exe 3792 Sales Order.exe 3792 Sales Order.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe 200 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2680 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Sales Order.execolorcpl.exepid process 3792 Sales Order.exe 3792 Sales Order.exe 3792 Sales Order.exe 200 colorcpl.exe 200 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
Sales Order.exeSales Order.exeExplorer.EXEcolorcpl.exedescription pid process Token: SeDebugPrivilege 1852 Sales Order.exe Token: SeDebugPrivilege 3792 Sales Order.exe Token: SeShutdownPrivilege 2680 Explorer.EXE Token: SeCreatePagefilePrivilege 2680 Explorer.EXE Token: SeShutdownPrivilege 2680 Explorer.EXE Token: SeCreatePagefilePrivilege 2680 Explorer.EXE Token: SeDebugPrivilege 200 colorcpl.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 2680 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Sales Order.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 1852 wrote to memory of 3576 1852 Sales Order.exe Sales Order.exe PID 1852 wrote to memory of 3576 1852 Sales Order.exe Sales Order.exe PID 1852 wrote to memory of 3576 1852 Sales Order.exe Sales Order.exe PID 1852 wrote to memory of 3792 1852 Sales Order.exe Sales Order.exe PID 1852 wrote to memory of 3792 1852 Sales Order.exe Sales Order.exe PID 1852 wrote to memory of 3792 1852 Sales Order.exe Sales Order.exe PID 1852 wrote to memory of 3792 1852 Sales Order.exe Sales Order.exe PID 1852 wrote to memory of 3792 1852 Sales Order.exe Sales Order.exe PID 1852 wrote to memory of 3792 1852 Sales Order.exe Sales Order.exe PID 2680 wrote to memory of 200 2680 Explorer.EXE colorcpl.exe PID 2680 wrote to memory of 200 2680 Explorer.EXE colorcpl.exe PID 2680 wrote to memory of 200 2680 Explorer.EXE colorcpl.exe PID 200 wrote to memory of 4000 200 colorcpl.exe cmd.exe PID 200 wrote to memory of 4000 200 colorcpl.exe cmd.exe PID 200 wrote to memory of 4000 200 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Sales Order.exe"C:\Users\Admin\AppData\Local\Temp\Sales Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Sales Order.exe"C:\Users\Admin\AppData\Local\Temp\Sales Order.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Sales Order.exe"C:\Users\Admin\AppData\Local\Temp\Sales Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Sales Order.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/200-134-0x0000000004AE0000-0x0000000004B6F000-memory.dmpFilesize
572KB
-
memory/200-131-0x0000000000CF0000-0x0000000000D09000-memory.dmpFilesize
100KB
-
memory/200-129-0x0000000000000000-mapping.dmp
-
memory/200-133-0x0000000004730000-0x0000000004A50000-memory.dmpFilesize
3.1MB
-
memory/200-132-0x0000000003200000-0x0000000003228000-memory.dmpFilesize
160KB
-
memory/1852-119-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/1852-122-0x0000000005770000-0x00000000057EB000-memory.dmpFilesize
492KB
-
memory/1852-121-0x0000000005480000-0x0000000005512000-memory.dmpFilesize
584KB
-
memory/1852-123-0x00000000054E0000-0x00000000054EF000-memory.dmpFilesize
60KB
-
memory/1852-120-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/1852-114-0x0000000000B80000-0x0000000000B81000-memory.dmpFilesize
4KB
-
memory/1852-118-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/1852-117-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/1852-116-0x0000000005AF0000-0x0000000005AF1000-memory.dmpFilesize
4KB
-
memory/2680-135-0x0000000005BC0000-0x0000000005CA9000-memory.dmpFilesize
932KB
-
memory/2680-128-0x0000000005A90000-0x0000000005BBB000-memory.dmpFilesize
1.2MB
-
memory/3792-124-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3792-127-0x0000000000D00000-0x0000000000D10000-memory.dmpFilesize
64KB
-
memory/3792-126-0x0000000001270000-0x0000000001590000-memory.dmpFilesize
3.1MB
-
memory/3792-125-0x000000000041D050-mapping.dmp
-
memory/4000-130-0x0000000000000000-mapping.dmp