Analysis
- max time kernel
151s - max time network
153s - platform
windows10_x64 - resource
win10v20210408 - submitted
03/08/2021, 13:01
Static task
static1
Behavioral task
behavioral1
Sample
ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe
- Size 455KB
- Sample210803-e1q46qt6rx
- SHA256 9b985974efb3d7555b61cec77f2667cd6aca5f74a07f712b3aa58a54aa03bebb
- MD5 8e6c4dd7ce47a6a456438eb5df06e52c
- SHA1 838e6c7f24bef22088d140c851cd1a3c35c9f241
- SHA512 89881068b4aa6476a45e4c5538678bad7a636f8c82e6831c044e7f4a0b3fc45e6a0f4717b328f09d2f0f23e7a60624031eb59aa65180d2cd8b30fd40012db440
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.3
C2
-
http://www.sutsci.com/d8ak/
Decoy
-
slingshots305.com
-
egemv.com
-
purplewrld.com
-
thaipayakorn.com
-
crontabcyber.com
-
wolfalike.com
-
tedstbrice.com
-
bbwtrip.com
-
clothestokidsri.com
-
experienanidworks.com
-
acuityhealthcare.xyz
-
applepai.net
-
happytownmayor.net
-
xn--vltadvisors-2eb.com
-
garbagegenius.com
-
ndddxs.com
-
accuratearrangements.com
-
wraptecny.com
-
torontomassage.club
-
ifem-ci.com
-
highestmargin.com
-
rahsiaboya.com
-
cafe2hk.com
-
peakreia.com
-
michelleurena.com
-
teentera.com
-
highendsmokeshops.com
-
one-san.net
-
marketplace-576268732.com
-
thesiswritinghelpfvb.com
-
35fengbei.com
-
thewindsurfinggypsy.com
-
magnoliaranchkennels.com
-
scottkenan.com
-
rasaenterprise.com
-
sanidom.com
-
boydyourvoice.com
-
akasoutheastern.com
-
neryder.com
-
pharmpolis.online
-
bainrix.com
-
bonaldi-marbrerie.com
-
onefitearth.com
-
theharkapp.com
-
geaux-la.com
-
therestingspot.com
-
soulfxjuice.com
-
lakestateallstars.com
-
cristofiam.com
-
findersinvestigationsinc.com
-
faithhonorsupport.com
-
bw985.com
-
crosschainconsulting.com
-
credit-du-nord-connexion.net
-
leedermeyer.com
-
4157709022.com
-
zyxoothgy.xyz
-
hotel-met-hond.com
-
hibiskurpiest.site
-
zx776.com
-
intothought.com
-
jardin-rent.com
-
zwtouzi.com
-
santapaularotary.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/1772-116-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/2740-123-0x0000000000B50000-0x0000000000B78000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3628 set thread context of 1772 3628 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 74 PID 1772 set thread context of 3024 1772 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 52 PID 2740 set thread context of 3024 2740 colorcpl.exe 52 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1772 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 1772 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 1772 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 1772 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe 2740 colorcpl.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3628 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 1772 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 1772 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 1772 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 2740 colorcpl.exe 2740 colorcpl.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1772 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe Token: SeDebugPrivilege 2740 colorcpl.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3024 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3628 wrote to memory of 1772 3628 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 74 PID 3628 wrote to memory of 1772 3628 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 74 PID 3628 wrote to memory of 1772 3628 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 74 PID 3628 wrote to memory of 1772 3628 ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe 74 PID 3024 wrote to memory of 2740 3024 Explorer.EXE 76 PID 3024 wrote to memory of 2740 3024 Explorer.EXE 76 PID 3024 wrote to memory of 2740 3024 Explorer.EXE 76 PID 2740 wrote to memory of 188 2740 colorcpl.exe 79 PID 2740 wrote to memory of 188 2740 colorcpl.exe 79 PID 2740 wrote to memory of 188 2740 colorcpl.exe 79
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe"C:\Users\Admin\AppData\Local\Temp\ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe"C:\Users\Admin\AppData\Local\Temp\ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1772
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ORIGINAL PROFORMA INVOICE COAU7220898130,PDF.exe"3⤵PID:188
-
-