Analysis
-
max time kernel
1205s -
max time network
1207s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
29-08-2021 02:52
Static task
static1
Behavioral task
behavioral1
Sample
Booking and Shipping Reference Details.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Booking and Shipping Reference Details.exe
Resource
win10v20210408
General
-
Target
Booking and Shipping Reference Details.exe
-
Size
764KB
-
MD5
261e1d3d96af2d57fabdf9295a6ad987
-
SHA1
4be2f141e6862bbf8a79bac4900a211008ac6e68
-
SHA256
468169b4fe61a81e910c9b820d46694ad3e089e7d276831e690f86012db80195
-
SHA512
0307ea1169f2193c513af63aadb10fa3a3f0c9bae5767997e940085572150e0db8480cbf4a72dc8795e78570250f0342eec768d8eb63c731519f3091ddec9a05
Malware Config
Extracted
xloader
2.3
u86g
http://www.99356a.com/u86g/
agenciaplim.com
fastpage.info
tiantianbd.com
hanedanpirlanta.com
project1accessories.com
rebeccadoumet.com
vrdnfz.com
jeaninesatl.com
isaakwallihconstruction.com
aegis.cloud
tigerandsnow.com
thehappyadventurer.com
ahhazu.com
hiveplushoney.com
k-plan-ning.com
peresvet.one
darkworkcustoms.com
deathbok.com
blackinkswizz.com
077sb.com
divecow.club
usbankaltituderewrds.com
nordaackalifestyle.com
melsamedia.com
spaziocanova.com
effinghamrotaryclub.com
organicbusinessstrategies.com
nevarsmith.com
bloqx.com
fortsdev.com
kingdomunified.com
missdecals.com
campbellsawmills.com
sharpestridesdetailing.com
castewaipoultryfarmllc.com
aregae.com
waterfiltration.systems
zxywxmr.com
davidedigiovanni.com
vfekhndzc.icu
guardamar.digital
ansb2b.com
nettute.com
getfluvidtested.com
ostadshagerd.com
bolsasytapers.com
deficryptocure.com
rahsiatokki1.com
virtual360hosting.info
rosettafeenathaniel.club
azschoolgy.com
cubanfilms.club
skooliehigh.com
kaybelledesignsllc.com
xn--lel-bla.com
2022.solar
myharitige.com
xn--iiqu5kngm42ez76a.com
kettlebellsamurai.com
nylonpicsporn.com
mimik33.com
minuwales.com
chelseashalza.com
friendchess.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1676-67-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1676-68-0x000000000041D020-mapping.dmp xloader behavioral1/memory/792-76-0x0000000000070000-0x0000000000098000-memory.dmp xloader behavioral1/memory/1764-95-0x000000000041D020-mapping.dmp xloader -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
cscript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\FBCTOLW0O6S = "C:\\Program Files (x86)\\Dnlr0\\windfj8f.exe" cscript.exe -
Executes dropped EXE 2 IoCs
Processes:
windfj8f.exewindfj8f.exepid process 1728 windfj8f.exe 1764 windfj8f.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1692 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
Booking and Shipping Reference Details.exeBooking and Shipping Reference Details.execscript.exewindfj8f.exedescription pid process target process PID 1080 set thread context of 1676 1080 Booking and Shipping Reference Details.exe Booking and Shipping Reference Details.exe PID 1676 set thread context of 1228 1676 Booking and Shipping Reference Details.exe Explorer.EXE PID 1676 set thread context of 1228 1676 Booking and Shipping Reference Details.exe Explorer.EXE PID 792 set thread context of 1228 792 cscript.exe Explorer.EXE PID 1728 set thread context of 1764 1728 windfj8f.exe windfj8f.exe -
Drops file in Program Files directory 2 IoCs
Processes:
cscript.exeExplorer.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Dnlr0\windfj8f.exe cscript.exe File created C:\Program Files (x86)\Dnlr0\windfj8f.exe Explorer.EXE -
Processes:
cscript.exedescription ioc process Key created \Registry\User\S-1-5-21-2455352368-1077083310-2879168483-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 cscript.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Booking and Shipping Reference Details.exeBooking and Shipping Reference Details.execscript.exewindfj8f.exewindfj8f.exepid process 1080 Booking and Shipping Reference Details.exe 1080 Booking and Shipping Reference Details.exe 1676 Booking and Shipping Reference Details.exe 1676 Booking and Shipping Reference Details.exe 1676 Booking and Shipping Reference Details.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 1728 windfj8f.exe 1728 windfj8f.exe 1764 windfj8f.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE -
Suspicious behavior: MapViewOfSection 10 IoCs
Processes:
Booking and Shipping Reference Details.execscript.exepid process 1676 Booking and Shipping Reference Details.exe 1676 Booking and Shipping Reference Details.exe 1676 Booking and Shipping Reference Details.exe 1676 Booking and Shipping Reference Details.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe 792 cscript.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
Booking and Shipping Reference Details.exeBooking and Shipping Reference Details.execscript.exeExplorer.EXEwindfj8f.exewindfj8f.exedescription pid process Token: SeDebugPrivilege 1080 Booking and Shipping Reference Details.exe Token: SeDebugPrivilege 1676 Booking and Shipping Reference Details.exe Token: SeDebugPrivilege 792 cscript.exe Token: SeShutdownPrivilege 1228 Explorer.EXE Token: SeDebugPrivilege 1728 windfj8f.exe Token: SeDebugPrivilege 1764 windfj8f.exe Token: SeShutdownPrivilege 1228 Explorer.EXE Token: SeShutdownPrivilege 1228 Explorer.EXE Token: SeShutdownPrivilege 1228 Explorer.EXE -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of SendNotifyMessage 31 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
Booking and Shipping Reference Details.exeBooking and Shipping Reference Details.execscript.exeExplorer.EXEwindfj8f.exedescription pid process target process PID 1080 wrote to memory of 1676 1080 Booking and Shipping Reference Details.exe Booking and Shipping Reference Details.exe PID 1080 wrote to memory of 1676 1080 Booking and Shipping Reference Details.exe Booking and Shipping Reference Details.exe PID 1080 wrote to memory of 1676 1080 Booking and Shipping Reference Details.exe Booking and Shipping Reference Details.exe PID 1080 wrote to memory of 1676 1080 Booking and Shipping Reference Details.exe Booking and Shipping Reference Details.exe PID 1080 wrote to memory of 1676 1080 Booking and Shipping Reference Details.exe Booking and Shipping Reference Details.exe PID 1080 wrote to memory of 1676 1080 Booking and Shipping Reference Details.exe Booking and Shipping Reference Details.exe PID 1080 wrote to memory of 1676 1080 Booking and Shipping Reference Details.exe Booking and Shipping Reference Details.exe PID 1676 wrote to memory of 792 1676 Booking and Shipping Reference Details.exe cscript.exe PID 1676 wrote to memory of 792 1676 Booking and Shipping Reference Details.exe cscript.exe PID 1676 wrote to memory of 792 1676 Booking and Shipping Reference Details.exe cscript.exe PID 1676 wrote to memory of 792 1676 Booking and Shipping Reference Details.exe cscript.exe PID 792 wrote to memory of 1692 792 cscript.exe cmd.exe PID 792 wrote to memory of 1692 792 cscript.exe cmd.exe PID 792 wrote to memory of 1692 792 cscript.exe cmd.exe PID 792 wrote to memory of 1692 792 cscript.exe cmd.exe PID 792 wrote to memory of 1020 792 cscript.exe Firefox.exe PID 792 wrote to memory of 1020 792 cscript.exe Firefox.exe PID 792 wrote to memory of 1020 792 cscript.exe Firefox.exe PID 792 wrote to memory of 1020 792 cscript.exe Firefox.exe PID 792 wrote to memory of 1020 792 cscript.exe Firefox.exe PID 1228 wrote to memory of 1728 1228 Explorer.EXE windfj8f.exe PID 1228 wrote to memory of 1728 1228 Explorer.EXE windfj8f.exe PID 1228 wrote to memory of 1728 1228 Explorer.EXE windfj8f.exe PID 1228 wrote to memory of 1728 1228 Explorer.EXE windfj8f.exe PID 1728 wrote to memory of 1764 1728 windfj8f.exe windfj8f.exe PID 1728 wrote to memory of 1764 1728 windfj8f.exe windfj8f.exe PID 1728 wrote to memory of 1764 1728 windfj8f.exe windfj8f.exe PID 1728 wrote to memory of 1764 1728 windfj8f.exe windfj8f.exe PID 1728 wrote to memory of 1764 1728 windfj8f.exe windfj8f.exe PID 1728 wrote to memory of 1764 1728 windfj8f.exe windfj8f.exe PID 1728 wrote to memory of 1764 1728 windfj8f.exe windfj8f.exe PID 792 wrote to memory of 1880 792 cscript.exe Firefox.exe PID 792 wrote to memory of 1880 792 cscript.exe Firefox.exe PID 792 wrote to memory of 1880 792 cscript.exe Firefox.exe PID 792 wrote to memory of 1880 792 cscript.exe Firefox.exe PID 792 wrote to memory of 1880 792 cscript.exe Firefox.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
