Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
27-07-2021 23:51
Static task
static1
Behavioral task
behavioral1
Sample
Invoice #210722 14,890 $.exe
Resource
win7v20210410
General
-
Target
Invoice #210722 14,890 $.exe
-
Size
700KB
-
MD5
9f049132f0c15e8687a0b670deab0960
-
SHA1
37ded4a6085ad07cfbc97ac43d8fcfa5c81e8cbf
-
SHA256
89fd73d17d825a1e661f69b41ffd9fcd9f5a3d044159763cbc82ffd0210eb78a
-
SHA512
6fb576e6fe3c7fdcd84a1e0ff0cb7d6f4d859aedc2e759128cc596a3ec1875dd51edb2fd462b8140b5f7aeec02c044ec139ae70c5a606c5ee3beaebb7136ad53
Malware Config
Extracted
xloader
2.3
http://www.appackersandmoversbengaluru.com/p4se/
weightlossforprofessionals.com
talkotstopandshop.com
everesttechsolutions.com
garboarts.com
esubastas-online.com
electriclastmile.com
tomio.tech
jacoty.com
knot-tied-up.com
energychoicesim.com
rocketcompaniessham.com
madarasapattinam.com
promosplace.com
newstarchurch.com
thesaleskitchen.com
slingmodeinc.com
jobresulthub.com
pillclk.com
shipu119.com
sibalcar.com
quotovate.com
bluecoyotecontracting.com
hc68kr.com
laundry39.com
vietthaivt.com
ikonflorida.com
xn--sm2b97e.com
innovisional.co.uk
spacecityscouples.com
slmccallum.com
hro41.com
theyardcardzstore.com
primewildlife.com
xn--seranderturzm-ebc.com
stilesandhansen.com
bvlesty.com
hejiayin.com
philosophersdojo.com
aworldofsofas.com
itile.net
unitronicdealers.com
savasoguz.com
magetu.info
devgmor.com
villasabai.com
pipipenguin.com
furnishessentials.com
patchmonitoring.com
michaelhumphriesrealestate.com
pratikahealth.com
caswellcu.com
lakeportal.com
weedyourmind.com
cardamommm.com
freshstartrestorationllcmd.com
mastercardbhdleon.com
ceramiccottageco.com
magiczneszkielka.com
casebookconnet.com
recharge.directory
phoneprivacyscreen.com
mumbaindicator.com
jumboprovacy.com
streamerdojo.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2292-125-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2292-126-0x000000000041D0F0-mapping.dmp xloader behavioral2/memory/3868-132-0x0000000000950000-0x0000000000979000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Invoice #210722 14,890 $.exeInvoice #210722 14,890 $.execontrol.exedescription pid process target process PID 564 set thread context of 2292 564 Invoice #210722 14,890 $.exe Invoice #210722 14,890 $.exe PID 2292 set thread context of 2708 2292 Invoice #210722 14,890 $.exe Explorer.EXE PID 3868 set thread context of 2708 3868 control.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
Invoice #210722 14,890 $.execontrol.exepid process 2292 Invoice #210722 14,890 $.exe 2292 Invoice #210722 14,890 $.exe 2292 Invoice #210722 14,890 $.exe 2292 Invoice #210722 14,890 $.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe 3868 control.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2708 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Invoice #210722 14,890 $.execontrol.exepid process 2292 Invoice #210722 14,890 $.exe 2292 Invoice #210722 14,890 $.exe 2292 Invoice #210722 14,890 $.exe 3868 control.exe 3868 control.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Invoice #210722 14,890 $.execontrol.exedescription pid process Token: SeDebugPrivilege 2292 Invoice #210722 14,890 $.exe Token: SeDebugPrivilege 3868 control.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Invoice #210722 14,890 $.exeExplorer.EXEcontrol.exedescription pid process target process PID 564 wrote to memory of 2292 564 Invoice #210722 14,890 $.exe Invoice #210722 14,890 $.exe PID 564 wrote to memory of 2292 564 Invoice #210722 14,890 $.exe Invoice #210722 14,890 $.exe PID 564 wrote to memory of 2292 564 Invoice #210722 14,890 $.exe Invoice #210722 14,890 $.exe PID 564 wrote to memory of 2292 564 Invoice #210722 14,890 $.exe Invoice #210722 14,890 $.exe PID 564 wrote to memory of 2292 564 Invoice #210722 14,890 $.exe Invoice #210722 14,890 $.exe PID 564 wrote to memory of 2292 564 Invoice #210722 14,890 $.exe Invoice #210722 14,890 $.exe PID 2708 wrote to memory of 3868 2708 Explorer.EXE control.exe PID 2708 wrote to memory of 3868 2708 Explorer.EXE control.exe PID 2708 wrote to memory of 3868 2708 Explorer.EXE control.exe PID 3868 wrote to memory of 3592 3868 control.exe cmd.exe PID 3868 wrote to memory of 3592 3868 control.exe cmd.exe PID 3868 wrote to memory of 3592 3868 control.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice #210722 14,890 $.exe"C:\Users\Admin\AppData\Local\Temp\Invoice #210722 14,890 $.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Invoice #210722 14,890 $.exe"C:\Users\Admin\AppData\Local\Temp\Invoice #210722 14,890 $.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Invoice #210722 14,890 $.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/564-114-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/564-116-0x00000000070C0000-0x000000000716A000-memory.dmpFilesize
680KB
-
memory/564-117-0x000000000A670000-0x000000000A671000-memory.dmpFilesize
4KB
-
memory/564-118-0x000000000A170000-0x000000000A171000-memory.dmpFilesize
4KB
-
memory/564-119-0x000000000A2B0000-0x000000000A2B1000-memory.dmpFilesize
4KB
-
memory/564-120-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/564-121-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/564-122-0x0000000004D50000-0x0000000004D6B000-memory.dmpFilesize
108KB
-
memory/564-123-0x0000000000B60000-0x0000000000BD4000-memory.dmpFilesize
464KB
-
memory/564-124-0x0000000000BE0000-0x0000000000C0F000-memory.dmpFilesize
188KB
-
memory/2292-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2292-126-0x000000000041D0F0-mapping.dmp
-
memory/2292-128-0x0000000001100000-0x00000000011AE000-memory.dmpFilesize
696KB
-
memory/2292-127-0x0000000001770000-0x0000000001A90000-memory.dmpFilesize
3.1MB
-
memory/2708-129-0x00000000062E0000-0x0000000006426000-memory.dmpFilesize
1.3MB
-
memory/2708-136-0x0000000006810000-0x0000000006947000-memory.dmpFilesize
1.2MB
-
memory/3592-133-0x0000000000000000-mapping.dmp
-
memory/3868-130-0x0000000000000000-mapping.dmp
-
memory/3868-131-0x00000000013D0000-0x00000000013F0000-memory.dmpFilesize
128KB
-
memory/3868-132-0x0000000000950000-0x0000000000979000-memory.dmpFilesize
164KB
-
memory/3868-134-0x0000000004CC0000-0x0000000004FE0000-memory.dmpFilesize
3.1MB
-
memory/3868-135-0x0000000004980000-0x0000000004A0F000-memory.dmpFilesize
572KB