Analysis
-
max time kernel
153s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 06:53
Static task
static1
Behavioral task
behavioral1
Sample
Scan0198DHL-pdf.exe
Resource
win7-en-20211208
General
-
Target
Scan0198DHL-pdf.exe
-
Size
381KB
-
MD5
8656201f1f8783272ae26af18738b3be
-
SHA1
8e58965b093a142c39972f3e20f6e68668f1ff35
-
SHA256
d3ff7ff9f8508bfdba95e8f26e0f4a31fc2c12376248de452e2d6fc349abc870
-
SHA512
edc48617d537138cbef5c21b11c85c6409371c0fc0b7fd6da897f17193dbe8d7650f11419fa82daedf637b0125655307fcb39ef7121fc12f5c7da9d037d79338
Malware Config
Extracted
xloader
2.5
pout
leadergaterealty.com
k7bsz.info
laidjapp1.com
eastcountytaxi.com
betterlife-uae.com
materaiku.com
chanhxebinhthuan-hcm.online
06gjm.xyz
67t.xyz
here-we-meet.com
screened-articletoseetoday.info
lucykg.club
mujdobron.quest
susakhi.com
funtabse.com
unlimitedpain.com
2ed58fwec.xyz
weighttrainingexpert.com
allisonsheillax.com
yektaburgers.com
altijdstoer.info
airemspapartments.com
videomuncher.com
centerstagedrama.com
nikkou-toy.store
arequipesymerengues.com
haishandl.com
fy2zy5.com
mailheld.digital
sheepysage.com
fabricadocredito.com
siq212.com
moo-coo.com
hoomxb.net
6s2.space
rsholding.net
castellanacustomboats.online
tremblock.com
ramblingkinkster.com
teamsooners.club
onlinecasino-univ.com
dash8board.com
aichuncha.com
springhilllawn.com
zgluke.com
happynft.agency
urbanempireapparel.com
guanyiren.com
biglotteryking.com
marionkgregory.store
mujeresyaccion.com
smcusa.net
mayyon.net
vivibanca.website
15dgj.xyz
miabossjewelry.com
ideeperloshopping.cloud
healizy.com
huvao.com
huggsforbubbs.com
radiomacadam.online
firirifilms.com
knowhorses.com
chickenbeetlebooks.com
transtarintl.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/644-123-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/644-126-0x0000000000B60000-0x0000000001370000-memory.dmp xloader behavioral2/memory/1504-129-0x00000000005D0000-0x00000000005F9000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Scan0198DHL-pdf.exeScan0198DHL-pdf.exenetsh.exedescription pid process target process PID 2552 set thread context of 644 2552 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 644 set thread context of 3012 644 Scan0198DHL-pdf.exe Explorer.EXE PID 1504 set thread context of 3012 1504 netsh.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
Scan0198DHL-pdf.exenetsh.exepid process 644 Scan0198DHL-pdf.exe 644 Scan0198DHL-pdf.exe 644 Scan0198DHL-pdf.exe 644 Scan0198DHL-pdf.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe 1504 netsh.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3012 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Scan0198DHL-pdf.exenetsh.exepid process 644 Scan0198DHL-pdf.exe 644 Scan0198DHL-pdf.exe 644 Scan0198DHL-pdf.exe 1504 netsh.exe 1504 netsh.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Scan0198DHL-pdf.exenetsh.exedescription pid process Token: SeDebugPrivilege 644 Scan0198DHL-pdf.exe Token: SeDebugPrivilege 1504 netsh.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Scan0198DHL-pdf.exeExplorer.EXEnetsh.exedescription pid process target process PID 2552 wrote to memory of 644 2552 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 2552 wrote to memory of 644 2552 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 2552 wrote to memory of 644 2552 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 2552 wrote to memory of 644 2552 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 2552 wrote to memory of 644 2552 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 2552 wrote to memory of 644 2552 Scan0198DHL-pdf.exe Scan0198DHL-pdf.exe PID 3012 wrote to memory of 1504 3012 Explorer.EXE netsh.exe PID 3012 wrote to memory of 1504 3012 Explorer.EXE netsh.exe PID 3012 wrote to memory of 1504 3012 Explorer.EXE netsh.exe PID 1504 wrote to memory of 4012 1504 netsh.exe cmd.exe PID 1504 wrote to memory of 4012 1504 netsh.exe cmd.exe PID 1504 wrote to memory of 4012 1504 netsh.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan0198DHL-pdf.exe"C:\Users\Admin\AppData\Local\Temp\Scan0198DHL-pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Scan0198DHL-pdf.exe"C:\Users\Admin\AppData\Local\Temp\Scan0198DHL-pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Scan0198DHL-pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/644-123-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/644-126-0x0000000000B60000-0x0000000001370000-memory.dmpFilesize
8.1MB
-
memory/644-125-0x0000000000FA0000-0x00000000012C0000-memory.dmpFilesize
3.1MB
-
memory/1504-128-0x00000000016C0000-0x00000000016DE000-memory.dmpFilesize
120KB
-
memory/1504-129-0x00000000005D0000-0x00000000005F9000-memory.dmpFilesize
164KB
-
memory/1504-131-0x0000000000D00000-0x0000000000E92000-memory.dmpFilesize
1.6MB
-
memory/1504-130-0x0000000001040000-0x0000000001360000-memory.dmpFilesize
3.1MB
-
memory/2552-122-0x0000000007590000-0x00000000075F2000-memory.dmpFilesize
392KB
-
memory/2552-118-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/2552-117-0x0000000004DF0000-0x0000000004E82000-memory.dmpFilesize
584KB
-
memory/2552-116-0x00000000052F0000-0x00000000057EE000-memory.dmpFilesize
5.0MB
-
memory/2552-115-0x0000000000470000-0x00000000004D6000-memory.dmpFilesize
408KB
-
memory/2552-119-0x0000000004D10000-0x0000000004D1A000-memory.dmpFilesize
40KB
-
memory/2552-121-0x0000000007410000-0x00000000074AC000-memory.dmpFilesize
624KB
-
memory/2552-120-0x0000000005240000-0x000000000524C000-memory.dmpFilesize
48KB
-
memory/3012-127-0x0000000004B40000-0x0000000004CC6000-memory.dmpFilesize
1.5MB
-
memory/3012-132-0x0000000001F80000-0x0000000002031000-memory.dmpFilesize
708KB