Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
22-10-2021 05:11
Static task
static1
Behavioral task
behavioral1
Sample
Shipping_Doc190dk0lwt837.exe
Resource
win7-en-20211014
General
-
Target
Shipping_Doc190dk0lwt837.exe
-
Size
249KB
-
MD5
2d0ac0a8f2d2aea1f05429585c1bdc4c
-
SHA1
3657594459b01c0c918e0deeaf3ad7f05a4efd90
-
SHA256
f1d7ead1ca0f3e39c12bf5b67bb35cfc745acf0f587c2d6ce45eb2904f44aaa7
-
SHA512
863b35e33b0b09aece9268c83ca3411180c23463a01e6b93744b978199c7fc386ecaddf0776588be59bcf41b46f4584e7405a17f1ee3cc64df602655036f92e7
Malware Config
Extracted
xloader
2.5
u5eh
http://www.retonamoss.com/u5eh/
tryafaq.com
bobcathntshop.com
oglead.com
026skz.xyz
brasbux.com
adna17.com
noveltyrofjiy.xyz
realestatecompanys.com
leman-web.com
df5686.com
jonathonhawkins.com
juliedominyfloralartistry.com
classyeventsco.com
aquaticatt.com
iotworld.xyz
hoc8.com
disposablediapers.store
peregovorim.online
advancebits.club
getaburialplan.com
tiger-trails.com
dnbaba.com
492981.com
eclipse-electrical-euless.com
cassandracchase.com
healthrightmeds.club
permkray.club
tawazoun-dz.com
extrabladet.com
offmanage.com
peoplexplants.com
mumkungiyim.com
personal-email-office-mgt.com
bjmysa.com
hopshomes.com
cnj-power.com
trendproduct.tech
chauffeuredaustralia.online
176ssjp0033.xyz
52juns.com
rewriringcanada.com
seabourneboats.com
sevensummittrek.com
retalent.agency
lz4ios.cloud
mindandbodyalignment.com
bedrijfmail-trk.com
bashmoney.net
xc3654.com
infiteltech.com
sh-hywz.com
huataiqche.com
grannyh.com
devinwithani.com
kingstons.info
fakedocshyundaigiveaway.com
bigsyncmusic.info
predstavnuk.com
frontiervalley8.com
timdpr.com
smartgymadmin.com
brsgeniusschool.com
tuckertractorworks.com
espchange.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/556-57-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/556-58-0x000000000041D3E0-mapping.dmp xloader behavioral1/memory/568-66-0x00000000000C0000-0x00000000000E9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1620 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
Shipping_Doc190dk0lwt837.exepid process 1728 Shipping_Doc190dk0lwt837.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Shipping_Doc190dk0lwt837.exeShipping_Doc190dk0lwt837.exechkdsk.exedescription pid process target process PID 1728 set thread context of 556 1728 Shipping_Doc190dk0lwt837.exe Shipping_Doc190dk0lwt837.exe PID 556 set thread context of 1268 556 Shipping_Doc190dk0lwt837.exe Explorer.EXE PID 568 set thread context of 1268 568 chkdsk.exe Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
chkdsk.exedescription ioc process File opened for modification C:\Program Files (x86)\Ufrdh6t8\regsvc1b6hzl5.exe chkdsk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Shipping_Doc190dk0lwt837.exechkdsk.exepid process 556 Shipping_Doc190dk0lwt837.exe 556 Shipping_Doc190dk0lwt837.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe 568 chkdsk.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Shipping_Doc190dk0lwt837.exechkdsk.exepid process 556 Shipping_Doc190dk0lwt837.exe 556 Shipping_Doc190dk0lwt837.exe 556 Shipping_Doc190dk0lwt837.exe 568 chkdsk.exe 568 chkdsk.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Shipping_Doc190dk0lwt837.exechkdsk.exedescription pid process Token: SeDebugPrivilege 556 Shipping_Doc190dk0lwt837.exe Token: SeDebugPrivilege 568 chkdsk.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Shipping_Doc190dk0lwt837.exeExplorer.EXEchkdsk.exedescription pid process target process PID 1728 wrote to memory of 556 1728 Shipping_Doc190dk0lwt837.exe Shipping_Doc190dk0lwt837.exe PID 1728 wrote to memory of 556 1728 Shipping_Doc190dk0lwt837.exe Shipping_Doc190dk0lwt837.exe PID 1728 wrote to memory of 556 1728 Shipping_Doc190dk0lwt837.exe Shipping_Doc190dk0lwt837.exe PID 1728 wrote to memory of 556 1728 Shipping_Doc190dk0lwt837.exe Shipping_Doc190dk0lwt837.exe PID 1728 wrote to memory of 556 1728 Shipping_Doc190dk0lwt837.exe Shipping_Doc190dk0lwt837.exe PID 1728 wrote to memory of 556 1728 Shipping_Doc190dk0lwt837.exe Shipping_Doc190dk0lwt837.exe PID 1728 wrote to memory of 556 1728 Shipping_Doc190dk0lwt837.exe Shipping_Doc190dk0lwt837.exe PID 1268 wrote to memory of 568 1268 Explorer.EXE chkdsk.exe PID 1268 wrote to memory of 568 1268 Explorer.EXE chkdsk.exe PID 1268 wrote to memory of 568 1268 Explorer.EXE chkdsk.exe PID 1268 wrote to memory of 568 1268 Explorer.EXE chkdsk.exe PID 568 wrote to memory of 1620 568 chkdsk.exe cmd.exe PID 568 wrote to memory of 1620 568 chkdsk.exe cmd.exe PID 568 wrote to memory of 1620 568 chkdsk.exe cmd.exe PID 568 wrote to memory of 1620 568 chkdsk.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping_Doc190dk0lwt837.exe"C:\Users\Admin\AppData\Local\Temp\Shipping_Doc190dk0lwt837.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping_Doc190dk0lwt837.exe"C:\Users\Admin\AppData\Local\Temp\Shipping_Doc190dk0lwt837.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping_Doc190dk0lwt837.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nstA5E.tmp\hkdklixzga.dllMD5
fe53df25d11886ebd5c24164328ca8bf
SHA13d051e82d0bd8bbd4c5647ab11a36e8fe0407631
SHA256d3827d83d541e98cff0bb89a27c2db75e59b62ed57a934cc8c9e6a9623864716
SHA512578a786ea59572ae33b245314493bfda501eadde6bfcad2e20fd45e39e7d2e6e237403ed912f38aebd3fa79c582f27e7846f0896e22e01d1e276abcb8b32eecc
-
memory/556-61-0x0000000000480000-0x0000000000491000-memory.dmpFilesize
68KB
-
memory/556-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/556-58-0x000000000041D3E0-mapping.dmp
-
memory/556-60-0x00000000008B0000-0x0000000000BB3000-memory.dmpFilesize
3.0MB
-
memory/568-65-0x0000000000FD0000-0x0000000000FD7000-memory.dmpFilesize
28KB
-
memory/568-63-0x0000000000000000-mapping.dmp
-
memory/568-66-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/568-67-0x0000000000C20000-0x0000000000F23000-memory.dmpFilesize
3.0MB
-
memory/568-68-0x00000000009E0000-0x0000000000A70000-memory.dmpFilesize
576KB
-
memory/1268-62-0x0000000006A60000-0x0000000006B57000-memory.dmpFilesize
988KB
-
memory/1268-69-0x0000000008D40000-0x0000000008E37000-memory.dmpFilesize
988KB
-
memory/1620-64-0x0000000000000000-mapping.dmp
-
memory/1728-55-0x00000000764D1000-0x00000000764D3000-memory.dmpFilesize
8KB