Analysis
-
max time kernel
152s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
31-01-2022 04:26
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoice #09876-INV-Order.PDF.exe
Resource
win7-en-20211208
General
-
Target
Proforma Invoice #09876-INV-Order.PDF.exe
-
Size
652KB
-
MD5
e6deb32888a854099ad15feea9a528b6
-
SHA1
50f6573ee795bb5301ab75d3d1fe54cb02f4cef2
-
SHA256
e0da8ee3e3841832297dbb9aa41c61a4c0d4ed14cd62153da3742a5dfa7ea6e1
-
SHA512
ba35bb7d5cb11c4a3aff0bcb0c015f0cabdbc19325fcab2930bcd023b893a446780e8e580a560fbb45475e552b15ca6fa65e374f001824b670c07f18d8d9fa10
Malware Config
Extracted
xloader
2.5
pout
leadergaterealty.com
k7bsz.info
laidjapp1.com
eastcountytaxi.com
betterlife-uae.com
materaiku.com
chanhxebinhthuan-hcm.online
06gjm.xyz
67t.xyz
here-we-meet.com
screened-articletoseetoday.info
lucykg.club
mujdobron.quest
susakhi.com
funtabse.com
unlimitedpain.com
2ed58fwec.xyz
weighttrainingexpert.com
allisonsheillax.com
yektaburgers.com
altijdstoer.info
airemspapartments.com
videomuncher.com
centerstagedrama.com
nikkou-toy.store
arequipesymerengues.com
haishandl.com
fy2zy5.com
mailheld.digital
sheepysage.com
fabricadocredito.com
siq212.com
moo-coo.com
hoomxb.net
6s2.space
rsholding.net
castellanacustomboats.online
tremblock.com
ramblingkinkster.com
teamsooners.club
onlinecasino-univ.com
dash8board.com
aichuncha.com
springhilllawn.com
zgluke.com
happynft.agency
urbanempireapparel.com
guanyiren.com
biglotteryking.com
marionkgregory.store
mujeresyaccion.com
smcusa.net
mayyon.net
vivibanca.website
15dgj.xyz
miabossjewelry.com
ideeperloshopping.cloud
healizy.com
huvao.com
huggsforbubbs.com
radiomacadam.online
firirifilms.com
knowhorses.com
chickenbeetlebooks.com
transtarintl.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/636-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/980-68-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1120 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Proforma Invoice #09876-INV-Order.PDF.exeProforma Invoice #09876-INV-Order.PDF.exemstsc.exedescription pid process target process PID 1520 set thread context of 636 1520 Proforma Invoice #09876-INV-Order.PDF.exe Proforma Invoice #09876-INV-Order.PDF.exe PID 636 set thread context of 1276 636 Proforma Invoice #09876-INV-Order.PDF.exe Explorer.EXE PID 980 set thread context of 1276 980 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
Proforma Invoice #09876-INV-Order.PDF.exemstsc.exepid process 636 Proforma Invoice #09876-INV-Order.PDF.exe 636 Proforma Invoice #09876-INV-Order.PDF.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe 980 mstsc.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Proforma Invoice #09876-INV-Order.PDF.exemstsc.exepid process 636 Proforma Invoice #09876-INV-Order.PDF.exe 636 Proforma Invoice #09876-INV-Order.PDF.exe 636 Proforma Invoice #09876-INV-Order.PDF.exe 980 mstsc.exe 980 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Proforma Invoice #09876-INV-Order.PDF.exemstsc.exedescription pid process Token: SeDebugPrivilege 636 Proforma Invoice #09876-INV-Order.PDF.exe Token: SeDebugPrivilege 980 mstsc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Proforma Invoice #09876-INV-Order.PDF.exeExplorer.EXEmstsc.exedescription pid process target process PID 1520 wrote to memory of 636 1520 Proforma Invoice #09876-INV-Order.PDF.exe Proforma Invoice #09876-INV-Order.PDF.exe PID 1520 wrote to memory of 636 1520 Proforma Invoice #09876-INV-Order.PDF.exe Proforma Invoice #09876-INV-Order.PDF.exe PID 1520 wrote to memory of 636 1520 Proforma Invoice #09876-INV-Order.PDF.exe Proforma Invoice #09876-INV-Order.PDF.exe PID 1520 wrote to memory of 636 1520 Proforma Invoice #09876-INV-Order.PDF.exe Proforma Invoice #09876-INV-Order.PDF.exe PID 1520 wrote to memory of 636 1520 Proforma Invoice #09876-INV-Order.PDF.exe Proforma Invoice #09876-INV-Order.PDF.exe PID 1520 wrote to memory of 636 1520 Proforma Invoice #09876-INV-Order.PDF.exe Proforma Invoice #09876-INV-Order.PDF.exe PID 1520 wrote to memory of 636 1520 Proforma Invoice #09876-INV-Order.PDF.exe Proforma Invoice #09876-INV-Order.PDF.exe PID 1276 wrote to memory of 980 1276 Explorer.EXE mstsc.exe PID 1276 wrote to memory of 980 1276 Explorer.EXE mstsc.exe PID 1276 wrote to memory of 980 1276 Explorer.EXE mstsc.exe PID 1276 wrote to memory of 980 1276 Explorer.EXE mstsc.exe PID 980 wrote to memory of 1120 980 mstsc.exe cmd.exe PID 980 wrote to memory of 1120 980 mstsc.exe cmd.exe PID 980 wrote to memory of 1120 980 mstsc.exe cmd.exe PID 980 wrote to memory of 1120 980 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice #09876-INV-Order.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice #09876-INV-Order.PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice #09876-INV-Order.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice #09876-INV-Order.PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Proforma Invoice #09876-INV-Order.PDF.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/636-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/636-64-0x0000000000180000-0x0000000000191000-memory.dmpFilesize
68KB
-
memory/636-63-0x0000000000C30000-0x0000000000F33000-memory.dmpFilesize
3.0MB
-
memory/636-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/636-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/980-68-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/980-67-0x00000000004A0000-0x00000000005A4000-memory.dmpFilesize
1.0MB
-
memory/980-69-0x00000000020A0000-0x00000000023A3000-memory.dmpFilesize
3.0MB
-
memory/980-70-0x00000000002F0000-0x0000000001F0C000-memory.dmpFilesize
28.1MB
-
memory/1276-65-0x0000000006AF0000-0x0000000006C08000-memory.dmpFilesize
1.1MB
-
memory/1276-71-0x0000000006C10000-0x0000000006D25000-memory.dmpFilesize
1.1MB
-
memory/1520-58-0x00000000056F0000-0x0000000005774000-memory.dmpFilesize
528KB
-
memory/1520-57-0x00000000003C0000-0x00000000003D4000-memory.dmpFilesize
80KB
-
memory/1520-56-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/1520-55-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1520-54-0x0000000000B80000-0x0000000000C2A000-memory.dmpFilesize
680KB