Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
18-11-2021 08:23
Static task
static1
Behavioral task
behavioral1
Sample
Order Inquiry_List0811221Group_Pte Ltd.exe
Resource
win7-en-20211104
General
-
Target
Order Inquiry_List0811221Group_Pte Ltd.exe
-
Size
753KB
-
MD5
7a472b26cb03fb90b7f7a98f0e3aaaac
-
SHA1
0dfd979849653398c60d791ee385f80a3648dc0b
-
SHA256
9bd94109c257b316e248e2486f3b84bf358cc5b9b259154e6b0544bcb04269d6
-
SHA512
84c1f8ed44c4bb3dd15d11a8ba1f3127e59e69d0f3edf5c36a711d252f6022079e5424dddb42e32cde19f7bb665ce853d19fd07e6029470857014aefd2e1444e
Malware Config
Extracted
xloader
2.5
46uq
http://www.jixelbbk.com/46uq/
spiritueleonlinetraining.online
jrpz86.com
dataxmart.com
zeogg.club
killiandooley.com
159studios.com
clginter.com
greenwirechicago.com
kennycheng.tech
carolyngracecoaching.com
cp-altodelamuela.com
amazonflowerjewelry.com
anseron.net
surplusqlxbjy.online
asasal.com
online-buy-now.com
kolab.today
statisticsacademy.com
dcupqiu.club
braxtynmi.xyz
bcw.today
stilteruimtes.online
etihadit.com
xihoatuoi.com
fetch-an-us-borrow-money.zone
yooliaphotography.com
ooaz2.xyz
ssss.host
impossiblegrow.com
neilserver.website
renewable-energy-products.com
daywestskincare.com
esmexport.com
carrofrance.com
xiaoxiaodao.club
sterlingmktg.com
txcyclerepair.com
embas.online
interpol-inter.com
piaohua66.com
jollyprime.com
urbanphonecase.com
parareda.net
bursadavarbursadanal.com
emresonfry.com
sharkfangs.com
beepboople.com
ordenmorgi.quest
bdqimeng666.top
workforma.com
vintageknollsapartments.com
alienguise.com
id-923783.space
scj-bos.com
polebear.website
pharmacyle.com
viridishelf.com
abros88.com
ocdpsych.com
gulfandinlandlimited.com
turkishqlxmpw.online
suddennnnnnnnnnnn14.xyz
copyshopetc.net
cursos24-7.online
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1852-63-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1852-64-0x000000000041D420-mapping.dmp xloader behavioral1/memory/1396-72-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 484 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
Order Inquiry_List0811221Group_Pte Ltd.exeOrder Inquiry_List0811221Group_Pte Ltd.exeipconfig.exedescription pid process target process PID 1456 set thread context of 1852 1456 Order Inquiry_List0811221Group_Pte Ltd.exe Order Inquiry_List0811221Group_Pte Ltd.exe PID 1852 set thread context of 1208 1852 Order Inquiry_List0811221Group_Pte Ltd.exe Explorer.EXE PID 1396 set thread context of 1208 1396 ipconfig.exe Explorer.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 1396 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
Order Inquiry_List0811221Group_Pte Ltd.exeipconfig.exepid process 1852 Order Inquiry_List0811221Group_Pte Ltd.exe 1852 Order Inquiry_List0811221Group_Pte Ltd.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe 1396 ipconfig.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
Order Inquiry_List0811221Group_Pte Ltd.exeipconfig.exepid process 1852 Order Inquiry_List0811221Group_Pte Ltd.exe 1852 Order Inquiry_List0811221Group_Pte Ltd.exe 1852 Order Inquiry_List0811221Group_Pte Ltd.exe 1396 ipconfig.exe 1396 ipconfig.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Order Inquiry_List0811221Group_Pte Ltd.exeipconfig.exedescription pid process Token: SeDebugPrivilege 1852 Order Inquiry_List0811221Group_Pte Ltd.exe Token: SeDebugPrivilege 1396 ipconfig.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1208 Explorer.EXE 1208 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Order Inquiry_List0811221Group_Pte Ltd.exeExplorer.EXEipconfig.exedescription pid process target process PID 1456 wrote to memory of 1852 1456 Order Inquiry_List0811221Group_Pte Ltd.exe Order Inquiry_List0811221Group_Pte Ltd.exe PID 1456 wrote to memory of 1852 1456 Order Inquiry_List0811221Group_Pte Ltd.exe Order Inquiry_List0811221Group_Pte Ltd.exe PID 1456 wrote to memory of 1852 1456 Order Inquiry_List0811221Group_Pte Ltd.exe Order Inquiry_List0811221Group_Pte Ltd.exe PID 1456 wrote to memory of 1852 1456 Order Inquiry_List0811221Group_Pte Ltd.exe Order Inquiry_List0811221Group_Pte Ltd.exe PID 1456 wrote to memory of 1852 1456 Order Inquiry_List0811221Group_Pte Ltd.exe Order Inquiry_List0811221Group_Pte Ltd.exe PID 1456 wrote to memory of 1852 1456 Order Inquiry_List0811221Group_Pte Ltd.exe Order Inquiry_List0811221Group_Pte Ltd.exe PID 1456 wrote to memory of 1852 1456 Order Inquiry_List0811221Group_Pte Ltd.exe Order Inquiry_List0811221Group_Pte Ltd.exe PID 1208 wrote to memory of 1396 1208 Explorer.EXE ipconfig.exe PID 1208 wrote to memory of 1396 1208 Explorer.EXE ipconfig.exe PID 1208 wrote to memory of 1396 1208 Explorer.EXE ipconfig.exe PID 1208 wrote to memory of 1396 1208 Explorer.EXE ipconfig.exe PID 1396 wrote to memory of 484 1396 ipconfig.exe cmd.exe PID 1396 wrote to memory of 484 1396 ipconfig.exe cmd.exe PID 1396 wrote to memory of 484 1396 ipconfig.exe cmd.exe PID 1396 wrote to memory of 484 1396 ipconfig.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order Inquiry_List0811221Group_Pte Ltd.exe"C:\Users\Admin\AppData\Local\Temp\Order Inquiry_List0811221Group_Pte Ltd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order Inquiry_List0811221Group_Pte Ltd.exe"C:\Users\Admin\AppData\Local\Temp\Order Inquiry_List0811221Group_Pte Ltd.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order Inquiry_List0811221Group_Pte Ltd.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/484-73-0x0000000000000000-mapping.dmp
-
memory/1208-68-0x0000000006110000-0x000000000622C000-memory.dmpFilesize
1.1MB
-
memory/1208-76-0x0000000006230000-0x00000000063A0000-memory.dmpFilesize
1.4MB
-
memory/1396-75-0x0000000000710000-0x00000000007A0000-memory.dmpFilesize
576KB
-
memory/1396-74-0x0000000002270000-0x0000000002573000-memory.dmpFilesize
3.0MB
-
memory/1396-72-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1396-71-0x00000000003B0000-0x00000000003BA000-memory.dmpFilesize
40KB
-
memory/1396-69-0x0000000000000000-mapping.dmp
-
memory/1456-60-0x0000000004EA0000-0x0000000004EF9000-memory.dmpFilesize
356KB
-
memory/1456-55-0x0000000001390000-0x0000000001391000-memory.dmpFilesize
4KB
-
memory/1456-59-0x00000000005F0000-0x00000000005F6000-memory.dmpFilesize
24KB
-
memory/1456-58-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/1456-57-0x0000000075C51000-0x0000000075C53000-memory.dmpFilesize
8KB
-
memory/1852-66-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1852-67-0x00000000002B0000-0x00000000002C1000-memory.dmpFilesize
68KB
-
memory/1852-64-0x000000000041D420-mapping.dmp
-
memory/1852-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1852-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1852-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB