Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-08-2021 17:59
Static task
static1
Behavioral task
behavioral1
Sample
PO pdf.exe
Resource
win7v20210408
General
-
Target
PO pdf.exe
-
Size
821KB
-
MD5
3b6c42f05964fe8f2625c9a812651305
-
SHA1
f294cb34db5a3a40b2f3ce054220746fb47ab9f2
-
SHA256
2cb7c7c1cb918607912be236d42152a8f9d5347cabf4e815940f2b85c5d9f026
-
SHA512
b9189896186d3197336adbbd94de0f3d7098b397659369ff8a3bf2e81deeef2ddb4d1b8a2a557aa060fafd71a21c7591deb1be74084900f0373908d2d6479eb0
Malware Config
Extracted
xloader
2.3
k8b5
http://www.chongzhi365.com/k8b5/
sardamedicals.com
reelectkendavis4council.com
coreconsultation.com
fajarazhary.com
mybitearner.com
brightpet.info
voicewithchoice.com
bailbondscompany.xyz
7133333333.com
delights.info
gawlvegdr.icu
sdqhpm.com
we2savvyok.com
primallifeathlete.com
gdsinglecell.com
isokineticmachines.com
smartneckrelax.com
gardenvintage.com
hiphopvolume.com
medicapoint.com
crybebe.com
elevatedgameplay.com
armespublishing.com
pathsiteofficial.com
xn--e-2fa.com
besoxie.com
pro-montage.com
smartsmsfloan.net
gafinstallations.com
osk2279.com
sexcam-live-sex.net
supermomsd.com
villa-sardi.com
nkb-webmart.com
vaaccidentdoctorsnearme.net
sewcialdistancesewing.com
smodery.com
mimik33.com
employeepremiumassistance.com
chenqixuan.com
whyyousuckatgolfmovie.com
scholarshdesk.xyz
suenosenescena.com
ombaked.com
growingbargains.com
growbigelite.com
michalwroblewski.online
selfpublishingprojectmgmt.com
salir.info
lutherdanavan.com
caraccidentlawyernearme.net
portraitverse.com
secure-alerts901.info
reviewscanada.com
andreasaction.com
mblinks.net
regulationtoshop.com
borderless-farm.com
excitingdailyshop.com
pawandalmia.net
greatplainsjane.com
operacionapoyo.com
26gibraltardrive.com
getportlandjustice.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2216-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2216-125-0x000000000041D0B0-mapping.dmp xloader behavioral2/memory/2648-131-0x0000000000CF0000-0x0000000000D19000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO pdf.exePO pdf.exemstsc.exedescription pid process target process PID 656 set thread context of 2216 656 PO pdf.exe PO pdf.exe PID 2216 set thread context of 3020 2216 PO pdf.exe Explorer.EXE PID 2648 set thread context of 3020 2648 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
PO pdf.exemstsc.exepid process 2216 PO pdf.exe 2216 PO pdf.exe 2216 PO pdf.exe 2216 PO pdf.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe 2648 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO pdf.exemstsc.exepid process 2216 PO pdf.exe 2216 PO pdf.exe 2216 PO pdf.exe 2648 mstsc.exe 2648 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO pdf.exemstsc.exedescription pid process Token: SeDebugPrivilege 2216 PO pdf.exe Token: SeDebugPrivilege 2648 mstsc.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO pdf.exeExplorer.EXEmstsc.exedescription pid process target process PID 656 wrote to memory of 2216 656 PO pdf.exe PO pdf.exe PID 656 wrote to memory of 2216 656 PO pdf.exe PO pdf.exe PID 656 wrote to memory of 2216 656 PO pdf.exe PO pdf.exe PID 656 wrote to memory of 2216 656 PO pdf.exe PO pdf.exe PID 656 wrote to memory of 2216 656 PO pdf.exe PO pdf.exe PID 656 wrote to memory of 2216 656 PO pdf.exe PO pdf.exe PID 3020 wrote to memory of 2648 3020 Explorer.EXE mstsc.exe PID 3020 wrote to memory of 2648 3020 Explorer.EXE mstsc.exe PID 3020 wrote to memory of 2648 3020 Explorer.EXE mstsc.exe PID 2648 wrote to memory of 1332 2648 mstsc.exe cmd.exe PID 2648 wrote to memory of 1332 2648 mstsc.exe cmd.exe PID 2648 wrote to memory of 1332 2648 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/656-114-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB
-
memory/656-116-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB
-
memory/656-117-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/656-118-0x0000000005780000-0x0000000005C7E000-memory.dmpFilesize
5.0MB
-
memory/656-119-0x0000000005800000-0x0000000005801000-memory.dmpFilesize
4KB
-
memory/656-120-0x0000000005B60000-0x0000000005B76000-memory.dmpFilesize
88KB
-
memory/656-121-0x00000000090E0000-0x00000000090E1000-memory.dmpFilesize
4KB
-
memory/656-122-0x0000000009180000-0x00000000091E7000-memory.dmpFilesize
412KB
-
memory/656-123-0x000000000B930000-0x000000000B966000-memory.dmpFilesize
216KB
-
memory/1332-133-0x0000000000000000-mapping.dmp
-
memory/2216-125-0x000000000041D0B0-mapping.dmp
-
memory/2216-127-0x0000000001460000-0x00000000015AA000-memory.dmpFilesize
1.3MB
-
memory/2216-126-0x0000000001930000-0x0000000001C50000-memory.dmpFilesize
3.1MB
-
memory/2216-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2648-129-0x0000000000000000-mapping.dmp
-
memory/2648-130-0x00000000011E0000-0x00000000014DC000-memory.dmpFilesize
3.0MB
-
memory/2648-131-0x0000000000CF0000-0x0000000000D19000-memory.dmpFilesize
164KB
-
memory/2648-132-0x0000000004FC0000-0x00000000052E0000-memory.dmpFilesize
3.1MB
-
memory/2648-134-0x0000000004EF0000-0x0000000004F7F000-memory.dmpFilesize
572KB
-
memory/3020-128-0x00000000028D0000-0x00000000029CA000-memory.dmpFilesize
1000KB
-
memory/3020-135-0x00000000008D0000-0x00000000009AE000-memory.dmpFilesize
888KB