Analysis
-
max time kernel
146s -
max time network
196s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
30-08-2021 17:59
Static task
static1
Behavioral task
behavioral1
Sample
PO pdf.exe
Resource
win7v20210408
General
-
Target
PO pdf.exe
-
Size
821KB
-
MD5
3b6c42f05964fe8f2625c9a812651305
-
SHA1
f294cb34db5a3a40b2f3ce054220746fb47ab9f2
-
SHA256
2cb7c7c1cb918607912be236d42152a8f9d5347cabf4e815940f2b85c5d9f026
-
SHA512
b9189896186d3197336adbbd94de0f3d7098b397659369ff8a3bf2e81deeef2ddb4d1b8a2a557aa060fafd71a21c7591deb1be74084900f0373908d2d6479eb0
Malware Config
Extracted
xloader
2.3
k8b5
http://www.chongzhi365.com/k8b5/
sardamedicals.com
reelectkendavis4council.com
coreconsultation.com
fajarazhary.com
mybitearner.com
brightpet.info
voicewithchoice.com
bailbondscompany.xyz
7133333333.com
delights.info
gawlvegdr.icu
sdqhpm.com
we2savvyok.com
primallifeathlete.com
gdsinglecell.com
isokineticmachines.com
smartneckrelax.com
gardenvintage.com
hiphopvolume.com
medicapoint.com
crybebe.com
elevatedgameplay.com
armespublishing.com
pathsiteofficial.com
xn--e-2fa.com
besoxie.com
pro-montage.com
smartsmsfloan.net
gafinstallations.com
osk2279.com
sexcam-live-sex.net
supermomsd.com
villa-sardi.com
nkb-webmart.com
vaaccidentdoctorsnearme.net
sewcialdistancesewing.com
smodery.com
mimik33.com
employeepremiumassistance.com
chenqixuan.com
whyyousuckatgolfmovie.com
scholarshdesk.xyz
suenosenescena.com
ombaked.com
growingbargains.com
growbigelite.com
michalwroblewski.online
selfpublishingprojectmgmt.com
salir.info
lutherdanavan.com
caraccidentlawyernearme.net
portraitverse.com
secure-alerts901.info
reviewscanada.com
andreasaction.com
mblinks.net
regulationtoshop.com
borderless-farm.com
excitingdailyshop.com
pawandalmia.net
greatplainsjane.com
operacionapoyo.com
26gibraltardrive.com
getportlandjustice.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/316-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/316-67-0x000000000041D0B0-mapping.dmp xloader behavioral1/memory/1328-75-0x0000000000110000-0x0000000000139000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2040 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO pdf.exePO pdf.exerundll32.exedescription pid process target process PID 564 set thread context of 316 564 PO pdf.exe PO pdf.exe PID 316 set thread context of 1200 316 PO pdf.exe Explorer.EXE PID 1328 set thread context of 1200 1328 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 19 IoCs
Processes:
PO pdf.exerundll32.exepid process 316 PO pdf.exe 316 PO pdf.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe 1328 rundll32.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO pdf.exerundll32.exepid process 316 PO pdf.exe 316 PO pdf.exe 316 PO pdf.exe 1328 rundll32.exe 1328 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO pdf.exerundll32.exedescription pid process Token: SeDebugPrivilege 316 PO pdf.exe Token: SeDebugPrivilege 1328 rundll32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
PO pdf.exeExplorer.EXErundll32.exedescription pid process target process PID 564 wrote to memory of 316 564 PO pdf.exe PO pdf.exe PID 564 wrote to memory of 316 564 PO pdf.exe PO pdf.exe PID 564 wrote to memory of 316 564 PO pdf.exe PO pdf.exe PID 564 wrote to memory of 316 564 PO pdf.exe PO pdf.exe PID 564 wrote to memory of 316 564 PO pdf.exe PO pdf.exe PID 564 wrote to memory of 316 564 PO pdf.exe PO pdf.exe PID 564 wrote to memory of 316 564 PO pdf.exe PO pdf.exe PID 1200 wrote to memory of 1328 1200 Explorer.EXE rundll32.exe PID 1200 wrote to memory of 1328 1200 Explorer.EXE rundll32.exe PID 1200 wrote to memory of 1328 1200 Explorer.EXE rundll32.exe PID 1200 wrote to memory of 1328 1200 Explorer.EXE rundll32.exe PID 1200 wrote to memory of 1328 1200 Explorer.EXE rundll32.exe PID 1200 wrote to memory of 1328 1200 Explorer.EXE rundll32.exe PID 1200 wrote to memory of 1328 1200 Explorer.EXE rundll32.exe PID 1328 wrote to memory of 2040 1328 rundll32.exe cmd.exe PID 1328 wrote to memory of 2040 1328 rundll32.exe cmd.exe PID 1328 wrote to memory of 2040 1328 rundll32.exe cmd.exe PID 1328 wrote to memory of 2040 1328 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/316-69-0x00000000000F0000-0x0000000000100000-memory.dmpFilesize
64KB
-
memory/316-68-0x0000000000A40000-0x0000000000D43000-memory.dmpFilesize
3.0MB
-
memory/316-67-0x000000000041D0B0-mapping.dmp
-
memory/564-65-0x0000000000BD0000-0x0000000000C06000-memory.dmpFilesize
216KB
-
memory/564-60-0x0000000001000000-0x0000000001001000-memory.dmpFilesize
4KB
-
memory/564-64-0x0000000005D90000-0x0000000005DF7000-memory.dmpFilesize
412KB
-
memory/564-63-0x00000000005C0000-0x00000000005D6000-memory.dmpFilesize
88KB
-
memory/564-62-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1200-70-0x0000000006130000-0x000000000621E000-memory.dmpFilesize
952KB
-
memory/1200-78-0x00000000063D0000-0x0000000006504000-memory.dmpFilesize
1.2MB
-
memory/1328-72-0x00000000757C1000-0x00000000757C3000-memory.dmpFilesize
8KB
-
memory/1328-74-0x0000000000EE0000-0x0000000000EEE000-memory.dmpFilesize
56KB
-
memory/1328-75-0x0000000000110000-0x0000000000139000-memory.dmpFilesize
164KB
-
memory/1328-76-0x0000000000B40000-0x0000000000E43000-memory.dmpFilesize
3.0MB
-
memory/1328-77-0x0000000000A60000-0x0000000000AEF000-memory.dmpFilesize
572KB
-
memory/1328-71-0x0000000000000000-mapping.dmp
-
memory/2040-73-0x0000000000000000-mapping.dmp