Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-10-2021 09:18
Static task
static1
Behavioral task
behavioral1
Sample
??__ ? __ ?????__ ??? __ ...pdf.....exe
Resource
win7-en-20210920
General
-
Target
??__ ? __ ?????__ ??? __ ...pdf.....exe
-
Size
395KB
-
MD5
b68d6bb055b0fb1367900eaee876dd20
-
SHA1
46721ae469d81070727744a16f02d8c88144e99f
-
SHA256
b0fe839ee84678c067828ee5d5d48a30e2588c4a29fd9402609a335fe667c91d
-
SHA512
890f7cf60b16ed5d7edb935fb5e2c4a4397751e67e01654d09022a45290fd7d46f24786be99af3bc99a9964458be757d82756c074cd07d032197c27cb00b6e9e
Malware Config
Extracted
xloader
2.5
s86j
http://www.emboldenlife.net/s86j/
getlumichargeserver.com
act-vitaalcoach.store
craftgeekz.com
monetflowerfarm.com
morakotislandrealty.com
onlineastrologeruk.com
evvpsml.com
hnbtc.net
auxiliacapitalpartnersllc.com
rdwoodworksstore.com
shulwinfitness.com
arterialhealthgrids.com
cryptork.biz
solomini-tech.com
porttownsendapartments.com
poprumor.com
assetsauctioneer.com
electronics2anyone.com
upskillpme.online
247fooddelivery.com
mceservicesnc.com
folge-meinempaket-de.com
saharaparkhurghada.com
flokitheshibainu.com
javcobra.com
hendrik-michels.com
pouyatec.com
vimaset.com
yourhockeyskates.com
nutri6si.com
sb019.com
green1994.com
gisellajewelry.com
nautical.store
babysneakersparis.com
seasonwiththereason.com
awonder.website
tamiltalks.com
klantbeheer.xyz
gangsishuawang.com
silverhavencap.com
pinksalt.care
456fuli.com
gabesfish.online
myveguiolcusbyopapp.com
sexwihmuslims.com
katiedraznin.com
sodavaranmali.com
rwcfrance2023tv.com
a2zroofingrepairs.com
safehousecamera.com
hinge.wtf
alphiver.com
corcentric-intl.com
moonenterprise.guru
cheburgent.com
elitecouriercs.com
raj56i.biz
incorporamovimiento.com
veritypedia.com
bamasaltwatercookbook.com
spdh04.xyz
thewayweseetheworld.info
ella.tech
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4084-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4084-126-0x000000000041D4F0-mapping.dmp xloader behavioral2/memory/2828-134-0x0000000002840000-0x0000000002869000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
____ _ __ _______ ___ __ ...pdf.....exe____ _ __ _______ ___ __ ...pdf.....exewlanext.exedescription pid process target process PID 2636 set thread context of 4084 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 4084 set thread context of 3020 4084 ____ _ __ _______ ___ __ ...pdf.....exe Explorer.EXE PID 2828 set thread context of 3020 2828 wlanext.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
____ _ __ _______ ___ __ ...pdf.....exe____ _ __ _______ ___ __ ...pdf.....exewlanext.exepid process 2636 ____ _ __ _______ ___ __ ...pdf.....exe 2636 ____ _ __ _______ ___ __ ...pdf.....exe 2636 ____ _ __ _______ ___ __ ...pdf.....exe 2636 ____ _ __ _______ ___ __ ...pdf.....exe 2636 ____ _ __ _______ ___ __ ...pdf.....exe 2636 ____ _ __ _______ ___ __ ...pdf.....exe 2636 ____ _ __ _______ ___ __ ...pdf.....exe 2636 ____ _ __ _______ ___ __ ...pdf.....exe 4084 ____ _ __ _______ ___ __ ...pdf.....exe 4084 ____ _ __ _______ ___ __ ...pdf.....exe 4084 ____ _ __ _______ ___ __ ...pdf.....exe 4084 ____ _ __ _______ ___ __ ...pdf.....exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe 2828 wlanext.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
____ _ __ _______ ___ __ ...pdf.....exewlanext.exepid process 4084 ____ _ __ _______ ___ __ ...pdf.....exe 4084 ____ _ __ _______ ___ __ ...pdf.....exe 4084 ____ _ __ _______ ___ __ ...pdf.....exe 2828 wlanext.exe 2828 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
____ _ __ _______ ___ __ ...pdf.....exe____ _ __ _______ ___ __ ...pdf.....exewlanext.exedescription pid process Token: SeDebugPrivilege 2636 ____ _ __ _______ ___ __ ...pdf.....exe Token: SeDebugPrivilege 4084 ____ _ __ _______ ___ __ ...pdf.....exe Token: SeDebugPrivilege 2828 wlanext.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
____ _ __ _______ ___ __ ...pdf.....exeExplorer.EXEwlanext.exedescription pid process target process PID 2636 wrote to memory of 3952 2636 ____ _ __ _______ ___ __ ...pdf.....exe schtasks.exe PID 2636 wrote to memory of 3952 2636 ____ _ __ _______ ___ __ ...pdf.....exe schtasks.exe PID 2636 wrote to memory of 3952 2636 ____ _ __ _______ ___ __ ...pdf.....exe schtasks.exe PID 2636 wrote to memory of 1576 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 1576 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 1576 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 792 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 792 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 792 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 2196 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 2196 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 2196 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 4084 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 4084 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 4084 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 4084 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 4084 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 2636 wrote to memory of 4084 2636 ____ _ __ _______ ___ __ ...pdf.....exe ____ _ __ _______ ___ __ ...pdf.....exe PID 3020 wrote to memory of 2828 3020 Explorer.EXE wlanext.exe PID 3020 wrote to memory of 2828 3020 Explorer.EXE wlanext.exe PID 3020 wrote to memory of 2828 3020 Explorer.EXE wlanext.exe PID 2828 wrote to memory of 1368 2828 wlanext.exe cmd.exe PID 2828 wrote to memory of 1368 2828 wlanext.exe cmd.exe PID 2828 wrote to memory of 1368 2828 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\____ _ __ _______ ___ __ ...pdf.....exe"C:\Users\Admin\AppData\Local\Temp\____ _ __ _______ ___ __ ...pdf.....exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uEZCQueLPHvB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4458.tmp"3⤵
- Creates scheduled task(s)
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\____ _ __ _______ ___ __ ...pdf.....exe"C:\Users\Admin\AppData\Local\Temp\____ _ __ _______ ___ __ ...pdf.....exe"3⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\____ _ __ _______ ___ __ ...pdf.....exe"C:\Users\Admin\AppData\Local\Temp\____ _ __ _______ ___ __ ...pdf.....exe"3⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\____ _ __ _______ ___ __ ...pdf.....exe"C:\Users\Admin\AppData\Local\Temp\____ _ __ _______ ___ __ ...pdf.....exe"3⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\____ _ __ _______ ___ __ ...pdf.....exe"C:\Users\Admin\AppData\Local\Temp\____ _ __ _______ ___ __ ...pdf.....exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:4084 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\____ _ __ _______ ___ __ ...pdf.....exe"3⤵PID:1368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1368-132-0x0000000000000000-mapping.dmp
-
memory/2636-121-0x00000000077B0000-0x00000000077B7000-memory.dmpFilesize
28KB
-
memory/2636-118-0x0000000007980000-0x0000000007981000-memory.dmpFilesize
4KB
-
memory/2636-119-0x0000000007340000-0x00000000073D2000-memory.dmpFilesize
584KB
-
memory/2636-120-0x00000000077D0000-0x00000000077D1000-memory.dmpFilesize
4KB
-
memory/2636-115-0x0000000000500000-0x0000000000501000-memory.dmpFilesize
4KB
-
memory/2636-122-0x0000000008020000-0x0000000008021000-memory.dmpFilesize
4KB
-
memory/2636-123-0x0000000007FD0000-0x000000000801B000-memory.dmpFilesize
300KB
-
memory/2636-117-0x00000000073E0000-0x00000000073E1000-memory.dmpFilesize
4KB
-
memory/2828-135-0x0000000002C30000-0x0000000002F50000-memory.dmpFilesize
3.1MB
-
memory/2828-131-0x0000000000000000-mapping.dmp
-
memory/2828-133-0x0000000000060000-0x0000000000077000-memory.dmpFilesize
92KB
-
memory/2828-134-0x0000000002840000-0x0000000002869000-memory.dmpFilesize
164KB
-
memory/2828-136-0x0000000002A00000-0x0000000002A90000-memory.dmpFilesize
576KB
-
memory/3020-137-0x00000000024C0000-0x000000000258A000-memory.dmpFilesize
808KB
-
memory/3020-130-0x0000000005E40000-0x0000000005F79000-memory.dmpFilesize
1.2MB
-
memory/3952-124-0x0000000000000000-mapping.dmp
-
memory/4084-129-0x0000000000E80000-0x0000000000E91000-memory.dmpFilesize
68KB
-
memory/4084-128-0x0000000001170000-0x0000000001490000-memory.dmpFilesize
3.1MB
-
memory/4084-126-0x000000000041D4F0-mapping.dmp
-
memory/4084-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB