Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 09:51
Static task
static1
Behavioral task
behavioral1
Sample
S.O.A. For JAN22_pdf.exe
Resource
win7-en-20211208
General
-
Target
S.O.A. For JAN22_pdf.exe
-
Size
385KB
-
MD5
7ec785f4a7f89ef669f4ae8f27944acd
-
SHA1
82a7ffc5b412cb1728afca2c22df3f8e24146df7
-
SHA256
bf5b18ccd94ad7519a945dc977e60d505e488edb1a7b91bc13a8031fe5cea262
-
SHA512
e90d2e4dd59c57c6cab86e6d27d094f220fc5fafc8c1efae14ceaa349083ff42334ae845e55682c62c00ca03b7cc22fad267753303942b7b83a740de8f040b2f
Malware Config
Extracted
xloader
2.5
b23k
foxsistersofhydesville.com
jetronbang.com
agriturismopartingoli.com
ihiinscus.com
zaksrestaurants.store
aspetac.com
ycjhjd.com
fountainspringscapemay.com
earlydose.com
nocodebelgium.com
65235.xyz
yasesite.com
steeltoilets.com
xceqa.xyz
2021udtv.com
belorusneft.top
the4asofdekhockey.com
gertexhosiery.com
fidelismortgages.com
bellacomoninguna.com
arab-carrier.com
xn--meng-bh8p60mfo2bn4z.com
wesavebig.com
033yu.xyz
vatgia9.com
withph.net
eastvastness.com
xzq797979.net
jostela.com
orzame.com
benzobluedi.com
tennistshirtz.com
bostondowntownrealestate.com
vendingandco.services
thespiritnewsletter.com
hyperprdouctivebiz.com
aiasoundfestival.com
6313671.club
tinampalermo.com
princess-solana-nft.com
hype-clicks.com
pwaygaonkar.net
joygwant.store
bestinsurance-quote-tx.com
charaburgh.com
caryfer.com
metruyen.online
foodemsa.com
elonnews.info
djxhwl.com
sumauto.net
degensimulator.xyz
ibankglobalfinance.xyz
namaqualand.xyz
saysylver.com
gcato.xyz
ironangelcreations.store
klayraccoonman.com
cashflow.asia
digital904.com
ouyangminwei.com
www2eee.com
494331.com
breastextra.com
ai-sakauchi.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2224-123-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2224-126-0x0000000001360000-0x00000000014F2000-memory.dmp xloader behavioral2/memory/2224-128-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/604-132-0x00000000005A0000-0x00000000005C9000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
S.O.A. For JAN22_pdf.exeS.O.A. For JAN22_pdf.exerundll32.exedescription pid process target process PID 2504 set thread context of 2224 2504 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 2224 set thread context of 2968 2224 S.O.A. For JAN22_pdf.exe Explorer.EXE PID 2224 set thread context of 2968 2224 S.O.A. For JAN22_pdf.exe Explorer.EXE PID 604 set thread context of 2968 604 rundll32.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
S.O.A. For JAN22_pdf.exerundll32.exepid process 2224 S.O.A. For JAN22_pdf.exe 2224 S.O.A. For JAN22_pdf.exe 2224 S.O.A. For JAN22_pdf.exe 2224 S.O.A. For JAN22_pdf.exe 2224 S.O.A. For JAN22_pdf.exe 2224 S.O.A. For JAN22_pdf.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe 604 rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2968 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
S.O.A. For JAN22_pdf.exerundll32.exepid process 2224 S.O.A. For JAN22_pdf.exe 2224 S.O.A. For JAN22_pdf.exe 2224 S.O.A. For JAN22_pdf.exe 2224 S.O.A. For JAN22_pdf.exe 604 rundll32.exe 604 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
S.O.A. For JAN22_pdf.exerundll32.exedescription pid process Token: SeDebugPrivilege 2224 S.O.A. For JAN22_pdf.exe Token: SeDebugPrivilege 604 rundll32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
S.O.A. For JAN22_pdf.exeExplorer.EXErundll32.exedescription pid process target process PID 2504 wrote to memory of 2224 2504 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 2504 wrote to memory of 2224 2504 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 2504 wrote to memory of 2224 2504 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 2504 wrote to memory of 2224 2504 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 2504 wrote to memory of 2224 2504 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 2504 wrote to memory of 2224 2504 S.O.A. For JAN22_pdf.exe S.O.A. For JAN22_pdf.exe PID 2968 wrote to memory of 604 2968 Explorer.EXE rundll32.exe PID 2968 wrote to memory of 604 2968 Explorer.EXE rundll32.exe PID 2968 wrote to memory of 604 2968 Explorer.EXE rundll32.exe PID 604 wrote to memory of 1372 604 rundll32.exe cmd.exe PID 604 wrote to memory of 1372 604 rundll32.exe cmd.exe PID 604 wrote to memory of 1372 604 rundll32.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\S.O.A. For JAN22_pdf.exe"C:\Users\Admin\AppData\Local\Temp\S.O.A. For JAN22_pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\S.O.A. For JAN22_pdf.exe"C:\Users\Admin\AppData\Local\Temp\S.O.A. For JAN22_pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\S.O.A. For JAN22_pdf.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/604-134-0x0000000004410000-0x000000000459D000-memory.dmpFilesize
1.6MB
-
memory/604-132-0x00000000005A0000-0x00000000005C9000-memory.dmpFilesize
164KB
-
memory/604-133-0x0000000004740000-0x0000000004A60000-memory.dmpFilesize
3.1MB
-
memory/604-131-0x0000000000B30000-0x0000000000B43000-memory.dmpFilesize
76KB
-
memory/2224-125-0x0000000001500000-0x0000000001820000-memory.dmpFilesize
3.1MB
-
memory/2224-129-0x0000000001A40000-0x0000000001A51000-memory.dmpFilesize
68KB
-
memory/2224-128-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2224-126-0x0000000001360000-0x00000000014F2000-memory.dmpFilesize
1.6MB
-
memory/2224-123-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2504-120-0x0000000005A90000-0x0000000005A9C000-memory.dmpFilesize
48KB
-
memory/2504-122-0x00000000080F0000-0x0000000008152000-memory.dmpFilesize
392KB
-
memory/2504-121-0x0000000007F70000-0x000000000800C000-memory.dmpFilesize
624KB
-
memory/2504-115-0x0000000000FA0000-0x0000000001006000-memory.dmpFilesize
408KB
-
memory/2504-119-0x00000000059B0000-0x00000000059BA000-memory.dmpFilesize
40KB
-
memory/2504-118-0x00000000033C0000-0x00000000033C1000-memory.dmpFilesize
4KB
-
memory/2504-117-0x0000000005910000-0x00000000059A2000-memory.dmpFilesize
584KB
-
memory/2504-116-0x0000000005E10000-0x000000000630E000-memory.dmpFilesize
5.0MB
-
memory/2968-127-0x0000000006DB0000-0x0000000006ECD000-memory.dmpFilesize
1.1MB
-
memory/2968-130-0x0000000001450000-0x0000000001554000-memory.dmpFilesize
1.0MB
-
memory/2968-135-0x0000000005820000-0x000000000592E000-memory.dmpFilesize
1.1MB