Analysis
- max time kernel
151s - max time network
148s - platform
windows10_x64 - resource
win10v20210408 - submitted
20/09/2021, 04:09
Static task
static1
Behavioral task
behavioral1
Sample
Bank Swift Scan pdf.exe
Resource
win7-en-20210916
windows7_x64
0 signatures
0 seconds
General
- Target Bank Swift Scan pdf.exe
- Size 322KB
- Sample210920-eqstsacgf5
- SHA256 7edea6fe44458e087954bd189d33214f74cdb0d25dc3ea598554a9b2e3808abc
- MD5 0a6d9f4af51990a6a50bf65fe8404959
- SHA1 37f8ff69c52fe6720e34b724938c558a2170a2ee
- SHA512 ac1c3b4b0a111f96394a7415d53d7d982fd17253ef42ceac453a4556eb29c6ff89dd54dcd81913fbd1814237eb7595269b72cc9c70f8761b3d1b748d7b5720fa
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.4
Campaign
-
di4c
C2
-
http://www.dropadsmedia.com/di4c/
Decoy
-
oscd.store
-
simplyminiatures.com
-
famouslovebackbaba.com
-
turkesteronesupplement.com
-
most-attractive.com
-
le-thermoplongeur.com
-
joydeb.xyz
-
incomepanther.com
-
infoterkiinii.xyz
-
indigocard.website
-
plasthecnolgy.com
-
canmamap.com
-
aviationtrainingworldusa.com
-
successoffplan.com
-
desert-breeze.com
-
nilavarna.com
-
stanthonyswelfare.com
-
shezefy.com
-
shcq08.xyz
-
spencerpauley.com
-
breakfastatbrittanys.com
-
workspace-mex.com
-
litteratorum.com
-
illstitute.com
-
framed-speed.com
-
buyandsellwithalec.com
-
xwdnawbx.xyz
-
mickyyoung.com
-
bandiu.xyz
-
planft.store
-
imaginalworks.com
-
lid-gb.xyz
-
ahgongs.com
-
carrirbuilder.com
-
neuro-ai-web-online.club
-
booparade.com
-
sketchfujitah.online
-
bayboatnation.com
-
ink2words.com
-
modernsolarusa.com
-
camuci.com
-
dentonlifetimedentistry.com
-
1ajpwvkk.icu
-
hangcheng56.com
-
suvenifa.com
-
spacetech-sa.com
-
emotionevents.xyz
-
momskitchenassam.com
-
imyandme.com
-
premiercattledrenches.com
-
procard.one
-
quiestcevin.com
-
blastofftv.xyz
-
live2leadinfo.com
-
jaalifetrx.space
-
weste-store.store
-
liquidmelon.restaurant
-
gjz863.icu
-
prince-info.com
-
islandsingle.com
-
shelazofficial.com
-
awhjguduahjfsd.com
-
notariuspublicus24.com
-
navneetsharma.xyz
Signatures
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/1512-116-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/988-123-0x0000000002AB0000-0x0000000002AD9000-memory.dmp xloader - Loads dropped DLL 1 IoCs
pid Process 3628 Bank Swift Scan pdf.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3628 set thread context of 1512 3628 Bank Swift Scan pdf.exe 68 PID 1512 set thread context of 3024 1512 Bank Swift Scan pdf.exe 11 PID 988 set thread context of 3024 988 NETSTAT.EXE 11 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 988 NETSTAT.EXE - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1512 Bank Swift Scan pdf.exe 1512 Bank Swift Scan pdf.exe 1512 Bank Swift Scan pdf.exe 1512 Bank Swift Scan pdf.exe 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE 988 NETSTAT.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 3628 Bank Swift Scan pdf.exe 1512 Bank Swift Scan pdf.exe 1512 Bank Swift Scan pdf.exe 1512 Bank Swift Scan pdf.exe 988 NETSTAT.EXE 988 NETSTAT.EXE - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1512 Bank Swift Scan pdf.exe Token: SeDebugPrivilege 988 NETSTAT.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE 3024 Explorer.EXE - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3628 wrote to memory of 1512 3628 Bank Swift Scan pdf.exe 68 PID 3628 wrote to memory of 1512 3628 Bank Swift Scan pdf.exe 68 PID 3628 wrote to memory of 1512 3628 Bank Swift Scan pdf.exe 68 PID 3628 wrote to memory of 1512 3628 Bank Swift Scan pdf.exe 68 PID 3024 wrote to memory of 988 3024 Explorer.EXE 70 PID 3024 wrote to memory of 988 3024 Explorer.EXE 70 PID 3024 wrote to memory of 988 3024 Explorer.EXE 70 PID 988 wrote to memory of 788 988 NETSTAT.EXE 71 PID 988 wrote to memory of 788 988 NETSTAT.EXE 71 PID 988 wrote to memory of 788 988 NETSTAT.EXE 71
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift Scan pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift Scan pdf.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift Scan pdf.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift Scan pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1512
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵PID:688
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Bank Swift Scan pdf.exe"3⤵PID:788
-
-