Analysis
- max time kernel
150s - max time network
164s - platform
windows10_x64 - resource
win10v20210410 - submitted
05/08/2021, 13:06
Static task
static1
Behavioral task
behavioral1
Sample
FedEx AWB# 774174658339,PDF.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target FedEx AWB# 774174658339,PDF.exe
- Size 511KB
- Sample210805-enb7b5yjvx
- SHA256 ea38a026b9c1764cc7e1028c9674c2cb6fef4c4861ba643976c686ea79d040f8
- MD5 b23671714a2acee8b2056b92844b2226
- SHA1 a48ae5691fa6c0ea89ea77f228325c62dfe6725f
- SHA512 4567ca543c8e6b592ad55d0796da21c6d0160524da33c9ac8e02e3845f3ca0c3c6423db30b4ce66ca56f7ae6b04743379f590f14df3237634aead2a82d6d3878
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.3
C2
-
http://www.sutsci.com/d8ak/
Decoy
-
slingshots305.com
-
egemv.com
-
purplewrld.com
-
thaipayakorn.com
-
crontabcyber.com
-
wolfalike.com
-
tedstbrice.com
-
bbwtrip.com
-
clothestokidsri.com
-
experienanidworks.com
-
acuityhealthcare.xyz
-
applepai.net
-
happytownmayor.net
-
xn--vltadvisors-2eb.com
-
garbagegenius.com
-
ndddxs.com
-
accuratearrangements.com
-
wraptecny.com
-
torontomassage.club
-
ifem-ci.com
-
highestmargin.com
-
rahsiaboya.com
-
cafe2hk.com
-
peakreia.com
-
michelleurena.com
-
teentera.com
-
highendsmokeshops.com
-
one-san.net
-
marketplace-576268732.com
-
thesiswritinghelpfvb.com
-
35fengbei.com
-
thewindsurfinggypsy.com
-
magnoliaranchkennels.com
-
scottkenan.com
-
rasaenterprise.com
-
sanidom.com
-
boydyourvoice.com
-
akasoutheastern.com
-
neryder.com
-
pharmpolis.online
-
bainrix.com
-
bonaldi-marbrerie.com
-
onefitearth.com
-
theharkapp.com
-
geaux-la.com
-
therestingspot.com
-
soulfxjuice.com
-
lakestateallstars.com
-
cristofiam.com
-
findersinvestigationsinc.com
-
faithhonorsupport.com
-
bw985.com
-
crosschainconsulting.com
-
credit-du-nord-connexion.net
-
leedermeyer.com
-
4157709022.com
-
zyxoothgy.xyz
-
hotel-met-hond.com
-
hibiskurpiest.site
-
zx776.com
-
intothought.com
-
jardin-rent.com
-
zwtouzi.com
-
santapaularotary.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/1600-116-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3884-122-0x0000000000F70000-0x0000000000F98000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3876 set thread context of 1600 3876 FedEx AWB# 774174658339,PDF.exe 76 PID 1600 set thread context of 3016 1600 FedEx AWB# 774174658339,PDF.exe 23 PID 3884 set thread context of 3016 3884 rundll32.exe 23 - Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 1600 FedEx AWB# 774174658339,PDF.exe 1600 FedEx AWB# 774174658339,PDF.exe 1600 FedEx AWB# 774174658339,PDF.exe 1600 FedEx AWB# 774174658339,PDF.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe 3884 rundll32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3016 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3876 FedEx AWB# 774174658339,PDF.exe 1600 FedEx AWB# 774174658339,PDF.exe 1600 FedEx AWB# 774174658339,PDF.exe 1600 FedEx AWB# 774174658339,PDF.exe 3884 rundll32.exe 3884 rundll32.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1600 FedEx AWB# 774174658339,PDF.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeDebugPrivilege 3884 rundll32.exe Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE Token: SeShutdownPrivilege 3016 Explorer.EXE Token: SeCreatePagefilePrivilege 3016 Explorer.EXE - Suspicious use of UnmapMainImage 1 IoCs
pid Process 3016 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3876 wrote to memory of 1600 3876 FedEx AWB# 774174658339,PDF.exe 76 PID 3876 wrote to memory of 1600 3876 FedEx AWB# 774174658339,PDF.exe 76 PID 3876 wrote to memory of 1600 3876 FedEx AWB# 774174658339,PDF.exe 76 PID 3876 wrote to memory of 1600 3876 FedEx AWB# 774174658339,PDF.exe 76 PID 3016 wrote to memory of 3884 3016 Explorer.EXE 78 PID 3016 wrote to memory of 3884 3016 Explorer.EXE 78 PID 3016 wrote to memory of 3884 3016 Explorer.EXE 78 PID 3884 wrote to memory of 1168 3884 rundll32.exe 81 PID 3884 wrote to memory of 1168 3884 rundll32.exe 81 PID 3884 wrote to memory of 1168 3884 rundll32.exe 81
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\FedEx AWB# 774174658339,PDF.exe"C:\Users\Admin\AppData\Local\Temp\FedEx AWB# 774174658339,PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\FedEx AWB# 774174658339,PDF.exe"C:\Users\Admin\AppData\Local\Temp\FedEx AWB# 774174658339,PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\FedEx AWB# 774174658339,PDF.exe"3⤵PID:1168
-
-