Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 06:53
Static task
static1
Behavioral task
behavioral1
Sample
Scan0198DHL-pdf.exe
Resource
win7-en-20211208
General
-
Target
Scan0198DHL-pdf.exe
-
Size
381KB
-
MD5
8656201f1f8783272ae26af18738b3be
-
SHA1
8e58965b093a142c39972f3e20f6e68668f1ff35
-
SHA256
d3ff7ff9f8508bfdba95e8f26e0f4a31fc2c12376248de452e2d6fc349abc870
-
SHA512
edc48617d537138cbef5c21b11c85c6409371c0fc0b7fd6da897f17193dbe8d7650f11419fa82daedf637b0125655307fcb39ef7121fc12f5c7da9d037d79338
Malware Config
Extracted
xloader
2.5
pout
leadergaterealty.com
k7bsz.info
laidjapp1.com
eastcountytaxi.com
betterlife-uae.com
materaiku.com
chanhxebinhthuan-hcm.online
06gjm.xyz
67t.xyz
here-we-meet.com
screened-articletoseetoday.info
lucykg.club
mujdobron.quest
susakhi.com
funtabse.com
unlimitedpain.com
2ed58fwec.xyz
weighttrainingexpert.com
allisonsheillax.com
yektaburgers.com
altijdstoer.info
airemspapartments.com
videomuncher.com
centerstagedrama.com
nikkou-toy.store
arequipesymerengues.com
haishandl.com
fy2zy5.com
mailheld.digital
sheepysage.com
fabricadocredito.com
siq212.com
moo-coo.com
hoomxb.net
6s2.space
rsholding.net
castellanacustomboats.online
tremblock.com
ramblingkinkster.com
teamsooners.club
onlinecasino-univ.com
dash8board.com
aichuncha.com
springhilllawn.com
zgluke.com
happynft.agency
urbanempireapparel.com
guanyiren.com
biglotteryking.com
marionkgregory.store
mujeresyaccion.com
smcusa.net
mayyon.net
vivibanca.website
15dgj.xyz
miabossjewelry.com
ideeperloshopping.cloud
healizy.com
huvao.com
huggsforbubbs.com
radiomacadam.online
firirifilms.com
knowhorses.com
chickenbeetlebooks.com
transtarintl.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1592-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/540-71-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1572 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Scan0198DHL-pdf.exeScan0198DHL-pdf.exeexplorer.exedescription pid process target process PID 1480 set thread context of 1592 1480 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 1592 set thread context of 1380 1592 Scan0198DHL-pdf.exe Explorer.EXE PID 540 set thread context of 1380 540 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Scan0198DHL-pdf.exeexplorer.exepid process 1592 Scan0198DHL-pdf.exe 1592 Scan0198DHL-pdf.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe 540 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Scan0198DHL-pdf.exeexplorer.exepid process 1592 Scan0198DHL-pdf.exe 1592 Scan0198DHL-pdf.exe 1592 Scan0198DHL-pdf.exe 540 explorer.exe 540 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Scan0198DHL-pdf.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1592 Scan0198DHL-pdf.exe Token: SeDebugPrivilege 540 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1380 Explorer.EXE 1380 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Scan0198DHL-pdf.exeExplorer.EXEexplorer.exedescription pid process target process PID 1480 wrote to memory of 1592 1480 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 1480 wrote to memory of 1592 1480 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 1480 wrote to memory of 1592 1480 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 1480 wrote to memory of 1592 1480 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 1480 wrote to memory of 1592 1480 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 1480 wrote to memory of 1592 1480 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 1480 wrote to memory of 1592 1480 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 1380 wrote to memory of 540 1380 Explorer.EXE explorer.exe PID 1380 wrote to memory of 540 1380 Explorer.EXE explorer.exe PID 1380 wrote to memory of 540 1380 Explorer.EXE explorer.exe PID 1380 wrote to memory of 540 1380 Explorer.EXE explorer.exe PID 540 wrote to memory of 1572 540 explorer.exe cmd.exe PID 540 wrote to memory of 1572 540 explorer.exe cmd.exe PID 540 wrote to memory of 1572 540 explorer.exe cmd.exe PID 540 wrote to memory of 1572 540 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan0198DHL-pdf.exe"C:\Users\Admin\AppData\Local\Temp\Scan0198DHL-pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan0198DHL-pdf.exe"C:\Users\Admin\AppData\Local\Temp\Scan0198DHL-pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Scan0198DHL-pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/540-72-0x00000000020C0000-0x0000000002150000-memory.dmpFilesize
576KB
-
memory/540-71-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/540-69-0x0000000000220000-0x00000000004A1000-memory.dmpFilesize
2.5MB
-
memory/540-70-0x0000000002480000-0x0000000002783000-memory.dmpFilesize
3.0MB
-
memory/540-68-0x0000000074681000-0x0000000074683000-memory.dmpFilesize
8KB
-
memory/1380-66-0x0000000007200000-0x0000000007398000-memory.dmpFilesize
1.6MB
-
memory/1380-73-0x0000000006410000-0x000000000656E000-memory.dmpFilesize
1.4MB
-
memory/1480-59-0x0000000005180000-0x00000000051E2000-memory.dmpFilesize
392KB
-
memory/1480-55-0x0000000001350000-0x00000000013B6000-memory.dmpFilesize
408KB
-
memory/1480-58-0x0000000000A10000-0x0000000000A1C000-memory.dmpFilesize
48KB
-
memory/1480-57-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/1480-56-0x0000000074B21000-0x0000000074B23000-memory.dmpFilesize
8KB
-
memory/1592-64-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1592-65-0x0000000000450000-0x0000000000461000-memory.dmpFilesize
68KB
-
memory/1592-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1592-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1592-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB