Overview

overview

10

Static

static

P. Order &...DF.exe

windows7_x64

10

P. Order &...DF.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    21-10-2021 05:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    P. Order & Contract (A-4553) PDF.exe

  • Size

    388KB

  • MD5

    2b7aa1c3ad41c61590c7e8788717f3a3

  • SHA1

    b25e8d174baa57079f2886d76ccf45248269d5d3

  • SHA256

    4d9cbe2a33087ef1552af182cd03bbbe5bba8d01f5eb11c25c3eb3eb72008a7c

  • SHA512

    67939ee05ad3baf7115f46cc85fabcff97b65836dd7ef8eedbfa9b114adca3376152bf00db3bf4d47976287b1d0ba1ed1960f036043fab392e5784a637f30084

Score
10/10
xloaderr3n5loaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

r3n5

C2

http://www.keeyasmarketplace.com/r3n5/

Decoy

peterjhill.com

bleednavy.com

a6d83.top

koudoula.store

albawardl.com

j-sdigitalekuns.net

0wzr2dglc.com

xd16880.com

safepostcourier.com

seuic.net

hainansousou.com

meuexamor.com

strategicthinking.coach

tabliqatbama.com

kidzplan.com

non-toxicnailpolish.com

bwgds.com

behindhereyesphotography.com

age-oldpklduy.xyz

lesconfidentialistes.paris

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata
  • Xloader Payload 3 IoCs
    rat
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3756
      • C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe
        "C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe"
        3⤵
          PID:2132
        • C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe
          "C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1288
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2452
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe"
          3⤵
            PID:2512

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1288-125-0x000000000041D4C0-mapping.dmp
        Download
      • memory/1288-128-0x0000000001880000-0x0000000001891000-memory.dmp
        Filesize

        68KB

        Download
      • memory/1288-127-0x0000000001560000-0x0000000001880000-memory.dmp
        Filesize

        3.1MB

        Download
      • memory/1288-124-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

        Download
      • memory/2452-135-0x0000000004640000-0x00000000046D0000-memory.dmp
        Filesize

        576KB

        Download
      • memory/2452-132-0x0000000003000000-0x0000000003029000-memory.dmp
        Filesize

        164KB

        Download
      • memory/2452-134-0x00000000048E0000-0x0000000004C00000-memory.dmp
        Filesize

        3.1MB

        Download
      • memory/2452-131-0x00000000008C0000-0x0000000000CFF000-memory.dmp
        Filesize

        4.2MB

        Download
      • memory/2452-130-0x0000000000000000-mapping.dmp
        Download
      • memory/2512-133-0x0000000000000000-mapping.dmp
        Download
      • memory/3064-129-0x0000000006010000-0x00000000061AA000-memory.dmp
        Filesize

        1.6MB

        Download
      • memory/3064-136-0x0000000004E10000-0x0000000004F86000-memory.dmp
        Filesize

        1.5MB

        Download
      • memory/3756-123-0x0000000008510000-0x000000000855B000-memory.dmp
        Filesize

        300KB

        Download
      • memory/3756-122-0x0000000008370000-0x0000000008371000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3756-121-0x0000000008030000-0x0000000008037000-memory.dmp
        Filesize

        28KB

        Download
      • memory/3756-120-0x00000000048A0000-0x0000000004D9E000-memory.dmp
        Filesize

        5.0MB

        Download
      • memory/3756-115-0x0000000000090000-0x0000000000091000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3756-119-0x0000000004940000-0x0000000004941000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3756-118-0x0000000004980000-0x0000000004981000-memory.dmp
        Filesize

        4KB

        Download
      • memory/3756-117-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
        Filesize

        4KB

        Download