Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
04-05-2021 14:02
Static task
static1
Behavioral task
behavioral1
Sample
Original copies of shipment docs.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Original copies of shipment docs.exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
pic05678063.exe
Resource
win7v20210410
General
-
Target
Original copies of shipment docs.exe
-
Size
92KB
-
MD5
8b96af7d76b487cea6aa04f565b8cb9f
-
SHA1
3e904fec3e82c9f01ccc64fbdcde35d306c6147f
-
SHA256
49559dd2c1d9b0841f3384f3080013f8d644760d45ab7cd4fb4928bb2b91f354
-
SHA512
786140d030095ce5c0865c21e049c8572e3ee5ec78eadebb15611a4b0f59bac995a306f14e85cd30506cd7661819d3d6a3fe43e4ac714fceb9e0c0991f171790
Malware Config
Extracted
xloader
2.3
http://www.innovativevan.com/i8be/
cdymjim.icu
globalmilitaryaircraft.com
slusheestore.com
freepdfconvert.net
itadsweden.com
legenddocs.com
metholyptus.com
966cm.com
mobilitygloves-protect.com
travaze.net
go-kalisa.com
believehavefaith.com
nywebhost.com
semitsol.com
wowyuu.net
cochesb2b.com
gobesttobuy.com
senmec23.com
bmsgw.com
newazenterprise.com
onlinefitnessmechanic.com
makeournationsafeagain.com
climat2020.com
hamsikoysutlaci.net
networkslice.com
wanganwanderer1.com
nationwidesignage.com
lucianmediazone.com
geekyweel.com
hzky888.com
mcfarlaneweb.com
c-w3.com
covidstracking.com
flowingwealth.com
sprinklesglobal.com
secret-mall.com
extraclasss.com
stasiapl.com
1905vintage.com
8649gb.com
brisketbeard.com
optionsafecode.com
foms4om.com
differentquartz.info
freshly.pizza
levettfyneralhome.com
leteeshirtboutique.com
creativesdanfe.com
t-oils.com
seoforamz.com
carbon2algae.com
kronospros.com
storepisode.com
viautong30.com
weipr.net
mjspizzaandwinghouse.com
e-yzr.com
webcamthing.com
wb917.com
sedentariocero.com
salon-solution.com
solgeneration.com
viviennevaile.com
weightlossbiloxi.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1556-69-0x0000000000401000-0x0000000000541000-memory.dmp xloader behavioral1/memory/540-78-0x00000000000D0000-0x00000000000F8000-memory.dmp xloader -
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
Processes:
Original copies of shipment docs.exeOriginal copies of shipment docs.exedescription ioc process File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Original copies of shipment docs.exe File opened (read-only) C:\Program Files\Qemu-ga\qemu-ga.exe Original copies of shipment docs.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1876 cmd.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
Original copies of shipment docs.exeOriginal copies of shipment docs.exepid process 1268 Original copies of shipment docs.exe 1556 Original copies of shipment docs.exe 1556 Original copies of shipment docs.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Original copies of shipment docs.exeOriginal copies of shipment docs.exeipconfig.exedescription pid process target process PID 1268 set thread context of 1556 1268 Original copies of shipment docs.exe Original copies of shipment docs.exe PID 1556 set thread context of 1196 1556 Original copies of shipment docs.exe Explorer.EXE PID 1556 set thread context of 1196 1556 Original copies of shipment docs.exe Explorer.EXE PID 540 set thread context of 1196 540 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 540 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
Original copies of shipment docs.exeipconfig.exepid process 1556 Original copies of shipment docs.exe 1556 Original copies of shipment docs.exe 1556 Original copies of shipment docs.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe 540 ipconfig.exe -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
Original copies of shipment docs.exeOriginal copies of shipment docs.exeipconfig.exepid process 1268 Original copies of shipment docs.exe 1556 Original copies of shipment docs.exe 1556 Original copies of shipment docs.exe 1556 Original copies of shipment docs.exe 1556 Original copies of shipment docs.exe 540 ipconfig.exe 540 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Original copies of shipment docs.exeipconfig.exedescription pid process Token: SeDebugPrivilege 1556 Original copies of shipment docs.exe Token: SeDebugPrivilege 540 ipconfig.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Original copies of shipment docs.exepid process 1268 Original copies of shipment docs.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Original copies of shipment docs.exeExplorer.EXEipconfig.exedescription pid process target process PID 1268 wrote to memory of 1556 1268 Original copies of shipment docs.exe Original copies of shipment docs.exe PID 1268 wrote to memory of 1556 1268 Original copies of shipment docs.exe Original copies of shipment docs.exe PID 1268 wrote to memory of 1556 1268 Original copies of shipment docs.exe Original copies of shipment docs.exe PID 1268 wrote to memory of 1556 1268 Original copies of shipment docs.exe Original copies of shipment docs.exe PID 1268 wrote to memory of 1556 1268 Original copies of shipment docs.exe Original copies of shipment docs.exe PID 1196 wrote to memory of 540 1196 Explorer.EXE ipconfig.exe PID 1196 wrote to memory of 540 1196 Explorer.EXE ipconfig.exe PID 1196 wrote to memory of 540 1196 Explorer.EXE ipconfig.exe PID 1196 wrote to memory of 540 1196 Explorer.EXE ipconfig.exe PID 540 wrote to memory of 1876 540 ipconfig.exe cmd.exe PID 540 wrote to memory of 1876 540 ipconfig.exe cmd.exe PID 540 wrote to memory of 1876 540 ipconfig.exe cmd.exe PID 540 wrote to memory of 1876 540 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Original copies of shipment docs.exe"C:\Users\Admin\AppData\Local\Temp\Original copies of shipment docs.exe"2⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Original copies of shipment docs.exe"C:\Users\Admin\AppData\Local\Temp\Original copies of shipment docs.exe"3⤵
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Original copies of shipment docs.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/540-75-0x0000000000000000-mapping.dmp
-
memory/540-81-0x0000000000540000-0x00000000005CF000-memory.dmpFilesize
572KB
-
memory/540-80-0x0000000002200000-0x0000000002503000-memory.dmpFilesize
3.0MB
-
memory/540-78-0x00000000000D0000-0x00000000000F8000-memory.dmpFilesize
160KB
-
memory/540-77-0x0000000000AD0000-0x0000000000ADA000-memory.dmpFilesize
40KB
-
memory/1196-72-0x00000000049B0000-0x0000000004A77000-memory.dmpFilesize
796KB
-
memory/1196-74-0x0000000004D70000-0x0000000004ED9000-memory.dmpFilesize
1.4MB
-
memory/1196-82-0x0000000009340000-0x000000000948C000-memory.dmpFilesize
1.3MB
-
memory/1268-62-0x00000000002A0000-0x00000000002AC000-memory.dmpFilesize
48KB
-
memory/1268-63-0x0000000075591000-0x0000000075593000-memory.dmpFilesize
8KB
-
memory/1556-70-0x000000001E7B0000-0x000000001EAB3000-memory.dmpFilesize
3.0MB
-
memory/1556-71-0x000000001E5D0000-0x000000001E5E0000-memory.dmpFilesize
64KB
-
memory/1556-73-0x0000000000070000-0x0000000000080000-memory.dmpFilesize
64KB
-
memory/1556-69-0x0000000000401000-0x0000000000541000-memory.dmpFilesize
1.2MB
-
memory/1556-67-0x00000000001B0000-0x00000000002B0000-memory.dmpFilesize
1024KB
-
memory/1556-65-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/1556-64-0x00000000004019EC-mapping.dmp
-
memory/1876-79-0x0000000000000000-mapping.dmp