Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
27-01-2022 09:51
Static task
static1
Behavioral task
behavioral1
Sample
S.O.A. For JAN22_pdf.exe
Resource
win7-en-20211208
General
-
Target
S.O.A. For JAN22_pdf.exe
-
Size
385KB
-
MD5
7ec785f4a7f89ef669f4ae8f27944acd
-
SHA1
82a7ffc5b412cb1728afca2c22df3f8e24146df7
-
SHA256
bf5b18ccd94ad7519a945dc977e60d505e488edb1a7b91bc13a8031fe5cea262
-
SHA512
e90d2e4dd59c57c6cab86e6d27d094f220fc5fafc8c1efae14ceaa349083ff42334ae845e55682c62c00ca03b7cc22fad267753303942b7b83a740de8f040b2f
Malware Config
Extracted
xloader
2.5
b23k
foxsistersofhydesville.com
jetronbang.com
agriturismopartingoli.com
ihiinscus.com
zaksrestaurants.store
aspetac.com
ycjhjd.com
fountainspringscapemay.com
earlydose.com
nocodebelgium.com
65235.xyz
yasesite.com
steeltoilets.com
xceqa.xyz
2021udtv.com
belorusneft.top
the4asofdekhockey.com
gertexhosiery.com
fidelismortgages.com
bellacomoninguna.com
arab-carrier.com
xn--meng-bh8p60mfo2bn4z.com
wesavebig.com
033yu.xyz
vatgia9.com
withph.net
eastvastness.com
xzq797979.net
jostela.com
orzame.com
benzobluedi.com
tennistshirtz.com
bostondowntownrealestate.com
vendingandco.services
thespiritnewsletter.com
hyperprdouctivebiz.com
aiasoundfestival.com
6313671.club
tinampalermo.com
princess-solana-nft.com
hype-clicks.com
pwaygaonkar.net
joygwant.store
bestinsurance-quote-tx.com
charaburgh.com
caryfer.com
metruyen.online
foodemsa.com
elonnews.info
djxhwl.com
sumauto.net
degensimulator.xyz
ibankglobalfinance.xyz
namaqualand.xyz
saysylver.com
gcato.xyz
ironangelcreations.store
klayraccoonman.com
cashflow.asia
digital904.com
ouyangminwei.com
www2eee.com
494331.com
breastextra.com
ai-sakauchi.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1228-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/784-67-0x00000000000B0000-0x00000000000D9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1896 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
S.O.A. For JAN22_pdf.exeS.O.A. For JAN22_pdf.exewlanext.exedescription pid process target process PID 1312 set thread context of 1228 1312 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 1228 set thread context of 1316 1228 S.O.A. For JAN22_pdf.exe Explorer.EXE PID 784 set thread context of 1316 784 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
S.O.A. For JAN22_pdf.exewlanext.exepid process 1228 S.O.A. For JAN22_pdf.exe 1228 S.O.A. For JAN22_pdf.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe 784 wlanext.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
S.O.A. For JAN22_pdf.exewlanext.exepid process 1228 S.O.A. For JAN22_pdf.exe 1228 S.O.A. For JAN22_pdf.exe 1228 S.O.A. For JAN22_pdf.exe 784 wlanext.exe 784 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
S.O.A. For JAN22_pdf.exewlanext.exedescription pid process Token: SeDebugPrivilege 1228 S.O.A. For JAN22_pdf.exe Token: SeDebugPrivilege 784 wlanext.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1316 Explorer.EXE 1316 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1316 Explorer.EXE 1316 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
S.O.A. For JAN22_pdf.exeExplorer.EXEwlanext.exedescription pid process target process PID 1312 wrote to memory of 1228 1312 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 1312 wrote to memory of 1228 1312 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 1312 wrote to memory of 1228 1312 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 1312 wrote to memory of 1228 1312 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 1312 wrote to memory of 1228 1312 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 1312 wrote to memory of 1228 1312 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 1312 wrote to memory of 1228 1312 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 1316 wrote to memory of 784 1316 Explorer.EXE wlanext.exe PID 1316 wrote to memory of 784 1316 Explorer.EXE wlanext.exe PID 1316 wrote to memory of 784 1316 Explorer.EXE wlanext.exe PID 1316 wrote to memory of 784 1316 Explorer.EXE wlanext.exe PID 784 wrote to memory of 1896 784 wlanext.exe cmd.exe PID 784 wrote to memory of 1896 784 wlanext.exe cmd.exe PID 784 wrote to memory of 1896 784 wlanext.exe cmd.exe PID 784 wrote to memory of 1896 784 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\S.O.A. For JAN22_pdf.exe"C:\Users\Admin\AppData\Local\Temp\S.O.A. For JAN22_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\S.O.A. For JAN22_pdf.exe"C:\Users\Admin\AppData\Local\Temp\S.O.A. For JAN22_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\S.O.A. For JAN22_pdf.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/784-66-0x0000000000090000-0x00000000000A6000-memory.dmpFilesize
88KB
-
memory/784-69-0x0000000001CE0000-0x0000000001D70000-memory.dmpFilesize
576KB
-
memory/784-68-0x0000000001F70000-0x0000000002273000-memory.dmpFilesize
3.0MB
-
memory/784-67-0x00000000000B0000-0x00000000000D9000-memory.dmpFilesize
164KB
-
memory/1228-63-0x0000000000800000-0x0000000000B03000-memory.dmpFilesize
3.0MB
-
memory/1228-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1228-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1228-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1228-64-0x0000000000280000-0x0000000000291000-memory.dmpFilesize
68KB
-
memory/1312-54-0x0000000000F90000-0x0000000000FF6000-memory.dmpFilesize
408KB
-
memory/1312-58-0x00000000051E0000-0x0000000005242000-memory.dmpFilesize
392KB
-
memory/1312-57-0x0000000000950000-0x000000000095C000-memory.dmpFilesize
48KB
-
memory/1312-56-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/1312-55-0x0000000076911000-0x0000000076913000-memory.dmpFilesize
8KB
-
memory/1316-65-0x0000000005F10000-0x000000000602F000-memory.dmpFilesize
1.1MB
-
memory/1316-70-0x0000000006320000-0x0000000006446000-memory.dmpFilesize
1.1MB