Analysis
-
max time kernel
150s -
max time network
162s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22-10-2021 03:08
Static task
static1
Behavioral task
behavioral1
Sample
DHL_119040 receipt document,pdf.exe
Resource
win7-en-20211014
General
-
Target
DHL_119040 receipt document,pdf.exe
-
Size
376KB
-
MD5
a26c06af19d765ddcb32a48cd6acb1eb
-
SHA1
152dcab66baef093434bf69a0c3f9e78f7bbeb90
-
SHA256
35204f1850b1439ef9a8fd958d6c3045edae69378aa3593021795d0600fc5a01
-
SHA512
98945dbca44f5620c66efb7fc323e796e04040d0d19a1e5514843daa5c3ee6696739e9e19c6b38ff78ce3328db45d073cab471fabd591e4b962248b4d24422fb
Malware Config
Extracted
xloader
2.5
b65i
http://www.onewebuy.net/b65i/
leofighters.com
smartat2.xyz
encontrevariedades.com
jimwilliamstutoring.com
kanpaiecuador.com
accura-inv.com
xtzgjxzz.com
scentstrategies.com
high-clicks2.com
hadishgebray.com
woodlawnbailbonds.com
dmsolutionsco.com
rdvulm21.com
beachyweens.com
ishirmansingh.com
rimmasbracelets.com
kellibrat.com
roselmasm.com
datkamoney.info
fermers.club
veytrex.com
bigfussblog.com
seehow3.com
howtosellhighticket.com
gv-china.com
midatlanticbaths.com
peoplexplants.com
xinhe138.com
peoplefirstflorida.com
lk-safe-keepingtoyof4.xyz
lavish-hika.com
thefooddrone.com
lowkeymastery.com
ferratahvar.com
ntgc.glass
ctfeldsine.com
131inwood.com
austinfishandchicken.com
adambridewell.com
starzara.com
pillfinancialliteracy.com
urlos.store
coralhide.com
y6pw.xyz
palazzoloan.com
peoplesadvantage.net
konzertmanagement.com
alphapat-sa.com
moresatisfy.club
sexynailcompany.com
janlgesnetwork.net
manifestingiam.com
vehicaldashino.com
jazminsalym.com
strtplay2day.info
insureagainstearthquake.com
sddn57.xyz
staygood.gmbh
paymentssecureweb.com
gee-law.com
tenloe098.xyz
mikevideodirection.online
povital.com
ktrtaiwan.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/420-116-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/420-117-0x000000000041D3B0-mapping.dmp xloader behavioral2/memory/1288-125-0x0000000000600000-0x0000000000629000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
DHL_119040 receipt document,pdf.exepid process 2244 DHL_119040 receipt document,pdf.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
DHL_119040 receipt document,pdf.exeDHL_119040 receipt document,pdf.execolorcpl.exedescription pid process target process PID 2244 set thread context of 420 2244 DHL_119040 receipt document,pdf.exe DHL_119040 receipt document,pdf.exe PID 420 set thread context of 3028 420 DHL_119040 receipt document,pdf.exe Explorer.EXE PID 1288 set thread context of 3028 1288 colorcpl.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
Processes:
DHL_119040 receipt document,pdf.execolorcpl.exepid process 420 DHL_119040 receipt document,pdf.exe 420 DHL_119040 receipt document,pdf.exe 420 DHL_119040 receipt document,pdf.exe 420 DHL_119040 receipt document,pdf.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe 1288 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3028 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DHL_119040 receipt document,pdf.execolorcpl.exepid process 420 DHL_119040 receipt document,pdf.exe 420 DHL_119040 receipt document,pdf.exe 420 DHL_119040 receipt document,pdf.exe 1288 colorcpl.exe 1288 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DHL_119040 receipt document,pdf.execolorcpl.exedescription pid process Token: SeDebugPrivilege 420 DHL_119040 receipt document,pdf.exe Token: SeDebugPrivilege 1288 colorcpl.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
DHL_119040 receipt document,pdf.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 2244 wrote to memory of 420 2244 DHL_119040 receipt document,pdf.exe DHL_119040 receipt document,pdf.exe PID 2244 wrote to memory of 420 2244 DHL_119040 receipt document,pdf.exe DHL_119040 receipt document,pdf.exe PID 2244 wrote to memory of 420 2244 DHL_119040 receipt document,pdf.exe DHL_119040 receipt document,pdf.exe PID 2244 wrote to memory of 420 2244 DHL_119040 receipt document,pdf.exe DHL_119040 receipt document,pdf.exe PID 2244 wrote to memory of 420 2244 DHL_119040 receipt document,pdf.exe DHL_119040 receipt document,pdf.exe PID 2244 wrote to memory of 420 2244 DHL_119040 receipt document,pdf.exe DHL_119040 receipt document,pdf.exe PID 3028 wrote to memory of 1288 3028 Explorer.EXE colorcpl.exe PID 3028 wrote to memory of 1288 3028 Explorer.EXE colorcpl.exe PID 3028 wrote to memory of 1288 3028 Explorer.EXE colorcpl.exe PID 1288 wrote to memory of 1312 1288 colorcpl.exe cmd.exe PID 1288 wrote to memory of 1312 1288 colorcpl.exe cmd.exe PID 1288 wrote to memory of 1312 1288 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL_119040 receipt document,pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL_119040 receipt document,pdf.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL_119040 receipt document,pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL_119040 receipt document,pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL_119040 receipt document,pdf.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nseDB7D.tmp\gjspvjmvb.dllMD5
cb5ae97fd494cd241495179668d3a3d2
SHA133e6282a11c9140860710cd4a251e428e5cb75b8
SHA2562e31c7a695a70e216180fefa04ff81c8ad783b72b8d5fe40f506e00ada784f6f
SHA51283d265679fcb712cb8810d9b24a68c2d952cdb00656464b3c52a34a9bac48a62d2ed26d82ff0837946876bc1d992796376703a394da4c451cae671a043f32f44
-
memory/420-116-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/420-117-0x000000000041D3B0-mapping.dmp
-
memory/420-118-0x0000000000AC0000-0x0000000000DE0000-memory.dmpFilesize
3.1MB
-
memory/420-120-0x0000000000AA0000-0x0000000000AB1000-memory.dmpFilesize
68KB
-
memory/1288-122-0x0000000000000000-mapping.dmp
-
memory/1288-124-0x0000000000CB0000-0x0000000000CC9000-memory.dmpFilesize
100KB
-
memory/1288-126-0x0000000004470000-0x0000000004790000-memory.dmpFilesize
3.1MB
-
memory/1288-125-0x0000000000600000-0x0000000000629000-memory.dmpFilesize
164KB
-
memory/1288-127-0x0000000004370000-0x0000000004400000-memory.dmpFilesize
576KB
-
memory/1312-123-0x0000000000000000-mapping.dmp
-
memory/3028-121-0x0000000002A80000-0x0000000002B44000-memory.dmpFilesize
784KB
-
memory/3028-128-0x00000000065B0000-0x0000000006701000-memory.dmpFilesize
1.3MB