Analysis
- max time kernel
158s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
20/01/2022, 08:13
Static task
static1
Behavioral task
behavioral1
Sample
DHL AWB AND INV.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target DHL AWB AND INV.exe
- Size 374KB
- Sample220120-j4e73agheq
- SHA256 0450f9017a4e7556c6bbfa5e69363ed935e11fa47efff5755b172103b3b59892
- MD5 126ae728ada77b821a6c92c47fbfdb5a
- SHA1 ab6c53b97d055e52bfbbd99e80947adc1ef00853
- SHA512 411a1a314b1bf8429a9e4f995f36fa0542ae11594937d93a7e6d12a4df4567c2ba907da059541e8588e00e35848296760f8891f372b92ece01e8bc11d8fc4e82
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
uite
Decoy
-
cdbydx.xyz
-
tomreagan.com
-
brandonhopital.com
-
185891.com
-
huoalen920thuqn.com
-
chaudharyhamza.com
-
bhbju.com
-
localagencytools.com
-
weswicke.com
-
validationlinkedterms.digital
-
kpenotaryservices.online
-
bestmodsforminecraft.com
-
sunflowerproducts.net
-
bottlekill.com
-
matchercc.info
-
econuera.com
-
new-passion.com
-
candy-crocs.com
-
lmgenapparel.com
-
flex-a-porte.com
-
dna-7.com
-
cedarparkkim.com
-
alonzo-fork.com
-
smartlabs.pro
-
kidsbestchance.net
-
angelecolab.com
-
confidentfoster.com
-
toriontour.com
-
retreatcc.com
-
healizy.com
-
mobilesolutions.store
-
aspenyoungbook.com
-
robotinsects.xyz
-
bestoflakegeorge.info
-
apporro.com
-
frenziedflora.com
-
jack-barbara-memorial.com
-
atulkkale.com
-
hype-clicks.com
-
brokers-actress.com
-
870haverford302.com
-
yourmemehere.com
-
recessionless.com
-
matrutibutik.com
-
sa-chan401.com
-
kodikannath.com
-
desartas.com
-
airtalk.top
-
pama-pic.xyz
-
agrocorp-elevage.com
-
arko-brno.com
-
needwar.com
-
sbw06.com
-
konzaware.com
-
sabrinaxmendes.com
-
mymonstermakeover.com
-
sanchezanthony.com
-
shamixoanni.website
-
empresasuporte.online
-
seastpete.com
-
intellibunk.com
-
afongate.com
-
themakeupline.com
-
sprecher.group
-
afterthoughtfarm.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/3488-306-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1540-312-0x0000000000160000-0x0000000000189000-memory.dmp xloader - Sets service image path in registry 2 TTPs
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3564 set thread context of 3488 3564 DHL AWB AND INV.exe 72 PID 3488 set thread context of 2564 3488 DHL AWB AND INV.exe 24 PID 1540 set thread context of 2564 1540 cmstp.exe 24 - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3488 DHL AWB AND INV.exe 3488 DHL AWB AND INV.exe 3488 DHL AWB AND INV.exe 3488 DHL AWB AND INV.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe 1540 cmstp.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2564 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3488 DHL AWB AND INV.exe 3488 DHL AWB AND INV.exe 3488 DHL AWB AND INV.exe 1540 cmstp.exe 1540 cmstp.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 3488 DHL AWB AND INV.exe Token: SeShutdownPrivilege 2564 Explorer.EXE Token: SeCreatePagefilePrivilege 2564 Explorer.EXE Token: SeDebugPrivilege 1540 cmstp.exe Token: SeShutdownPrivilege 2564 Explorer.EXE Token: SeCreatePagefilePrivilege 2564 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3564 wrote to memory of 3488 3564 DHL AWB AND INV.exe 72 PID 3564 wrote to memory of 3488 3564 DHL AWB AND INV.exe 72 PID 3564 wrote to memory of 3488 3564 DHL AWB AND INV.exe 72 PID 3564 wrote to memory of 3488 3564 DHL AWB AND INV.exe 72 PID 3564 wrote to memory of 3488 3564 DHL AWB AND INV.exe 72 PID 3564 wrote to memory of 3488 3564 DHL AWB AND INV.exe 72 PID 2564 wrote to memory of 1540 2564 Explorer.EXE 73 PID 2564 wrote to memory of 1540 2564 Explorer.EXE 73 PID 2564 wrote to memory of 1540 2564 Explorer.EXE 73 PID 1540 wrote to memory of 1932 1540 cmstp.exe 74 PID 1540 wrote to memory of 1932 1540 cmstp.exe 74 PID 1540 wrote to memory of 1932 1540 cmstp.exe 74
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\AppData\Local\Temp\DHL AWB AND INV.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB AND INV.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\DHL AWB AND INV.exe"C:\Users\Admin\AppData\Local\Temp\DHL AWB AND INV.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3488
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL AWB AND INV.exe"3⤵PID:1932
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p1⤵PID:1544
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe dc33930d99531a397ab1f040f7137cc9 ELWvJHCk2UK0O2Nsdu0TYw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:1388