Analysis
-
max time kernel
162s -
max time network
167s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-08-2021 13:44
Static task
static1
Behavioral task
behavioral1
Sample
PO pdf.exe
Resource
win7v20210408
General
-
Target
PO pdf.exe
-
Size
821KB
-
MD5
3b6c42f05964fe8f2625c9a812651305
-
SHA1
f294cb34db5a3a40b2f3ce054220746fb47ab9f2
-
SHA256
2cb7c7c1cb918607912be236d42152a8f9d5347cabf4e815940f2b85c5d9f026
-
SHA512
b9189896186d3197336adbbd94de0f3d7098b397659369ff8a3bf2e81deeef2ddb4d1b8a2a557aa060fafd71a21c7591deb1be74084900f0373908d2d6479eb0
Malware Config
Extracted
xloader
2.3
k8b5
http://www.chongzhi365.com/k8b5/
sardamedicals.com
reelectkendavis4council.com
coreconsultation.com
fajarazhary.com
mybitearner.com
brightpet.info
voicewithchoice.com
bailbondscompany.xyz
7133333333.com
delights.info
gawlvegdr.icu
sdqhpm.com
we2savvyok.com
primallifeathlete.com
gdsinglecell.com
isokineticmachines.com
smartneckrelax.com
gardenvintage.com
hiphopvolume.com
medicapoint.com
crybebe.com
elevatedgameplay.com
armespublishing.com
pathsiteofficial.com
xn--e-2fa.com
besoxie.com
pro-montage.com
smartsmsfloan.net
gafinstallations.com
osk2279.com
sexcam-live-sex.net
supermomsd.com
villa-sardi.com
nkb-webmart.com
vaaccidentdoctorsnearme.net
sewcialdistancesewing.com
smodery.com
mimik33.com
employeepremiumassistance.com
chenqixuan.com
whyyousuckatgolfmovie.com
scholarshdesk.xyz
suenosenescena.com
ombaked.com
growingbargains.com
growbigelite.com
michalwroblewski.online
selfpublishingprojectmgmt.com
salir.info
lutherdanavan.com
caraccidentlawyernearme.net
portraitverse.com
secure-alerts901.info
reviewscanada.com
andreasaction.com
mblinks.net
regulationtoshop.com
borderless-farm.com
excitingdailyshop.com
pawandalmia.net
greatplainsjane.com
operacionapoyo.com
26gibraltardrive.com
getportlandjustice.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3220-125-0x000000000041D0B0-mapping.dmp xloader behavioral2/memory/3220-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1152-132-0x0000000000830000-0x0000000000859000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
PO pdf.exePO pdf.exeNETSTAT.EXEdescription pid process target process PID 1404 set thread context of 3220 1404 PO pdf.exe PO pdf.exe PID 3220 set thread context of 3008 3220 PO pdf.exe Explorer.EXE PID 1152 set thread context of 3008 1152 NETSTAT.EXE Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 1152 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
PO pdf.exeNETSTAT.EXEpid process 3220 PO pdf.exe 3220 PO pdf.exe 3220 PO pdf.exe 3220 PO pdf.exe 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE 1152 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
PO pdf.exeNETSTAT.EXEpid process 3220 PO pdf.exe 3220 PO pdf.exe 3220 PO pdf.exe 1152 NETSTAT.EXE 1152 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO pdf.exeNETSTAT.EXEdescription pid process Token: SeDebugPrivilege 3220 PO pdf.exe Token: SeDebugPrivilege 1152 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
PO pdf.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 1404 wrote to memory of 3220 1404 PO pdf.exe PO pdf.exe PID 1404 wrote to memory of 3220 1404 PO pdf.exe PO pdf.exe PID 1404 wrote to memory of 3220 1404 PO pdf.exe PO pdf.exe PID 1404 wrote to memory of 3220 1404 PO pdf.exe PO pdf.exe PID 1404 wrote to memory of 3220 1404 PO pdf.exe PO pdf.exe PID 1404 wrote to memory of 3220 1404 PO pdf.exe PO pdf.exe PID 3008 wrote to memory of 1152 3008 Explorer.EXE NETSTAT.EXE PID 3008 wrote to memory of 1152 3008 Explorer.EXE NETSTAT.EXE PID 3008 wrote to memory of 1152 3008 Explorer.EXE NETSTAT.EXE PID 1152 wrote to memory of 2264 1152 NETSTAT.EXE cmd.exe PID 1152 wrote to memory of 2264 1152 NETSTAT.EXE cmd.exe PID 1152 wrote to memory of 2264 1152 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO pdf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1152-134-0x0000000002EF0000-0x0000000002F7F000-memory.dmpFilesize
572KB
-
memory/1152-132-0x0000000000830000-0x0000000000859000-memory.dmpFilesize
164KB
-
memory/1152-131-0x00000000008D0000-0x00000000008DB000-memory.dmpFilesize
44KB
-
memory/1152-129-0x0000000000000000-mapping.dmp
-
memory/1152-133-0x0000000003090000-0x00000000033B0000-memory.dmpFilesize
3.1MB
-
memory/1404-118-0x0000000003370000-0x0000000003371000-memory.dmpFilesize
4KB
-
memory/1404-121-0x0000000009150000-0x0000000009151000-memory.dmpFilesize
4KB
-
memory/1404-122-0x00000000019A0000-0x0000000001A07000-memory.dmpFilesize
412KB
-
memory/1404-123-0x00000000090B0000-0x00000000090E6000-memory.dmpFilesize
216KB
-
memory/1404-120-0x0000000009080000-0x0000000009096000-memory.dmpFilesize
88KB
-
memory/1404-119-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/1404-117-0x0000000005920000-0x0000000005921000-memory.dmpFilesize
4KB
-
memory/1404-116-0x0000000005EF0000-0x0000000005EF1000-memory.dmpFilesize
4KB
-
memory/1404-114-0x0000000000FA0000-0x0000000000FA1000-memory.dmpFilesize
4KB
-
memory/2264-130-0x0000000000000000-mapping.dmp
-
memory/3008-128-0x0000000002CA0000-0x0000000002D91000-memory.dmpFilesize
964KB
-
memory/3008-135-0x0000000004E20000-0x0000000004EDB000-memory.dmpFilesize
748KB
-
memory/3220-126-0x0000000000F50000-0x0000000001270000-memory.dmpFilesize
3.1MB
-
memory/3220-127-0x0000000000AD0000-0x0000000000AE0000-memory.dmpFilesize
64KB
-
memory/3220-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3220-125-0x000000000041D0B0-mapping.dmp