Analysis
- max time kernel
148s - max time network
156s - platform
windows10_x64 - resource
win10v20210408 - submitted
12/09/2021, 13:00
Static task
static1
Behavioral task
behavioral1
Sample
order.exe
Resource
win7v20210408
windows7_x64
General
- Target order.exe
- Size 730KB
- Sample210912-p8nmwsfcdm
- SHA256 4b6fb9eac1ea52e013bfb4061a1232fe0d145bc9e260df9bd0d76b1a31be78bf
- MD5 37bfff255b323160a222c6573121a826
- SHA1 c9d5a770db875676f3ea062bbc6de83d4d8b5c2e
- SHA512 0a821d86618812d185c9952dbd14da68843efbd2fccb6a94e7137b764f04f72a4fd61861fa0fd95556a5f46456d7da311a8bd0d1f6aceac556a82c3c2a671c4d
- MD5 SHA1 SHA512
Malware Config
Extracted
-
xloader
-
2.3
-
angp
-
http://www.cartoonuniversetr.com/angp/
-
up24az.com
-
zeroveom.com
-
1digitalventures.com
-
forddongsaigon.com
-
ryota-mizusawa.com
-
quick-1k.com
-
startprofitsonline.com
-
thumbaycomforts.com
-
wigholes.website
-
makhariskloset.com
-
laranabcn.com
-
unseen.observer
-
multipliii.com
-
smartpod.tech
-
lightparis.com
-
reddetenis.com
-
forprosperliving.group
-
growingequityfund.com
-
youbuzc.com
-
kompromat.global
-
tvanchieta.com
-
zusbre.com
-
beijingban2.icu
-
beautybrowpen.com
-
broadwayvapeshops.com
-
securaproperty.com
-
398-genda.icu
-
karate-club-arbent.com
-
walkietalkiesforkids.com
-
watsonplumbingheating.com
-
automationagility.com
-
agaverealestateteam.com
-
thereprezentant.com
-
shrivastavwebsolutions.com
-
hydets.xyz
-
little-monsters.info
-
amorabeautygh.com
-
kuberabettingtip.com
-
cervezamaracaibo.com
-
diyblogphotos.com
-
upscalejob.com
-
osti-slim-001.host
-
tmcb2b.com
-
stuartdio.com
-
redemptionstorychurch.com
-
okinfocenter.com
-
activatemymind.com
-
dnadropnutrition.com
-
pietermaritzburgpower.com
-
fjxwddz.com
-
youngindwon.com
-
neworleanshemorrhoidcenter.com
-
blunss.info
-
thereglo.com
-
greeenshootsproductions.com
-
missasiasanfrancisco.com
-
oparinia.com
-
metroimportadores.com
-
thepremiumfreight.com
-
themodernthali.com
-
compallowshop.com
-
korsandroid.com
-
saqtrading.com
-
zhuanzhuana.club
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/484-119-0x0000000000000000-mapping.dmp xloader behavioral2/memory/484-121-0x0000000010410000-0x0000000010439000-memory.dmp xloader behavioral2/memory/804-128-0x00000000005A0000-0x00000000005C9000-memory.dmp xloader - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 484 set thread context of 3020 484 DpiScaling.exe 22 PID 804 set thread context of 3020 804 netsh.exe 22 - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 484 DpiScaling.exe 484 DpiScaling.exe 484 DpiScaling.exe 484 DpiScaling.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe 804 netsh.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3020 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 484 DpiScaling.exe 484 DpiScaling.exe 484 DpiScaling.exe 804 netsh.exe 804 netsh.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 484 DpiScaling.exe Token: SeDebugPrivilege 804 netsh.exe Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE Token: SeShutdownPrivilege 3020 Explorer.EXE Token: SeCreatePagefilePrivilege 3020 Explorer.EXE - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3008 wrote to memory of 484 3008 order.exe 68 PID 3008 wrote to memory of 484 3008 order.exe 68 PID 3008 wrote to memory of 484 3008 order.exe 68 PID 3008 wrote to memory of 484 3008 order.exe 68 PID 3008 wrote to memory of 484 3008 order.exe 68 PID 3008 wrote to memory of 484 3008 order.exe 68 PID 3020 wrote to memory of 804 3020 Explorer.EXE 69 PID 3020 wrote to memory of 804 3020 Explorer.EXE 69 PID 3020 wrote to memory of 804 3020 Explorer.EXE 69 PID 804 wrote to memory of 1012 804 netsh.exe 70 PID 804 wrote to memory of 1012 804 netsh.exe 70 PID 804 wrote to memory of 1012 804 netsh.exe 70
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\order.exe"C:\Users\Admin\AppData\Local\Temp\order.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:484
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\DpiScaling.exe"3⤵PID:1012
-
-