Overview
overview
10Static
static
1006ffb7bbd7...da3906
linux_amd64
06ffb7bbd7...da3906
linux_mipsel
06ffb7bbd7...da3906
linux_mips
154080c584...95.msi
windows7_x64
8154080c584...95.msi
windows10_x64
81650ced30c...c5.exe
windows7_x64
1650ced30c...c5.exe
windows10_x64
1a70a7de8a...4a.exe
windows7_x64
81a70a7de8a...4a.exe
windows10_x64
8ISSUES INV....1.exe
windows7_x64
10ISSUES INV....1.exe
windows10_x64
10350fbd43ce...ed.exe
windows7_x64
350fbd43ce...ed.exe
windows10_x64
44faf11719...12.exe
windows7_x64
144faf11719...12.exe
windows10_x64
14853dc09bb...5f6.js
windows7_x64
14853dc09bb...5f6.js
windows10_x64
14ba637df90...3f4a9e
linux_amd64
4ba637df90...3f4a9e
linux_mipsel
4ba637df90...3f4a9e
linux_mips
4f8c1840d6...92df06
linux_amd64
4f8c1840d6...92df06
linux_mipsel
4f8c1840d6...92df06
linux_mips
623534bf15...72.vbs
windows7_x64
10623534bf15...72.vbs
windows10_x64
1065df637db2...00083b
linux_amd64
65df637db2...00083b
linux_mipsel
65df637db2...00083b
linux_mips
717ad3ee2b...47.dll
windows7_x64
10717ad3ee2b...47.dll
windows10_x64
1071ba20bdd8...99.pps
windows7_x64
1071ba20bdd8...99.pps
windows10_x64
10Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-07-2021 13:07
Behavioral task
behavioral1
Sample
06ffb7bbd7dd6a47bd3fdb77f86e2bc3b3a9d0112496eed24f75581164da3906
Resource
ubuntu-amd64
Behavioral task
behavioral2
Sample
06ffb7bbd7dd6a47bd3fdb77f86e2bc3b3a9d0112496eed24f75581164da3906
Resource
debian9-mipsel
Behavioral task
behavioral3
Sample
06ffb7bbd7dd6a47bd3fdb77f86e2bc3b3a9d0112496eed24f75581164da3906
Resource
debian9-mipsbe
Behavioral task
behavioral4
Sample
154080c5844ed76332320fcf3f1773391d80200f18f9025fd05b55b86f8ff795.msi
Resource
win7v20210408
Behavioral task
behavioral5
Sample
154080c5844ed76332320fcf3f1773391d80200f18f9025fd05b55b86f8ff795.msi
Resource
win10v20210410
Behavioral task
behavioral6
Sample
1650ced30cfb68451bb432b44f72fa93687d95d83f70fa039658d8cb665508c5.exe
Resource
win7v20210410
Behavioral task
behavioral7
Sample
1650ced30cfb68451bb432b44f72fa93687d95d83f70fa039658d8cb665508c5.exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
1a70a7de8a393638b80336e9d2b225c2fd199d9d3eed3ad2c007656cc20c2b4a.exe
Resource
win7v20210410
Behavioral task
behavioral9
Sample
1a70a7de8a393638b80336e9d2b225c2fd199d9d3eed3ad2c007656cc20c2b4a.exe
Resource
win10v20210408
Behavioral task
behavioral10
Sample
ISSUES INVOICE E-4136 REV.1.exe
Resource
win7v20210410
Behavioral task
behavioral11
Sample
ISSUES INVOICE E-4136 REV.1.exe
Resource
win10v20210408
Behavioral task
behavioral12
Sample
350fbd43ce6f7d1d3d636aa5b94187d4dcc8e866527cfdc9c9ce226aea3500ed.exe
Resource
win7v20210408
Behavioral task
behavioral13
Sample
350fbd43ce6f7d1d3d636aa5b94187d4dcc8e866527cfdc9c9ce226aea3500ed.exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
44faf11719b3a679e7a6dd5db40033ec4dd6e1b0361c145b81586cb735a64112.exe
Resource
win7v20210408
Behavioral task
behavioral15
Sample
44faf11719b3a679e7a6dd5db40033ec4dd6e1b0361c145b81586cb735a64112.exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
4853dc09bbd4a61610a354d5fcd0f9e376e284124c5ff949ba49457eed1f55f6.js
Resource
win7v20210410
Behavioral task
behavioral17
Sample
4853dc09bbd4a61610a354d5fcd0f9e376e284124c5ff949ba49457eed1f55f6.js
Resource
win10v20210408
Behavioral task
behavioral18
Sample
4ba637df90076330cdace697a87aafc6dd1d1b3a35b4ad924aad80aa7c3f4a9e
Resource
ubuntu-amd64
Behavioral task
behavioral19
Sample
4ba637df90076330cdace697a87aafc6dd1d1b3a35b4ad924aad80aa7c3f4a9e
Resource
debian9-mipsel
Behavioral task
behavioral20
Sample
4ba637df90076330cdace697a87aafc6dd1d1b3a35b4ad924aad80aa7c3f4a9e
Resource
debian9-mipsbe
Behavioral task
behavioral21
Sample
4f8c1840d692d8248f3b7cb478acfbb7e65bdeecd64790a163eaa0db5592df06
Resource
ubuntu-amd64
Behavioral task
behavioral22
Sample
4f8c1840d692d8248f3b7cb478acfbb7e65bdeecd64790a163eaa0db5592df06
Resource
debian9-mipsel
Behavioral task
behavioral23
Sample
4f8c1840d692d8248f3b7cb478acfbb7e65bdeecd64790a163eaa0db5592df06
Resource
debian9-mipsbe
Behavioral task
behavioral24
Sample
623534bf150f2538edb27e51ed56b92f464adb5da8e2db378ec3a666fcb64772.vbs
Resource
win7v20210410
Behavioral task
behavioral25
Sample
623534bf150f2538edb27e51ed56b92f464adb5da8e2db378ec3a666fcb64772.vbs
Resource
win10v20210410
Behavioral task
behavioral26
Sample
65df637db227ff1685bdf82ab676de4ed70bffd4c96e6cde70d575217700083b
Resource
ubuntu-amd64
Behavioral task
behavioral27
Sample
65df637db227ff1685bdf82ab676de4ed70bffd4c96e6cde70d575217700083b
Resource
debian9-mipsel
Behavioral task
behavioral28
Sample
65df637db227ff1685bdf82ab676de4ed70bffd4c96e6cde70d575217700083b
Resource
debian9-mipsbe
Behavioral task
behavioral29
Sample
717ad3ee2b9ae94aac5bd01bce9bb945d8c620e3a60f241864dede3646f3dd47.dll
Resource
win7v20210410
Behavioral task
behavioral30
Sample
717ad3ee2b9ae94aac5bd01bce9bb945d8c620e3a60f241864dede3646f3dd47.dll
Resource
win10v20210410
Behavioral task
behavioral31
Sample
71ba20bdd899fde2a4e2967bc6c719f2c96146cc80c3dd8953431cb82d4df199.pps
Resource
win7v20210408
Behavioral task
behavioral32
Sample
71ba20bdd899fde2a4e2967bc6c719f2c96146cc80c3dd8953431cb82d4df199.pps
Resource
win10v20210410
General
-
Target
ISSUES INVOICE E-4136 REV.1.exe
-
Size
646KB
-
MD5
02efae6482a081c221d846f386752d3a
-
SHA1
2c2dce7d34e81dd0329022ec41802ce8296a7ba7
-
SHA256
19f2101d500dfa2ba71baf220497fe8888667bb7d9c8cf4996087ff67c11d156
-
SHA512
00dd5efb9b60a914072f9f9c555da0c4ad3871bf74a14312e0429662f2aa55a75cd9352e49690e07478e4b079ffc9f7592bbda48c56027ecda6c714374f0b925
Malware Config
Extracted
xloader
2.3
http://www.wwwgraciescottage.com/u9pi/
balancerestoreomaha.com
allpurposepaintingservices.com
talsworldwide.com
specialforcesofindia.com
flaxx.life
taspate.com
88q858.com
parossunbed.com
pontacols.com
soulpowerlive.com
holowide.com
covidcustomdesigns.com
cleaner-solar.com
cnhy0769.com
gmb-marketing.com
thepassiveincomecreator.com
kate.chat
awkwardpeachfitness.com
lolly-bops.com
29752ellendale.com
hardrock.site
eaornti.com
angelademarco.com
jimeipifa.com
bestcoastwellness.com
savignies.com
pantheoncases.com
myzoomroomz.com
sutransformacion.com
rhexlux.com
schnarr-online.com
e-srot.com
thecode.community
enrgsystems.com
allterdsmatter.com
navyugitsolutions.com
red-studios.com
hotelcastellgye.com
kujtimet.com
irondoorsnearme.net
connecteddots.digital
putortifashions.com
jeilaslimefactory.com
veristasolutions.com
simplysummerdawn.com
pohanc.net
saltairbeer.com
rapidexpressshipping.com
jukeboxjeffdj.com
renetyson.com
uluapokehouse.com
fimco.net
bidatauction.net
notimpersonating.com
vascularsurgery.club
cjcgraphics.info
remoteandnice.com
blogafonte.com
eclorui.com
ravexim3.com
cloudservices.technology
gezirapharma-sd.com
couia.com
shlokus.info
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral11/memory/1364-124-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral11/memory/1364-125-0x000000000041D040-mapping.dmp xloader behavioral11/memory/2836-133-0x0000000000880000-0x00000000008A8000-memory.dmp xloader -
Suspicious use of SetThreadContext 4 IoCs
Processes:
ISSUES INVOICE E-4136 REV.1.exeISSUES INVOICE E-4136 REV.1.execmstp.exedescription pid process target process PID 3920 set thread context of 1364 3920 ISSUES INVOICE E-4136 REV.1.exe ISSUES INVOICE E-4136 REV.1.exe PID 1364 set thread context of 3000 1364 ISSUES INVOICE E-4136 REV.1.exe Explorer.EXE PID 1364 set thread context of 3000 1364 ISSUES INVOICE E-4136 REV.1.exe Explorer.EXE PID 2836 set thread context of 3000 2836 cmstp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 46 IoCs
Processes:
ISSUES INVOICE E-4136 REV.1.execmstp.exepid process 1364 ISSUES INVOICE E-4136 REV.1.exe 1364 ISSUES INVOICE E-4136 REV.1.exe 1364 ISSUES INVOICE E-4136 REV.1.exe 1364 ISSUES INVOICE E-4136 REV.1.exe 1364 ISSUES INVOICE E-4136 REV.1.exe 1364 ISSUES INVOICE E-4136 REV.1.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe 2836 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3000 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ISSUES INVOICE E-4136 REV.1.execmstp.exepid process 1364 ISSUES INVOICE E-4136 REV.1.exe 1364 ISSUES INVOICE E-4136 REV.1.exe 1364 ISSUES INVOICE E-4136 REV.1.exe 1364 ISSUES INVOICE E-4136 REV.1.exe 2836 cmstp.exe 2836 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ISSUES INVOICE E-4136 REV.1.execmstp.exedescription pid process Token: SeDebugPrivilege 1364 ISSUES INVOICE E-4136 REV.1.exe Token: SeDebugPrivilege 2836 cmstp.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3000 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ISSUES INVOICE E-4136 REV.1.exeExplorer.EXEcmstp.exedescription pid process target process PID 3920 wrote to memory of 1364 3920 ISSUES INVOICE E-4136 REV.1.exe ISSUES INVOICE E-4136 REV.1.exe PID 3920 wrote to memory of 1364 3920 ISSUES INVOICE E-4136 REV.1.exe ISSUES INVOICE E-4136 REV.1.exe PID 3920 wrote to memory of 1364 3920 ISSUES INVOICE E-4136 REV.1.exe ISSUES INVOICE E-4136 REV.1.exe PID 3920 wrote to memory of 1364 3920 ISSUES INVOICE E-4136 REV.1.exe ISSUES INVOICE E-4136 REV.1.exe PID 3920 wrote to memory of 1364 3920 ISSUES INVOICE E-4136 REV.1.exe ISSUES INVOICE E-4136 REV.1.exe PID 3920 wrote to memory of 1364 3920 ISSUES INVOICE E-4136 REV.1.exe ISSUES INVOICE E-4136 REV.1.exe PID 3000 wrote to memory of 2836 3000 Explorer.EXE cmstp.exe PID 3000 wrote to memory of 2836 3000 Explorer.EXE cmstp.exe PID 3000 wrote to memory of 2836 3000 Explorer.EXE cmstp.exe PID 2836 wrote to memory of 3716 2836 cmstp.exe cmd.exe PID 2836 wrote to memory of 3716 2836 cmstp.exe cmd.exe PID 2836 wrote to memory of 3716 2836 cmstp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ISSUES INVOICE E-4136 REV.1.exe"C:\Users\Admin\AppData\Local\Temp\ISSUES INVOICE E-4136 REV.1.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ISSUES INVOICE E-4136 REV.1.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ISSUES INVOICE E-4136 REV.1.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1364-129-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/1364-124-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1364-125-0x000000000041D040-mapping.dmp
-
memory/1364-127-0x00000000010C0000-0x00000000010D0000-memory.dmpFilesize
64KB
-
memory/1364-126-0x0000000001420000-0x0000000001740000-memory.dmpFilesize
3.1MB
-
memory/2836-136-0x00000000041D0000-0x000000000425F000-memory.dmpFilesize
572KB
-
memory/2836-132-0x0000000000A10000-0x0000000000A26000-memory.dmpFilesize
88KB
-
memory/2836-134-0x0000000004380000-0x00000000046A0000-memory.dmpFilesize
3.1MB
-
memory/2836-133-0x0000000000880000-0x00000000008A8000-memory.dmpFilesize
160KB
-
memory/2836-131-0x0000000000000000-mapping.dmp
-
memory/3000-137-0x0000000007100000-0x0000000007247000-memory.dmpFilesize
1.3MB
-
memory/3000-128-0x0000000006FA0000-0x00000000070FB000-memory.dmpFilesize
1.4MB
-
memory/3000-130-0x00000000072D0000-0x0000000007452000-memory.dmpFilesize
1.5MB
-
memory/3716-135-0x0000000000000000-mapping.dmp
-
memory/3920-116-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/3920-117-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/3920-114-0x0000000000850000-0x0000000000851000-memory.dmpFilesize
4KB
-
memory/3920-123-0x0000000007610000-0x000000000765E000-memory.dmpFilesize
312KB
-
memory/3920-122-0x0000000006F30000-0x0000000006FCB000-memory.dmpFilesize
620KB
-
memory/3920-121-0x0000000007670000-0x0000000007671000-memory.dmpFilesize
4KB
-
memory/3920-120-0x00000000056C0000-0x00000000056C2000-memory.dmpFilesize
8KB
-
memory/3920-119-0x0000000005270000-0x000000000576E000-memory.dmpFilesize
5.0MB
-
memory/3920-118-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB