Analysis
-
max time kernel
300s -
max time network
299s -
platform
windows10_x64 -
resource
win10-en -
submitted
15-09-2021 02:35
Static task
static1
Behavioral task
behavioral1
Sample
RFQ356284678,pdf.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
RFQ356284678,pdf.exe
Resource
win10-en
General
-
Target
RFQ356284678,pdf.exe
-
Size
401KB
-
MD5
30b799e145ec03674de8d27ae3e5c0ba
-
SHA1
339a5df9d70b31d0b59a5e97d672f12ccb67e45e
-
SHA256
5df88b107258b6f9b91512ca18b098fec01005b71eed470932f006103d5bb346
-
SHA512
d37d9be8f9bc3c17afead37c22b91a96fe2cb4314d09424270e75b2f36d7be4a9d560540909508170f8c0e3e2d1ba0635595045a6299ea5e6f8be215007b841e
Malware Config
Extracted
xloader
2.3
gv6d
http://www.breakaway.uk/gv6d/
bigfatgay.com
czrsgd168.com
bnkinvestments.com
uhchearingfl.com
hooktowingco.com
bold2x.com
dirtyhandsdigital.com
princetonreviewes.com
typhoonmusicgroup.com
onlinemathcoach.net
safecareethiopia.net
alvarogdeo.com
access-sca-login.pro
handbagswholesalemaster.com
whoaservices.com
telemunndopr.com
dream2works.com
itemconfirmation.com
kentebags.com
chennaipremium.com
galoresgemsandjewellery.com
waithere123.com
rastrillodefrank.com
itssopersonal.com
foundacious.com
dev-forum.com
forthepig.com
elipbiy01.com
bowserinc.com
lightbarworld.com
argent-flair.today
ruggedbychoice.com
temptationsweet.com
skylineglobalbank.online
zermattsearch.com
djayfa.com
playmomsknowbest.com
pushoverdeclarev.club
urbansmile.net
snailsstory.com
cooperate-win.com
lightdelux.com
cafevoila.net
jiemanwu.com
nicborain.com
servicebayview.com
jiangkunsw.com
dailyplanetportal.info
zoroergonomics.com
maxwrage.com
yetlag.com
comercializadoraprogant.net
homapilot.com
beijinghun2.icu
easymailsend3088.xyz
chipotale.com
sexyonadime.com
cocosuperstore.com
suzysgifts.com
ultrajerseys.com
randomexperience.net
gocenterhome.com
zaredali.site
oyunvega.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/356-117-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/2556-125-0x00000000006B0000-0x00000000006D8000-memory.dmp xloader -
Executes dropped EXE 2 IoCs
Processes:
mjotol9hnn-lg.exemjotol9hnn-lg.exepid process 1008 mjotol9hnn-lg.exe 2152 mjotol9hnn-lg.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
systray.exedescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run systray.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OBCTFTBP-27 = "C:\\Program Files (x86)\\Cvtato\\mjotol9hnn-lg.exe" systray.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
RFQ356284678,pdf.exeRFQ356284678,pdf.exesystray.exemjotol9hnn-lg.exedescription pid process target process PID 4044 set thread context of 356 4044 RFQ356284678,pdf.exe RFQ356284678,pdf.exe PID 356 set thread context of 3036 356 RFQ356284678,pdf.exe Explorer.EXE PID 356 set thread context of 3036 356 RFQ356284678,pdf.exe Explorer.EXE PID 2556 set thread context of 3036 2556 systray.exe Explorer.EXE PID 1008 set thread context of 2152 1008 mjotol9hnn-lg.exe mjotol9hnn-lg.exe -
Drops file in Program Files directory 4 IoCs
Processes:
systray.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Cvtato\mjotol9hnn-lg.exe systray.exe File opened for modification C:\Program Files (x86)\Cvtato Explorer.EXE File created C:\Program Files (x86)\Cvtato\mjotol9hnn-lg.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Cvtato\mjotol9hnn-lg.exe Explorer.EXE -
Processes:
systray.exedescription ioc process Key created \Registry\User\S-1-5-21-2559286294-2439613352-4032193287-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 systray.exe -
Modifies registry class 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
RFQ356284678,pdf.exesystray.exepid process 356 RFQ356284678,pdf.exe 356 RFQ356284678,pdf.exe 356 RFQ356284678,pdf.exe 356 RFQ356284678,pdf.exe 356 RFQ356284678,pdf.exe 356 RFQ356284678,pdf.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE -
Suspicious behavior: MapViewOfSection 10 IoCs
Processes:
RFQ356284678,pdf.exeRFQ356284678,pdf.exesystray.exemjotol9hnn-lg.exepid process 4044 RFQ356284678,pdf.exe 356 RFQ356284678,pdf.exe 356 RFQ356284678,pdf.exe 356 RFQ356284678,pdf.exe 356 RFQ356284678,pdf.exe 2556 systray.exe 2556 systray.exe 2556 systray.exe 1008 mjotol9hnn-lg.exe 2556 systray.exe -
Suspicious use of AdjustPrivilegeToken 33 IoCs
Processes:
RFQ356284678,pdf.exeExplorer.EXEsystray.exemjotol9hnn-lg.exedescription pid process Token: SeDebugPrivilege 356 RFQ356284678,pdf.exe Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeDebugPrivilege 2556 systray.exe Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeDebugPrivilege 2152 mjotol9hnn-lg.exe Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE Token: SeShutdownPrivilege 3036 Explorer.EXE Token: SeCreatePagefilePrivilege 3036 Explorer.EXE -
Suspicious use of FindShellTrayWindow 9 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE 3036 Explorer.EXE 3036 Explorer.EXE 3036 Explorer.EXE 3036 Explorer.EXE 3036 Explorer.EXE 3036 Explorer.EXE 3036 Explorer.EXE 3036 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 3036 Explorer.EXE 3036 Explorer.EXE 3036 Explorer.EXE 3036 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
RFQ356284678,pdf.exeExplorer.EXEsystray.exemjotol9hnn-lg.exedescription pid process target process PID 4044 wrote to memory of 356 4044 RFQ356284678,pdf.exe RFQ356284678,pdf.exe PID 4044 wrote to memory of 356 4044 RFQ356284678,pdf.exe RFQ356284678,pdf.exe PID 4044 wrote to memory of 356 4044 RFQ356284678,pdf.exe RFQ356284678,pdf.exe PID 4044 wrote to memory of 356 4044 RFQ356284678,pdf.exe RFQ356284678,pdf.exe PID 3036 wrote to memory of 2556 3036 Explorer.EXE systray.exe PID 3036 wrote to memory of 2556 3036 Explorer.EXE systray.exe PID 3036 wrote to memory of 2556 3036 Explorer.EXE systray.exe PID 2556 wrote to memory of 3600 2556 systray.exe cmd.exe PID 2556 wrote to memory of 3600 2556 systray.exe cmd.exe PID 2556 wrote to memory of 3600 2556 systray.exe cmd.exe PID 2556 wrote to memory of 3580 2556 systray.exe Firefox.exe PID 2556 wrote to memory of 3580 2556 systray.exe Firefox.exe PID 3036 wrote to memory of 1008 3036 Explorer.EXE mjotol9hnn-lg.exe PID 3036 wrote to memory of 1008 3036 Explorer.EXE mjotol9hnn-lg.exe PID 3036 wrote to memory of 1008 3036 Explorer.EXE mjotol9hnn-lg.exe PID 1008 wrote to memory of 2152 1008 mjotol9hnn-lg.exe mjotol9hnn-lg.exe PID 1008 wrote to memory of 2152 1008 mjotol9hnn-lg.exe mjotol9hnn-lg.exe PID 1008 wrote to memory of 2152 1008 mjotol9hnn-lg.exe mjotol9hnn-lg.exe PID 1008 wrote to memory of 2152 1008 mjotol9hnn-lg.exe mjotol9hnn-lg.exe PID 2556 wrote to memory of 3580 2556 systray.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ356284678,pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ356284678,pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ356284678,pdf.exe"C:\Users\Admin\AppData\Local\Temp\RFQ356284678,pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ356284678,pdf.exe"3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\Cvtato\mjotol9hnn-lg.exe"C:\Program Files (x86)\Cvtato\mjotol9hnn-lg.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Cvtato\mjotol9hnn-lg.exe"C:\Program Files (x86)\Cvtato\mjotol9hnn-lg.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Cvtato\mjotol9hnn-lg.exeMD5
30b799e145ec03674de8d27ae3e5c0ba
SHA1339a5df9d70b31d0b59a5e97d672f12ccb67e45e
SHA2565df88b107258b6f9b91512ca18b098fec01005b71eed470932f006103d5bb346
SHA512d37d9be8f9bc3c17afead37c22b91a96fe2cb4314d09424270e75b2f36d7be4a9d560540909508170f8c0e3e2d1ba0635595045a6299ea5e6f8be215007b841e
-
C:\Program Files (x86)\Cvtato\mjotol9hnn-lg.exeMD5
30b799e145ec03674de8d27ae3e5c0ba
SHA1339a5df9d70b31d0b59a5e97d672f12ccb67e45e
SHA2565df88b107258b6f9b91512ca18b098fec01005b71eed470932f006103d5bb346
SHA512d37d9be8f9bc3c17afead37c22b91a96fe2cb4314d09424270e75b2f36d7be4a9d560540909508170f8c0e3e2d1ba0635595045a6299ea5e6f8be215007b841e
-
C:\Program Files (x86)\Cvtato\mjotol9hnn-lg.exeMD5
30b799e145ec03674de8d27ae3e5c0ba
SHA1339a5df9d70b31d0b59a5e97d672f12ccb67e45e
SHA2565df88b107258b6f9b91512ca18b098fec01005b71eed470932f006103d5bb346
SHA512d37d9be8f9bc3c17afead37c22b91a96fe2cb4314d09424270e75b2f36d7be4a9d560540909508170f8c0e3e2d1ba0635595045a6299ea5e6f8be215007b841e
-
memory/356-118-0x0000000001470000-0x0000000001790000-memory.dmpFilesize
3.1MB
-
memory/356-119-0x0000000000E00000-0x0000000000F4A000-memory.dmpFilesize
1.3MB
-
memory/356-117-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/356-121-0x0000000000F70000-0x0000000000F80000-memory.dmpFilesize
64KB
-
memory/356-115-0x000000000041CFC0-mapping.dmp
-
memory/1008-130-0x0000000000000000-mapping.dmp
-
memory/1008-135-0x0000000001240000-0x0000000001256000-memory.dmpFilesize
88KB
-
memory/2152-133-0x000000000041CFC0-mapping.dmp
-
memory/2152-136-0x0000000000F30000-0x0000000001250000-memory.dmpFilesize
3.1MB
-
memory/2556-123-0x0000000000000000-mapping.dmp
-
memory/2556-127-0x0000000004610000-0x0000000004930000-memory.dmpFilesize
3.1MB
-
memory/2556-128-0x0000000004470000-0x00000000044FF000-memory.dmpFilesize
572KB
-
memory/2556-124-0x0000000001060000-0x0000000001066000-memory.dmpFilesize
24KB
-
memory/2556-125-0x00000000006B0000-0x00000000006D8000-memory.dmpFilesize
160KB
-
memory/3036-129-0x0000000000650000-0x00000000006F7000-memory.dmpFilesize
668KB
-
memory/3036-122-0x0000000006A80000-0x0000000006BCE000-memory.dmpFilesize
1.3MB
-
memory/3036-120-0x0000000006880000-0x0000000006953000-memory.dmpFilesize
844KB
-
memory/3580-137-0x0000000000000000-mapping.dmp
-
memory/3580-139-0x0000023134780000-0x00000231348C5000-memory.dmpFilesize
1.3MB
-
memory/3580-138-0x00007FF6B2000000-0x00007FF6B2093000-memory.dmpFilesize
588KB
-
memory/3600-126-0x0000000000000000-mapping.dmp
-
memory/4044-116-0x0000000000870000-0x0000000000872000-memory.dmpFilesize
8KB