cscript.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cscript.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\Booking and Shipping Reference Details.exe"C:\Users\Admin\AppData\Local\Temp\Booking and Shipping Reference Details.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\Booking and Shipping Reference Details.exe"C:\Users\Admin\AppData\Local\Temp\Booking and Shipping Reference Details.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"4⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:792 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Booking and Shipping Reference Details.exe"5⤵
- Deletes itself
PID:1692 -
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵PID:1020
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"5⤵PID:1880
-
C:\Program Files (x86)\Dnlr0\windfj8f.exe"C:\Program Files (x86)\Dnlr0\windfj8f.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Dnlr0\windfj8f.exe"C:\Program Files (x86)\Dnlr0\windfj8f.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1764
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Dnlr0\windfj8f.exeMD5
261e1d3d96af2d57fabdf9295a6ad987
SHA14be2f141e6862bbf8a79bac4900a211008ac6e68
SHA256468169b4fe61a81e910c9b820d46694ad3e089e7d276831e690f86012db80195
SHA5120307ea1169f2193c513af63aadb10fa3a3f0c9bae5767997e940085572150e0db8480cbf4a72dc8795e78570250f0342eec768d8eb63c731519f3091ddec9a05
-
C:\Program Files (x86)\Dnlr0\windfj8f.exeMD5
261e1d3d96af2d57fabdf9295a6ad987
SHA14be2f141e6862bbf8a79bac4900a211008ac6e68
SHA256468169b4fe61a81e910c9b820d46694ad3e089e7d276831e690f86012db80195
SHA5120307ea1169f2193c513af63aadb10fa3a3f0c9bae5767997e940085572150e0db8480cbf4a72dc8795e78570250f0342eec768d8eb63c731519f3091ddec9a05
-
C:\Program Files (x86)\Dnlr0\windfj8f.exeMD5
261e1d3d96af2d57fabdf9295a6ad987
SHA14be2f141e6862bbf8a79bac4900a211008ac6e68
SHA256468169b4fe61a81e910c9b820d46694ad3e089e7d276831e690f86012db80195
SHA5120307ea1169f2193c513af63aadb10fa3a3f0c9bae5767997e940085572150e0db8480cbf4a72dc8795e78570250f0342eec768d8eb63c731519f3091ddec9a05
-
memory/792-79-0x00000000022B0000-0x000000000233F000-memory.dmpFilesize
572KB
-
memory/792-78-0x0000000001FA0000-0x00000000022A3000-memory.dmpFilesize
3.0MB
-
memory/792-76-0x0000000000070000-0x0000000000098000-memory.dmpFilesize
160KB
-
memory/792-75-0x0000000000710000-0x0000000000732000-memory.dmpFilesize
136KB
-
memory/792-74-0x0000000000000000-mapping.dmp
-
memory/1020-82-0x0000000000000000-mapping.dmp
-
memory/1020-90-0x000000013F780000-0x000000013F813000-memory.dmpFilesize
588KB
-
memory/1020-91-0x00000000023C0000-0x0000000002535000-memory.dmpFilesize
1.5MB
-
memory/1080-66-0x00000000007C0000-0x00000000007F3000-memory.dmpFilesize
204KB
-
memory/1080-65-0x0000000005380000-0x00000000053E9000-memory.dmpFilesize
420KB
-
memory/1080-64-0x00000000002E0000-0x00000000002F6000-memory.dmpFilesize
88KB
-
memory/1080-60-0x0000000001120000-0x0000000001121000-memory.dmpFilesize
4KB
-
memory/1080-63-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/1080-62-0x0000000075B31000-0x0000000075B33000-memory.dmpFilesize
8KB
-
memory/1228-73-0x00000000073C0000-0x0000000007537000-memory.dmpFilesize
1.5MB
-
memory/1228-71-0x0000000004220000-0x00000000042FF000-memory.dmpFilesize
892KB
-
memory/1228-80-0x0000000006470000-0x0000000006564000-memory.dmpFilesize
976KB
-
memory/1676-67-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1676-72-0x0000000000430000-0x0000000000440000-memory.dmpFilesize
64KB
-
memory/1676-70-0x0000000000160000-0x0000000000170000-memory.dmpFilesize
64KB
-
memory/1676-69-0x00000000008A0000-0x0000000000BA3000-memory.dmpFilesize
3.0MB
-
memory/1676-68-0x000000000041D020-mapping.dmp
-
memory/1692-77-0x0000000000000000-mapping.dmp
-
memory/1728-89-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/1728-86-0x0000000000A60000-0x0000000000A61000-memory.dmpFilesize
4KB
-
memory/1728-83-0x0000000000000000-mapping.dmp
-
memory/1764-95-0x000000000041D020-mapping.dmp
-
memory/1764-97-0x0000000000B30000-0x0000000000E33000-memory.dmpFilesize
3.0MB
-
memory/1880-98-0x0000000000000000-mapping.dmp
-
memory/1880-99-0x000000013F270000-0x000000013F303000-memory.dmpFilesize
588KB
-
memory/1880-100-0x0000000000060000-0x00000000001A7000-memory.dmpFilesize
1.3MB