Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
24-09-2021 09:26
Static task
static1
Behavioral task
behavioral1
Sample
Order confirmation 49506.PDF.exe
Resource
win7v20210408
General
-
Target
Order confirmation 49506.PDF.exe
-
Size
465KB
-
MD5
a88e3833ee5ccb2434ee90aa645a8894
-
SHA1
b6e78de80bbdc7748dfcbea47bc43593b587b075
-
SHA256
4dfab25d3ccff9a33396c252590c27c57f23f9a94b11ebd9834b23981b0908e6
-
SHA512
becf2614d5196c2b43f74c94f76cc0e9e21ffc75edd8a3ec8057a01ed9e8cfce755590228174692e4935861406627f7048fcf0294007b62148c5ece9f065af77
Malware Config
Extracted
xloader
2.5
ny9y
http://www.caddomain.com/ny9y/
prelovedboutiqe.com
zhantool.com
grypeguidgorge.com
aa6588.com
privateerspacecompany.space
phil-goodman.com
jckabogados.com
familybeautifull.com
probinns.com
angelika-fritz.online
mygeeb.com
481344.com
freesoft.pro
extracter.store
fasxpay.com
hnjxcd.com
wfot2002.com
worldexecutor.com
tongxintachangjia.com
zachtippit.com
press-fitness.com
thequantblockchain.com
chiseiko.com
syedaakanwal.online
awsumm.one
fdmetaverse.com
wakanet-shop.com
bratliebe.info
onlinegiftcards.xyz
clutchhealthperformance.com
woodcarveddoors.com
midatlanticbathremodel.com
1stwill.com
pandacoffeebrand.com
alternativeformicroplastics.com
e9gift.com
zefibar.com
cashyatra.com
thoracicsurgeondebate.com
littlebluestemcupcakes.com
jmarketinggroup.com
masterbook365.com
thetutorisin.com
eletro-laser.com
serpenttrading.com
honeymaroc.com
olinia.xyz
ils.network
laexpodreams.com
4ohmtf.info
iphone13.onl
rjforsec.com
nathanrundle.com
lepetiteimport.com
ggsp3.xyz
darkxfreegiveway.com
micomunidadcenter.com
deepscan3d.com
acaadjkhdakjkdh.xyz
c2batlrjmk56txloreu3241.com
digitalsuccess.life
xerochargeusa.com
smartlifeformulation.net
buywithagents.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2696-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2696-126-0x000000000041D470-mapping.dmp xloader behavioral2/memory/1008-132-0x0000000000890000-0x00000000008B9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Order confirmation 49506.PDF.exeOrder confirmation 49506.PDF.execontrol.exedescription pid process target process PID 2160 set thread context of 2696 2160 Order confirmation 49506.PDF.exe Order confirmation 49506.PDF.exe PID 2696 set thread context of 3008 2696 Order confirmation 49506.PDF.exe Explorer.EXE PID 1008 set thread context of 3008 1008 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
Order confirmation 49506.PDF.execontrol.exepid process 2696 Order confirmation 49506.PDF.exe 2696 Order confirmation 49506.PDF.exe 2696 Order confirmation 49506.PDF.exe 2696 Order confirmation 49506.PDF.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe 1008 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3008 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Order confirmation 49506.PDF.execontrol.exepid process 2696 Order confirmation 49506.PDF.exe 2696 Order confirmation 49506.PDF.exe 2696 Order confirmation 49506.PDF.exe 1008 control.exe 1008 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order confirmation 49506.PDF.execontrol.exedescription pid process Token: SeDebugPrivilege 2696 Order confirmation 49506.PDF.exe Token: SeDebugPrivilege 1008 control.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Order confirmation 49506.PDF.exeExplorer.EXEcontrol.exedescription pid process target process PID 2160 wrote to memory of 2696 2160 Order confirmation 49506.PDF.exe Order confirmation 49506.PDF.exe PID 2160 wrote to memory of 2696 2160 Order confirmation 49506.PDF.exe Order confirmation 49506.PDF.exe PID 2160 wrote to memory of 2696 2160 Order confirmation 49506.PDF.exe Order confirmation 49506.PDF.exe PID 2160 wrote to memory of 2696 2160 Order confirmation 49506.PDF.exe Order confirmation 49506.PDF.exe PID 2160 wrote to memory of 2696 2160 Order confirmation 49506.PDF.exe Order confirmation 49506.PDF.exe PID 2160 wrote to memory of 2696 2160 Order confirmation 49506.PDF.exe Order confirmation 49506.PDF.exe PID 3008 wrote to memory of 1008 3008 Explorer.EXE control.exe PID 3008 wrote to memory of 1008 3008 Explorer.EXE control.exe PID 3008 wrote to memory of 1008 3008 Explorer.EXE control.exe PID 1008 wrote to memory of 516 1008 control.exe cmd.exe PID 1008 wrote to memory of 516 1008 control.exe cmd.exe PID 1008 wrote to memory of 516 1008 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order confirmation 49506.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Order confirmation 49506.PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order confirmation 49506.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Order confirmation 49506.PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order confirmation 49506.PDF.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/516-133-0x0000000000000000-mapping.dmp
-
memory/1008-130-0x0000000000000000-mapping.dmp
-
memory/1008-135-0x0000000004580000-0x0000000004610000-memory.dmpFilesize
576KB
-
memory/1008-134-0x00000000047C0000-0x0000000004AE0000-memory.dmpFilesize
3.1MB
-
memory/1008-132-0x0000000000890000-0x00000000008B9000-memory.dmpFilesize
164KB
-
memory/1008-131-0x0000000000A70000-0x0000000000A90000-memory.dmpFilesize
128KB
-
memory/2160-121-0x00000000077A0000-0x00000000077A4000-memory.dmpFilesize
16KB
-
memory/2160-115-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/2160-124-0x0000000007DA0000-0x0000000007DD8000-memory.dmpFilesize
224KB
-
memory/2160-117-0x0000000005A00000-0x0000000005A01000-memory.dmpFilesize
4KB
-
memory/2160-123-0x0000000007C30000-0x0000000007C98000-memory.dmpFilesize
416KB
-
memory/2160-118-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/2160-119-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/2160-120-0x0000000007830000-0x0000000007831000-memory.dmpFilesize
4KB
-
memory/2160-122-0x00000000053E0000-0x0000000005472000-memory.dmpFilesize
584KB
-
memory/2696-126-0x000000000041D470-mapping.dmp
-
memory/2696-128-0x00000000011D0000-0x00000000011E1000-memory.dmpFilesize
68KB
-
memory/2696-127-0x00000000012A0000-0x00000000015C0000-memory.dmpFilesize
3.1MB
-
memory/2696-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3008-129-0x0000000006800000-0x000000000694D000-memory.dmpFilesize
1.3MB
-
memory/3008-136-0x00000000032F0000-0x0000000003399000-memory.dmpFilesize
676KB