Analysis
-
max time kernel
302s -
max time network
336s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 02:35
Static task
static1
Behavioral task
behavioral1
Sample
RFQ356284678,pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
RFQ356284678,pdf.exe
Resource
win10-en
General
-
Target
RFQ356284678,pdf.exe
-
Size
401KB
-
MD5
30b799e145ec03674de8d27ae3e5c0ba
-
SHA1
339a5df9d70b31d0b59a5e97d672f12ccb67e45e
-
SHA256
5df88b107258b6f9b91512ca18b098fec01005b71eed470932f006103d5bb346
-
SHA512
d37d9be8f9bc3c17afead37c22b91a96fe2cb4314d09424270e75b2f36d7be4a9d560540909508170f8c0e3e2d1ba0635595045a6299ea5e6f8be215007b841e
Malware Config
Extracted
xloader
2.3
gv6d
http://www.breakaway.uk/gv6d/
bigfatgay.com
czrsgd168.com
bnkinvestments.com
uhchearingfl.com
hooktowingco.com
bold2x.com
dirtyhandsdigital.com
princetonreviewes.com
typhoonmusicgroup.com
onlinemathcoach.net
safecareethiopia.net
alvarogdeo.com
access-sca-login.pro
handbagswholesalemaster.com
whoaservices.com
telemunndopr.com
dream2works.com
itemconfirmation.com
kentebags.com
chennaipremium.com
galoresgemsandjewellery.com
waithere123.com
rastrillodefrank.com
itssopersonal.com
foundacious.com
dev-forum.com
forthepig.com
elipbiy01.com
bowserinc.com
lightbarworld.com
argent-flair.today
ruggedbychoice.com
temptationsweet.com
skylineglobalbank.online
zermattsearch.com
djayfa.com
playmomsknowbest.com
pushoverdeclarev.club
urbansmile.net
snailsstory.com
cooperate-win.com
lightdelux.com
cafevoila.net
jiemanwu.com
nicborain.com
servicebayview.com
jiangkunsw.com
dailyplanetportal.info
zoroergonomics.com
maxwrage.com
yetlag.com
comercializadoraprogant.net
homapilot.com
beijinghun2.icu
easymailsend3088.xyz
chipotale.com
sexyonadime.com
cocosuperstore.com
suzysgifts.com
ultrajerseys.com
randomexperience.net
gocenterhome.com
zaredali.site
oyunvega.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1960-63-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/464-69-0x00000000000C0000-0x00000000000E8000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
wincds.exewincds.exepid process 912 wincds.exe 1016 wincds.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1508 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
NAPSTAT.EXEdescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run NAPSTAT.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HZ5LUHMXCN = "C:\\Program Files (x86)\\Gzlj8\\wincds.exe" NAPSTAT.EXE -
Suspicious use of SetThreadContext 4 IoCs
Processes:
RFQ356284678,pdf.exeRFQ356284678,pdf.exeNAPSTAT.EXEwincds.exedescription pid process target process PID 1976 set thread context of 1960 1976 RFQ356284678,pdf.exe RFQ356284678,pdf.exe PID 1960 set thread context of 1228 1960 RFQ356284678,pdf.exe Explorer.EXE PID 464 set thread context of 1228 464 NAPSTAT.EXE Explorer.EXE PID 912 set thread context of 1016 912 wincds.exe wincds.exe -
Drops file in Program Files directory 2 IoCs
Processes:
NAPSTAT.EXEExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Gzlj8\wincds.exe NAPSTAT.EXE File created C:\Program Files (x86)\Gzlj8\wincds.exe Explorer.EXE -
Processes:
NAPSTAT.EXEdescription ioc process Key created \Registry\User\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 NAPSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
RFQ356284678,pdf.exeNAPSTAT.EXEwincds.exepid process 1960 RFQ356284678,pdf.exe 1960 RFQ356284678,pdf.exe 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 1016 wincds.exe 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE -
Suspicious behavior: MapViewOfSection 9 IoCs
Processes:
RFQ356284678,pdf.exeRFQ356284678,pdf.exeNAPSTAT.EXEwincds.exepid process 1976 RFQ356284678,pdf.exe 1960 RFQ356284678,pdf.exe 1960 RFQ356284678,pdf.exe 1960 RFQ356284678,pdf.exe 464 NAPSTAT.EXE 464 NAPSTAT.EXE 464 NAPSTAT.EXE 912 wincds.exe 464 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
RFQ356284678,pdf.exeNAPSTAT.EXEExplorer.EXEwincds.exedescription pid process Token: SeDebugPrivilege 1960 RFQ356284678,pdf.exe Token: SeDebugPrivilege 464 NAPSTAT.EXE Token: SeShutdownPrivilege 1228 Explorer.EXE Token: SeShutdownPrivilege 1228 Explorer.EXE Token: SeShutdownPrivilege 1228 Explorer.EXE Token: SeDebugPrivilege 1016 wincds.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
RFQ356284678,pdf.exeExplorer.EXENAPSTAT.EXEwincds.exedescription pid process target process PID 1976 wrote to memory of 1960 1976 RFQ356284678,pdf.exe RFQ356284678,pdf.exe PID 1976 wrote to memory of 1960 1976 RFQ356284678,pdf.exe RFQ356284678,pdf.exe PID 1976 wrote to memory of 1960 1976 RFQ356284678,pdf.exe RFQ356284678,pdf.exe PID 1976 wrote to memory of 1960 1976 RFQ356284678,pdf.exe RFQ356284678,pdf.exe PID 1976 wrote to memory of 1960 1976 RFQ356284678,pdf.exe RFQ356284678,pdf.exe PID 1228 wrote to memory of 464 1228 Explorer.EXE NAPSTAT.EXE PID 1228 wrote to memory of 464 1228 Explorer.EXE NAPSTAT.EXE PID 1228 wrote to memory of 464 1228 Explorer.EXE NAPSTAT.EXE PID 1228 wrote to memory of 464 1228 Explorer.EXE NAPSTAT.EXE PID 464 wrote to memory of 1508 464 NAPSTAT.EXE cmd.exe PID 464 wrote to memory of 1508 464 NAPSTAT.EXE cmd.exe PID 464 wrote to memory of 1508 464 NAPSTAT.EXE cmd.exe PID 464 wrote to memory of 1508 464 NAPSTAT.EXE cmd.exe PID 464 wrote to memory of 1152 464 NAPSTAT.EXE Firefox.exe PID 464 wrote to memory of 1152 464 NAPSTAT.EXE Firefox.exe PID 464 wrote to memory of 1152 464 NAPSTAT.EXE Firefox.exe PID 464 wrote to memory of 1152 464 NAPSTAT.EXE Firefox.exe PID 1228 wrote to memory of 912 1228 Explorer.EXE wincds.exe PID 1228 wrote to memory of 912 1228 Explorer.EXE wincds.exe PID 1228 wrote to memory of 912 1228 Explorer.EXE wincds.exe PID 1228 wrote to memory of 912 1228 Explorer.EXE wincds.exe PID 912 wrote to memory of 1016 912 wincds.exe wincds.exe PID 912 wrote to memory of 1016 912 wincds.exe wincds.exe PID 912 wrote to memory of 1016 912 wincds.exe wincds.exe PID 912 wrote to memory of 1016 912 wincds.exe wincds.exe PID 912 wrote to memory of 1016 912 wincds.exe wincds.exe PID 464 wrote to memory of 1152 464 NAPSTAT.EXE Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ356284678,pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ356284678,pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ356284678,pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ356284678,pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ356284678,pdf.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Gzlj8\wincds.exe"C:\Program Files (x86)\Gzlj8\wincds.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Gzlj8\wincds.exe"C:\Program Files (x86)\Gzlj8\wincds.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Gzlj8\wincds.exeMD5
30b799e145ec03674de8d27ae3e5c0ba
SHA1339a5df9d70b31d0b59a5e97d672f12ccb67e45e
SHA2565df88b107258b6f9b91512ca18b098fec01005b71eed470932f006103d5bb346
SHA512d37d9be8f9bc3c17afead37c22b91a96fe2cb4314d09424270e75b2f36d7be4a9d560540909508170f8c0e3e2d1ba0635595045a6299ea5e6f8be215007b841e
-
C:\Program Files (x86)\Gzlj8\wincds.exeMD5
30b799e145ec03674de8d27ae3e5c0ba
SHA1339a5df9d70b31d0b59a5e97d672f12ccb67e45e
SHA2565df88b107258b6f9b91512ca18b098fec01005b71eed470932f006103d5bb346
SHA512d37d9be8f9bc3c17afead37c22b91a96fe2cb4314d09424270e75b2f36d7be4a9d560540909508170f8c0e3e2d1ba0635595045a6299ea5e6f8be215007b841e
-
C:\Program Files (x86)\Gzlj8\wincds.exeMD5
30b799e145ec03674de8d27ae3e5c0ba
SHA1339a5df9d70b31d0b59a5e97d672f12ccb67e45e
SHA2565df88b107258b6f9b91512ca18b098fec01005b71eed470932f006103d5bb346
SHA512d37d9be8f9bc3c17afead37c22b91a96fe2cb4314d09424270e75b2f36d7be4a9d560540909508170f8c0e3e2d1ba0635595045a6299ea5e6f8be215007b841e
-
memory/464-70-0x0000000001F10000-0x0000000002213000-memory.dmpFilesize
3.0MB
-
memory/464-72-0x0000000001D80000-0x0000000001E0F000-memory.dmpFilesize
572KB
-
memory/464-69-0x00000000000C0000-0x00000000000E8000-memory.dmpFilesize
160KB
-
memory/464-68-0x00000000007A0000-0x00000000007E6000-memory.dmpFilesize
280KB
-
memory/464-67-0x0000000000000000-mapping.dmp
-
memory/912-75-0x0000000000000000-mapping.dmp
-
memory/1016-79-0x000000000041CFC0-mapping.dmp
-
memory/1016-82-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/1152-81-0x0000000000000000-mapping.dmp
-
memory/1152-84-0x0000000000060000-0x000000000012A000-memory.dmpFilesize
808KB
-
memory/1152-83-0x000000013F210000-0x000000013F2A3000-memory.dmpFilesize
588KB
-
memory/1228-73-0x0000000004F40000-0x0000000005071000-memory.dmpFilesize
1.2MB
-
memory/1228-66-0x00000000041A0000-0x000000000427A000-memory.dmpFilesize
872KB
-
memory/1508-71-0x0000000000000000-mapping.dmp
-
memory/1960-63-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1960-61-0x000000000041CFC0-mapping.dmp
-
memory/1960-65-0x00000000000E0000-0x00000000000F0000-memory.dmpFilesize
64KB
-
memory/1960-64-0x0000000000990000-0x0000000000C93000-memory.dmpFilesize
3.0MB
-
memory/1976-62-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/1976-60-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB