Analysis
- max time kernel
300s - max time network
303s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
09/02/2022, 16:23
Static task
static1
Behavioral task
behavioral1
Sample
09022022-739651826-pdf.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target 09022022-739651826-pdf.exe
- Size 265KB
- Sample220209-tvs3nsahe6
- SHA256 46adc5850ed556d130d5d35db220fc303d45d719960e7e4b4b56174e9cdd3850
- MD5 37c86eea298f12684500f2083a2e4e7d
- SHA1 4c84e078d068e2a79ddbc48d03459e87390cb756
- SHA512 8a9ea9cf85e375a5b4b50789c6cf1041172400916a045c735987929c52081ff25748bfa404472c580261f8251f37973ba30ecdbc464f0546f702518ff87cd09a
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
uar3
Decoy
-
sgadvocats.com
-
mjscannabus.com
-
hilldaley.com
-
ksdollhouse.com
-
hotgiftboutique.com
-
purebloodsmeet.com
-
relaunched.info
-
cap-glove.com
-
productcollection.store
-
fulikyy.xyz
-
remoteaviationjobs.com
-
bestcleancrystal.com
-
virtualorganizationpartner.com
-
bookgocar.com
-
hattuafhv.quest
-
makonigroup.com
-
officecom-myaccount.com
-
malgorzata-lac.com
-
e-learningeducators.com
-
hygilaur.com
-
kgv-lachswehr.com
-
salazarcomunicacion.com
-
robopython.com
-
corporateequity.online
-
complianceservicegroup.com
-
aperza-ex.com
-
webflowusa.com
-
asesoriasfinancieras.xyz
-
missolivesbranches.com
-
numiquest.com
-
criskconsultancy.com
-
gotemup.com
-
themaptalk.com
-
lakebalboahalf.com
-
cateringfrenchcroissant.com
-
paddocklakerealestate.com
-
lojaquerosurprezza.store
-
courtneywhitearmusic.com
-
geovannimaquinadevendas.online
-
pricklypairjazz.com
-
engagedigi.com
-
conduitforthespirit.com
-
anaheimaletrail.com
-
wholesalemall.store
-
alertsbecu.com
-
gestion-kayfra.com
-
youcanstores.com
-
qsuo.net
-
formadv.info
-
dihesia.xyz
-
carrreir.com
-
twenteeminuteswithtee.com
-
realliferenewal.com
-
officialprokodsukses.icu
-
stanfordgrouploscabos.com
-
maxicashpromir.xyz
-
zysqshjs.com
-
trc-clicks.com
-
chsclbd.com
-
amdproduce.net
-
republicoflies.com
-
beaux-parents.com
-
lucrativeapp.com
-
milbombas.com
-
alexanderplaywear.com
Signatures
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/3440-118-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3400-126-0x0000000000B70000-0x0000000000B99000-memory.dmp xloader - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ZLNTRJTHWRM = "C:\\Program Files (x86)\\Maprl7\\lhihzliobpdcbc.exe" chkdsk.exe - Executes dropped EXE 4 IoCs
pid Process 1016 qgerjshzns.exe 3440 qgerjshzns.exe 4284 lhihzliobpdcbc.exe 4292 lhihzliobpdcbc.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1016 set thread context of 3440 1016 qgerjshzns.exe 70 PID 3440 set thread context of 3052 3440 qgerjshzns.exe 30 PID 3400 set thread context of 3052 3400 chkdsk.exe 30 PID 4284 set thread context of 4292 4284 lhihzliobpdcbc.exe 80 - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Maprl7\lhihzliobpdcbc.exe chkdsk.exe File opened for modification C:\Program Files (x86)\Maprl7 Explorer.EXE File created C:\Program Files (x86)\Maprl7\lhihzliobpdcbc.exe Explorer.EXE File opened for modification C:\Program Files (x86)\Maprl7\lhihzliobpdcbc.exe Explorer.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
description ioc Process Key created \Registry\User\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3440 qgerjshzns.exe 3440 qgerjshzns.exe 3440 qgerjshzns.exe 3440 qgerjshzns.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3052 Explorer.EXE - Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 3440 qgerjshzns.exe 3440 qgerjshzns.exe 3440 qgerjshzns.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe 3400 chkdsk.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3440 qgerjshzns.exe Token: SeDebugPrivilege 3400 chkdsk.exe Token: SeDebugPrivilege 4292 lhihzliobpdcbc.exe Token: SeShutdownPrivilege 3052 Explorer.EXE Token: SeCreatePagefilePrivilege 3052 Explorer.EXE - Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2500 wrote to memory of 1016 2500 09022022-739651826-pdf.exe 69 PID 2500 wrote to memory of 1016 2500 09022022-739651826-pdf.exe 69 PID 2500 wrote to memory of 1016 2500 09022022-739651826-pdf.exe 69 PID 1016 wrote to memory of 3440 1016 qgerjshzns.exe 70 PID 1016 wrote to memory of 3440 1016 qgerjshzns.exe 70 PID 1016 wrote to memory of 3440 1016 qgerjshzns.exe 70 PID 1016 wrote to memory of 3440 1016 qgerjshzns.exe 70 PID 1016 wrote to memory of 3440 1016 qgerjshzns.exe 70 PID 1016 wrote to memory of 3440 1016 qgerjshzns.exe 70 PID 3052 wrote to memory of 3400 3052 Explorer.EXE 71 PID 3052 wrote to memory of 3400 3052 Explorer.EXE 71 PID 3052 wrote to memory of 3400 3052 Explorer.EXE 71 PID 3400 wrote to memory of 3800 3400 chkdsk.exe 72 PID 3400 wrote to memory of 3800 3400 chkdsk.exe 72 PID 3400 wrote to memory of 3800 3400 chkdsk.exe 72 PID 3400 wrote to memory of 3228 3400 chkdsk.exe 76 PID 3400 wrote to memory of 3228 3400 chkdsk.exe 76 PID 3400 wrote to memory of 3228 3400 chkdsk.exe 76 PID 3400 wrote to memory of 4276 3400 chkdsk.exe 78 PID 3400 wrote to memory of 4276 3400 chkdsk.exe 78 PID 3052 wrote to memory of 4284 3052 Explorer.EXE 79 PID 3052 wrote to memory of 4284 3052 Explorer.EXE 79 PID 3052 wrote to memory of 4284 3052 Explorer.EXE 79 PID 4284 wrote to memory of 4292 4284 lhihzliobpdcbc.exe 80 PID 4284 wrote to memory of 4292 4284 lhihzliobpdcbc.exe 80 PID 4284 wrote to memory of 4292 4284 lhihzliobpdcbc.exe 80 PID 4284 wrote to memory of 4292 4284 lhihzliobpdcbc.exe 80 PID 4284 wrote to memory of 4292 4284 lhihzliobpdcbc.exe 80 PID 4284 wrote to memory of 4292 4284 lhihzliobpdcbc.exe 80 PID 3400 wrote to memory of 4276 3400 chkdsk.exe 78
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\09022022-739651826-pdf.exe"C:\Users\Admin\AppData\Local\Temp\09022022-739651826-pdf.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\qgerjshzns.exeC:\Users\Admin\AppData\Local\Temp\qgerjshzns.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\qgerjshzns.exeC:\Users\Admin\AppData\Local\Temp\qgerjshzns.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3440
-
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\qgerjshzns.exe"3⤵PID:3800
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:3228
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4276
-
-
-
C:\Program Files (x86)\Maprl7\lhihzliobpdcbc.exe"C:\Program Files (x86)\Maprl7\lhihzliobpdcbc.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Program Files (x86)\Maprl7\lhihzliobpdcbc.exe"C:\Program Files (x86)\Maprl7\lhihzliobpdcbc.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
-