Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
09-12-2021 04:21
Static task
static1
Behavioral task
behavioral1
Sample
Bill of Lading & Shipping Advice.exe
Resource
win7-en-20211208
General
-
Target
Bill of Lading & Shipping Advice.exe
-
Size
508KB
-
MD5
ca0d7b52d537773db4598a25fdf5cf22
-
SHA1
f971b4ac64190312edfd3830dd40a257316c7e8f
-
SHA256
b9829a5660b2dcf188de5595741b42380f091c30bb3be299e131b61171d7b513
-
SHA512
58b69ca75d881acf8d90e3c22859dff514f796872460e619bd4699f71abbeb02ccc6832b583d29e916b6f993d508018b50d59cd8d46859251cb12e9e14d91195
Malware Config
Extracted
xloader
2.5
ea0r
http://www.asiapubz-hk.com/ea0r/
lionheartcreativestudios.com
konzertmanagement.com
blackpanther.online
broychim-int.com
takut18.com
txstarsolar.com
herdsherpa.com
igorshestakov.com
shinesbox.com
reflectpkljlt.xyz
oiltoolshub.com
viralmoneychallenge.com
changingalphastrategies.com
mecitiris.com
rdadmin.online
miniambiente.com
kominarcine.com
pino-almond.com
heihit.xyz
junqi888.com
metalumber.com
sclvfu.com
macanostore.online
projecturs.com
ahcprp.com
gztyfnrj.com
lospacenos.com
tak-etranger.com
dingermail.com
skiin.club
ystops.com
tnboxes.com
ccafgz.com
info1337.xyz
platinum24.top
hothess.com
novelfinancewhite.xyz
theselectdifference.com
flufca.com
giftcodefreefirevns.com
kgv-lachswehr.com
report-alfarabilabs.com
skeetones.com
4bcinc.com
americamr.com
wewonacademy.com
evrazavto.store
true-fanbox.com
greencofiji.com
threecommaspartners.com
hgtradingcoltd.com
xihe1919.com
241mk.com
helplockedout.com
wefundprojects.com
neosecure.store
purenewsworldwide.com
luckylottovip999.com
lottidobler.com
proyectohaciendohistoria.com
raintm.com
theproducerformula.com
trademarkitforyourself.com
ottaweed.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1156-56-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1156-57-0x000000000041D410-mapping.dmp xloader behavioral1/memory/1156-62-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1336-67-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 560 cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
Bill of Lading & Shipping Advice.exepid process 1516 Bill of Lading & Shipping Advice.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Bill of Lading & Shipping Advice.exeBill of Lading & Shipping Advice.exehelp.exedescription pid process target process PID 1516 set thread context of 1156 1516 Bill of Lading & Shipping Advice.exe Bill of Lading & Shipping Advice.exe PID 1156 set thread context of 1412 1156 Bill of Lading & Shipping Advice.exe Explorer.EXE PID 1156 set thread context of 1412 1156 Bill of Lading & Shipping Advice.exe Explorer.EXE PID 1336 set thread context of 1412 1336 help.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Bill of Lading & Shipping Advice.exehelp.exepid process 1156 Bill of Lading & Shipping Advice.exe 1156 Bill of Lading & Shipping Advice.exe 1156 Bill of Lading & Shipping Advice.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe 1336 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
Bill of Lading & Shipping Advice.exehelp.exepid process 1156 Bill of Lading & Shipping Advice.exe 1156 Bill of Lading & Shipping Advice.exe 1156 Bill of Lading & Shipping Advice.exe 1156 Bill of Lading & Shipping Advice.exe 1336 help.exe 1336 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Bill of Lading & Shipping Advice.exehelp.exedescription pid process Token: SeDebugPrivilege 1156 Bill of Lading & Shipping Advice.exe Token: SeDebugPrivilege 1336 help.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1412 Explorer.EXE 1412 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
Bill of Lading & Shipping Advice.exeBill of Lading & Shipping Advice.exehelp.exedescription pid process target process PID 1516 wrote to memory of 1156 1516 Bill of Lading & Shipping Advice.exe Bill of Lading & Shipping Advice.exe PID 1516 wrote to memory of 1156 1516 Bill of Lading & Shipping Advice.exe Bill of Lading & Shipping Advice.exe PID 1516 wrote to memory of 1156 1516 Bill of Lading & Shipping Advice.exe Bill of Lading & Shipping Advice.exe PID 1516 wrote to memory of 1156 1516 Bill of Lading & Shipping Advice.exe Bill of Lading & Shipping Advice.exe PID 1516 wrote to memory of 1156 1516 Bill of Lading & Shipping Advice.exe Bill of Lading & Shipping Advice.exe PID 1516 wrote to memory of 1156 1516 Bill of Lading & Shipping Advice.exe Bill of Lading & Shipping Advice.exe PID 1516 wrote to memory of 1156 1516 Bill of Lading & Shipping Advice.exe Bill of Lading & Shipping Advice.exe PID 1156 wrote to memory of 1336 1156 Bill of Lading & Shipping Advice.exe help.exe PID 1156 wrote to memory of 1336 1156 Bill of Lading & Shipping Advice.exe help.exe PID 1156 wrote to memory of 1336 1156 Bill of Lading & Shipping Advice.exe help.exe PID 1156 wrote to memory of 1336 1156 Bill of Lading & Shipping Advice.exe help.exe PID 1336 wrote to memory of 560 1336 help.exe cmd.exe PID 1336 wrote to memory of 560 1336 help.exe cmd.exe PID 1336 wrote to memory of 560 1336 help.exe cmd.exe PID 1336 wrote to memory of 560 1336 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Bill of Lading & Shipping Advice.exe"C:\Users\Admin\AppData\Local\Temp\Bill of Lading & Shipping Advice.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Bill of Lading & Shipping Advice.exe"C:\Users\Admin\AppData\Local\Temp\Bill of Lading & Shipping Advice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Bill of Lading & Shipping Advice.exe"5⤵
- Deletes itself
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsnC3DC.tmp\ynieoukx.dllMD5
7c9a18a000849851c8e34fe6e1e88b21
SHA1ffd0b9cd7b469be2f15ce836076ff21c88ee3a2d
SHA25680f12b6475767dd4cd6271fd6e213317230ce5814909c9b21e132cacae3952c6
SHA5125e62ee3116a13fe3fcaf137329f02825be17ed2385c43a227b9b5f7f59b09636de0f85ee778b31f1c87b67afd786a6f62d5c79acc85caad32ebde0ce24cd9c9a
-
memory/560-68-0x0000000000000000-mapping.dmp
-
memory/1156-63-0x0000000002240000-0x0000000002251000-memory.dmpFilesize
68KB
-
memory/1156-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1156-60-0x0000000000A10000-0x0000000000A21000-memory.dmpFilesize
68KB
-
memory/1156-59-0x0000000000700000-0x0000000000A03000-memory.dmpFilesize
3.0MB
-
memory/1156-57-0x000000000041D410-mapping.dmp
-
memory/1156-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1336-70-0x00000000005A0000-0x0000000000630000-memory.dmpFilesize
576KB
-
memory/1336-69-0x0000000000910000-0x0000000000C13000-memory.dmpFilesize
3.0MB
-
memory/1336-65-0x0000000000000000-mapping.dmp
-
memory/1336-67-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1336-66-0x0000000000500000-0x0000000000506000-memory.dmpFilesize
24KB
-
memory/1412-61-0x0000000006B00000-0x0000000006C61000-memory.dmpFilesize
1.4MB
-
memory/1412-64-0x0000000004990000-0x0000000004A55000-memory.dmpFilesize
788KB
-
memory/1412-71-0x0000000006D60000-0x0000000006EA4000-memory.dmpFilesize
1.3MB
-
memory/1516-54-0x0000000075AB1000-0x0000000075AB3000-memory.dmpFilesize
8KB