Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
19-08-2021 05:20
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCUMENT.exe
Resource
win7v20210410
General
-
Target
SHIPPING DOCUMENT.exe
-
Size
622KB
-
MD5
482fa062ccc6bddcf62b70186194cb6c
-
SHA1
9c0f6c938ab0cf047817d1d0838b303d5587048e
-
SHA256
02ad1e8b1187eba2576ef84f878c7c9b579fdad150ec5f4f060c814d22ab0550
-
SHA512
95b7dd6ad34243825a825af92408fdc4ede68b4d9be3e9f42341bd0d48b3dd782e9bce984bb9a1f356de0b28966a4c688bb967b84307802b0e5c6382888266ab
Malware Config
Extracted
xloader
2.3
e2wa
http://www.waterandthreads.com/e2wa/
mursdiary.com
bivibe.com
margueritebriu.com
xn--schttorf-openair-lzb.com
lyatransport.com
exclusivemerchantsolutions.com
cafedeollamendoza.com
myfashionest.com
bonap56.com
dubaikey.club
redwoodva.com
suffolkpolicepba.com
zonedblack.com
alekhyasarees.com
moonrockscanada.com
info-kaiteki.com
covidtenantrelief.com
jiazhengayi.com
cryptotrustlab.com
jeanpaulramirez.money
paradiseimoveis.com
blackdogrenovation.com
tbsolucionesdigitales.com
gteduca.com
besure-inspections.com
yaffasports.com
driveetrucks.com
d4la.com
qikpaypa.com
learners.host
harrisfrenchies.com
qra-practitioner.info
betassist.info
slots918.com
vitaproshop.com
centralkidsonline.com
virtualsalespartner.com
myaccountantlondon.net
egytci.com
hearttoheartgroupllc.com
sdxsx.com
italybase.com
ohmmy.store
batiburriyo.com
kinchobbq.com
landoflostchemists.com
militaryhelponpaymentsnow.info
lightspeedcleaningservice.com
supplementery.com
frididiare.com
kotokisuojana.com
bijousecret.com
lespace64.com
66cent.com
freejoys.com
tudodoido.com
carlotasthings.com
xn--c3csjh3dnu3g2fc1gd.com
evansvilleendos.com
themissionstatment.com
anonymouspeer.com
com172658295875.info
worldwithoutworry.com
genovacmab.com
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/924-62-0x0000000000000000-mapping.dmp xloader behavioral1/memory/924-64-0x0000000010410000-0x0000000010439000-memory.dmp xloader behavioral1/memory/1460-70-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run help.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\URXXCFWH2T = "C:\\Program Files (x86)\\internet explorer\\ieinstal.exe" help.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
help.exedescription ioc process Key created \Registry\User\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run help.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ieinstal.exehelp.exedescription pid process target process PID 924 set thread context of 1196 924 ieinstal.exe Explorer.EXE PID 1460 set thread context of 1196 1460 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
ieinstal.exehelp.exepid process 924 ieinstal.exe 924 ieinstal.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe 1460 help.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
ieinstal.exehelp.exepid process 924 ieinstal.exe 924 ieinstal.exe 924 ieinstal.exe 1460 help.exe 1460 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
ieinstal.exehelp.exedescription pid process Token: SeDebugPrivilege 924 ieinstal.exe Token: SeDebugPrivilege 1460 help.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE 1196 Explorer.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
SHIPPING DOCUMENT.exeExplorer.EXEdescription pid process target process PID 1748 wrote to memory of 924 1748 SHIPPING DOCUMENT.exe ieinstal.exe PID 1748 wrote to memory of 924 1748 SHIPPING DOCUMENT.exe ieinstal.exe PID 1748 wrote to memory of 924 1748 SHIPPING DOCUMENT.exe ieinstal.exe PID 1748 wrote to memory of 924 1748 SHIPPING DOCUMENT.exe ieinstal.exe PID 1748 wrote to memory of 924 1748 SHIPPING DOCUMENT.exe ieinstal.exe PID 1748 wrote to memory of 924 1748 SHIPPING DOCUMENT.exe ieinstal.exe PID 1748 wrote to memory of 924 1748 SHIPPING DOCUMENT.exe ieinstal.exe PID 1748 wrote to memory of 924 1748 SHIPPING DOCUMENT.exe ieinstal.exe PID 1748 wrote to memory of 924 1748 SHIPPING DOCUMENT.exe ieinstal.exe PID 1748 wrote to memory of 924 1748 SHIPPING DOCUMENT.exe ieinstal.exe PID 1196 wrote to memory of 1460 1196 Explorer.EXE help.exe PID 1196 wrote to memory of 1460 1196 Explorer.EXE help.exe PID 1196 wrote to memory of 1460 1196 Explorer.EXE help.exe PID 1196 wrote to memory of 1460 1196 Explorer.EXE help.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\internet explorer\ieinstal.exe"C:\Program Files (x86)\internet explorer\ieinstal.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/924-65-0x00000000021D0000-0x00000000024D3000-memory.dmpFilesize
3.0MB
-
memory/924-62-0x0000000000000000-mapping.dmp
-
memory/924-63-0x00000000000A0000-0x00000000000A1000-memory.dmpFilesize
4KB
-
memory/924-64-0x0000000010410000-0x0000000010439000-memory.dmpFilesize
164KB
-
memory/924-66-0x00000000001D0000-0x00000000001E0000-memory.dmpFilesize
64KB
-
memory/1196-67-0x0000000006F60000-0x0000000007095000-memory.dmpFilesize
1.2MB
-
memory/1196-73-0x0000000009090000-0x00000000091E1000-memory.dmpFilesize
1.3MB
-
memory/1460-68-0x0000000000000000-mapping.dmp
-
memory/1460-71-0x0000000000840000-0x0000000000B43000-memory.dmpFilesize
3.0MB
-
memory/1460-70-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1460-69-0x00000000006A0000-0x00000000006A6000-memory.dmpFilesize
24KB
-
memory/1460-72-0x00000000004E0000-0x000000000056F000-memory.dmpFilesize
572KB
-
memory/1748-60-0x00000000757E1000-0x00000000757E3000-memory.dmpFilesize
8KB
-
memory/1748-61-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB