Analysis
- max time kernel
153s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
31/01/2022, 15:24
Static task
static1
Behavioral task
behavioral1
Sample
DHL Delivery Documents.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL Delivery Documents.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target DHL Delivery Documents.exe
- Size 78KB
- Sample220131-ss4wqaabc3
- SHA256 b34bc888551b9a603edf76a356a4c0fc290fac420d3c6df0decd0916970bfb9b
- MD5 94743aae8b0eb58bf9849035dc640b3c
- SHA1 089f398df4eb9cf0511038cff177ecd3fbc9715c
- SHA512 23b72e99ec9ad81a97d3b4902c020c7f27b3b156ca81bc5c818f9ecd88b40f6cfb3b9b436511e952de31a9c7841cf80e9019c0ad2a54d075ba5f1bf7e9e562b0
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
zqzw
Decoy
-
laurentmathieu.com
-
nohohonndana.com
-
hhmc.info
-
shophallows.com
-
blazebunk.com
-
goodbridge.xyz
-
flakycloud.com
-
bakermckenziegroups.com
-
formation-adistance.com
-
lovingearthbotanicals.com
-
tbrservice.plus
-
heritagehousehotels.com
-
drwbuildersco.com
-
lacsghb.com
-
wain3x.com
-
dadreview.club
-
continiutycp.com
-
cockgirls.com
-
48mpt.xyz
-
033skz.xyz
-
gmconstructionlnc.com
-
ms-mint.com
-
aenrione.xyz
-
honxuan.com
-
snowmanvila.com
-
cig-online.com
-
valetvolley.com
-
bjsnft.com
-
bennystrom.com
-
flw.ink
-
clarissagrandiart.com
-
samfamstudio.com
-
pamschams.com
-
edgar-regale.com
-
combi-tech.tech
-
00xwq.online
-
eclipseconstrucciones.com
-
plick-click.com
-
dive.education
-
regenelis.com
-
blue-chipwordtoscan-today.info
-
xn--rsso51aevf65u.com
-
maonagrana.com
-
lucasdebatintrader.com
-
cassijohnson.com
-
roeten.online
-
into-concrete.xyz
-
motovip.store
-
floryfab.com
-
slkykq.com
-
vidyakala.com
-
stairwaystowealth.com
-
meganandbobbyprine.com
-
arestradings.com
-
emilyschlueter.com
-
platanin.com
-
hnhstudios.com
-
dmembutidos.com
-
dcassorealtor.com
-
megamobil.wien
-
001skz.xyz
-
5t45urfgurkhgbvkhbuh.com
-
a3hd.com
-
newmexicotruckwrecklawyers.com
-
trabaho-academy.net
Signatures
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/320-132-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2596-155-0x0000000002B60000-0x0000000002B89000-memory.dmp xloader - Sets service image path in registry 2 TTPs
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3504 set thread context of 320 3504 DHL Delivery Documents.exe 54 PID 320 set thread context of 2440 320 aspnet_compiler.exe 14 PID 2596 set thread context of 2440 2596 WWAHost.exe 14 - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe - Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 320 aspnet_compiler.exe 320 aspnet_compiler.exe 320 aspnet_compiler.exe 320 aspnet_compiler.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe 2596 WWAHost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2440 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 320 aspnet_compiler.exe 320 aspnet_compiler.exe 320 aspnet_compiler.exe 2596 WWAHost.exe 2596 WWAHost.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 3504 DHL Delivery Documents.exe Token: SeDebugPrivilege 320 aspnet_compiler.exe Token: SeDebugPrivilege 2596 WWAHost.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3504 wrote to memory of 320 3504 DHL Delivery Documents.exe 54 PID 3504 wrote to memory of 320 3504 DHL Delivery Documents.exe 54 PID 3504 wrote to memory of 320 3504 DHL Delivery Documents.exe 54 PID 3504 wrote to memory of 320 3504 DHL Delivery Documents.exe 54 PID 3504 wrote to memory of 320 3504 DHL Delivery Documents.exe 54 PID 3504 wrote to memory of 320 3504 DHL Delivery Documents.exe 54 PID 2440 wrote to memory of 2596 2440 Explorer.EXE 56 PID 2440 wrote to memory of 2596 2440 Explorer.EXE 56 PID 2440 wrote to memory of 2596 2440 Explorer.EXE 56 PID 2596 wrote to memory of 2912 2596 WWAHost.exe 61 PID 2596 wrote to memory of 2912 2596 WWAHost.exe 61 PID 2596 wrote to memory of 2912 2596 WWAHost.exe 61
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\DHL Delivery Documents.exe"C:\Users\Admin\AppData\Local\Temp\DHL Delivery Documents.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:320
-
-
-
C:\Windows\SysWOW64\WWAHost.exe"C:\Windows\SysWOW64\WWAHost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"3⤵PID:2912
-
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe f87852be5b1160b56a8734c3ced8b7ac SQSLfwJpYki1XtwICMDPjw.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵PID:2756