Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
06-05-2021 08:11
Static task
static1
Behavioral task
behavioral1
Sample
DHL Receipt_AWB811470484778.exe
Resource
win7v20210410
General
-
Target
DHL Receipt_AWB811470484778.exe
-
Size
1.2MB
-
MD5
54e12bb22e93723f1207f9b0c68ce740
-
SHA1
c4c2bd10d4e5a21997e1b5a2eec5beccd63759ea
-
SHA256
47e832373110163a11b922941cb9a2377c7e44ed290a528073152b0fb1ffef93
-
SHA512
d1741eecc9bb3177ce4b115ded4379af5d4898a9088882f130f3a52ecfca5cdefd488316e8076f42c56d5e0c12119b38de28236429b67daaf9262b64af1a5bf3
Malware Config
Extracted
xloader
2.3
http://www.maleev.design/a7dr/
thevirginiahighlanders.com
crazybenzi.com
nottruthful.com
happi.info
amjadlighting.com
mlebentv.com
pogrebnolipa.com
907wine.com
programheart.com
jenniferlarmstrong.com
alexjcarpenter.com
rokyslegendou.com
confidenceismine.com
thegeek420.com
hover-lover.com
conversationallawinstitute.com
ssonya.com
woopyyl.com
ebotasymas.com
nysobvakoiijqjs.com
apt-school.com
towerplaceapartments.com
lafinchfabric.com
solterosdeviaje.net
thenextcatastrophe.com
kleanrituals.net
boyamobilya.com
unstoppablegoodness.com
szwj91.com
daeverse.com
contorig2.com
tradingandcargo.com
freedomseattle.net
vegefitness.net
bastiontools.tools
enbienes.com
nestedmedia.com
beforeandafter-alwayshair.com
impianramai.com
labour.lgbt
simplifytaos.com
exaskate.com
arolist.com
joaomkt.com
byedon2020gear.com
saibailong.com
xn--elektrikpazar-gbc.com
annaiasacademy.com
jimmygmask.com
fearlesssport.store
toiyzy.com
stringsandthingsnwa.com
heaheakoya.com
peakvitamind3.com
kennethjtackett.com
mysticjp.com
momohuishou.com
theclubmarbella.com
doreljuvenilecares.com
begeorgia.com
pinnacleviewapartment.com
soberrituals.com
recometals.com
saywahhtech.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1488-125-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/1488-126-0x000000000041D010-mapping.dmp xloader behavioral2/memory/1020-133-0x0000000000CA0000-0x0000000000CC8000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
DHL Receipt_AWB811470484778.exeDHL Receipt_AWB811470484778.exeipconfig.exedescription pid process target process PID 640 set thread context of 1488 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 1488 set thread context of 2428 1488 DHL Receipt_AWB811470484778.exe Explorer.EXE PID 1020 set thread context of 2428 1020 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1020 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
DHL Receipt_AWB811470484778.exeDHL Receipt_AWB811470484778.exeipconfig.exepid process 640 DHL Receipt_AWB811470484778.exe 640 DHL Receipt_AWB811470484778.exe 640 DHL Receipt_AWB811470484778.exe 640 DHL Receipt_AWB811470484778.exe 1488 DHL Receipt_AWB811470484778.exe 1488 DHL Receipt_AWB811470484778.exe 1488 DHL Receipt_AWB811470484778.exe 1488 DHL Receipt_AWB811470484778.exe 1020 ipconfig.exe 1020 ipconfig.exe 1020 ipconfig.exe 1020 ipconfig.exe 1020 ipconfig.exe 1020 ipconfig.exe 1020 ipconfig.exe 1020 ipconfig.exe 1020 ipconfig.exe 1020 ipconfig.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DHL Receipt_AWB811470484778.exeipconfig.exepid process 1488 DHL Receipt_AWB811470484778.exe 1488 DHL Receipt_AWB811470484778.exe 1488 DHL Receipt_AWB811470484778.exe 1020 ipconfig.exe 1020 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
DHL Receipt_AWB811470484778.exeDHL Receipt_AWB811470484778.exeipconfig.exedescription pid process Token: SeDebugPrivilege 640 DHL Receipt_AWB811470484778.exe Token: SeDebugPrivilege 1488 DHL Receipt_AWB811470484778.exe Token: SeDebugPrivilege 1020 ipconfig.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
DHL Receipt_AWB811470484778.exeExplorer.EXEipconfig.exedescription pid process target process PID 640 wrote to memory of 3296 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 640 wrote to memory of 3296 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 640 wrote to memory of 3296 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 640 wrote to memory of 2236 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 640 wrote to memory of 2236 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 640 wrote to memory of 2236 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 640 wrote to memory of 1488 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 640 wrote to memory of 1488 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 640 wrote to memory of 1488 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 640 wrote to memory of 1488 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 640 wrote to memory of 1488 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 640 wrote to memory of 1488 640 DHL Receipt_AWB811470484778.exe DHL Receipt_AWB811470484778.exe PID 2428 wrote to memory of 1020 2428 Explorer.EXE ipconfig.exe PID 2428 wrote to memory of 1020 2428 Explorer.EXE ipconfig.exe PID 2428 wrote to memory of 1020 2428 Explorer.EXE ipconfig.exe PID 1020 wrote to memory of 2104 1020 ipconfig.exe cmd.exe PID 1020 wrote to memory of 2104 1020 ipconfig.exe cmd.exe PID 1020 wrote to memory of 2104 1020 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Receipt_AWB811470484778.exe"C:\Users\Admin\AppData\Local\Temp\DHL Receipt_AWB811470484778.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Receipt_AWB811470484778.exe"C:\Users\Admin\AppData\Local\Temp\DHL Receipt_AWB811470484778.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Receipt_AWB811470484778.exe"C:\Users\Admin\AppData\Local\Temp\DHL Receipt_AWB811470484778.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\DHL Receipt_AWB811470484778.exe"C:\Users\Admin\AppData\Local\Temp\DHL Receipt_AWB811470484778.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL Receipt_AWB811470484778.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/640-114-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/640-116-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/640-117-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/640-118-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/640-119-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/640-120-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/640-121-0x0000000004E70000-0x000000000536E000-memory.dmpFilesize
5.0MB
-
memory/640-122-0x0000000005360000-0x000000000536E000-memory.dmpFilesize
56KB
-
memory/640-123-0x0000000000C60000-0x0000000000CD9000-memory.dmpFilesize
484KB
-
memory/640-124-0x0000000009700000-0x0000000009732000-memory.dmpFilesize
200KB
-
memory/1020-131-0x0000000000000000-mapping.dmp
-
memory/1020-132-0x0000000000CE0000-0x0000000000CEB000-memory.dmpFilesize
44KB
-
memory/1020-133-0x0000000000CA0000-0x0000000000CC8000-memory.dmpFilesize
160KB
-
memory/1020-134-0x0000000002D40000-0x0000000002E8A000-memory.dmpFilesize
1.3MB
-
memory/1020-136-0x0000000003230000-0x00000000032BF000-memory.dmpFilesize
572KB
-
memory/1488-126-0x000000000041D010-mapping.dmp
-
memory/1488-128-0x0000000001070000-0x0000000001390000-memory.dmpFilesize
3.1MB
-
memory/1488-130-0x0000000000BF0000-0x0000000000C00000-memory.dmpFilesize
64KB
-
memory/1488-125-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2104-135-0x0000000000000000-mapping.dmp
-
memory/2428-129-0x00000000049F0000-0x0000000004B83000-memory.dmpFilesize
1.6MB
-
memory/2428-137-0x0000000004B90000-0x0000000004C90000-memory.dmpFilesize
1024KB