Analysis
-
max time kernel
162s -
max time network
169s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
03-02-2022 08:00
Static task
static1
Behavioral task
behavioral1
Sample
IMG 29987 SHIPMENT Order 85 3.02.2022.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
IMG 29987 SHIPMENT Order 85 3.02.2022.exe
Resource
win10v2004-en-20220112
General
-
Target
IMG 29987 SHIPMENT Order 85 3.02.2022.exe
-
Size
558KB
-
MD5
d541dd30d857710b9a5f708b83db0241
-
SHA1
6a6b66e233eee0b11129732e35e4e7c65c631c84
-
SHA256
af662c52d97d2590fa9a275d02feaf5aab3c18365e002a288efd862bd09aa6b4
-
SHA512
685cdf9f95452ca8b177208cac7fc6841709167a5a46116d7267c6330fcf4f77ecca67dd9730554682bdc5fbf9e19f5f2f0bb3bb3ab2f520f49271261067ac89
Malware Config
Extracted
xloader
2.5
p8ce
wishmeluck1.xyz
nawabumi.com
terra.fish
eoraipsumami.quest
awakeningyourid.com
csyein.com
tslsinteligentes.com
cataractusa.com
capitalwheelstogo.com
staffremotely.com
trashbinwasher.com
blaneyparkrendezvous.com
yolrt.com
northendtaproom.com
showgeini.com
b95206.com
almcpersonaltraining.com
lovabledoodleshome.com
woodlandstationcondos.com
nikahlive.com
sassholesentiments.com
bupis44.info
salahiheartclinic.com
loveandpersonality.com
electric-cortex.com
beijixing-zs.com
proper-sa.com
legacyfamilypartners.com
psidsamor.com
schotinderoos.com
kosma-concept.com
onitled.com
zscyyds.xyz
mannatgroups.com
radweb-demo.com
lambanghieuquangcao.info
antabatik.com
lerongclub.com
mobssvipshop.com
dr-walther.com
ibexitconsultants.com
cnyprospects.com
j9mkt64.com
archer-claims.com
lggrandinn.com
jowhp.com
outdoormz.store
cantikgroup.company
2brothersprinting.com
ginamodernart.com
koupeespen.quest
senerants.tech
designthrottle.com
emquality.com
cerulesafe.com
orascomservice.com
skinsotight.com
premiumconciergemarbella.com
cottagepor.xyz
gwayav.com
johnguidesyou.com
corporativokale.com
jskswj.com
xinico.info
gebaeudetechnik-burscheid.com
Signatures
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/820-137-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3364-143-0x00000000005A0000-0x00000000005C9000-memory.dmp xloader -
Sets service image path in registry 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
IMG 29987 SHIPMENT Order 85 3.02.2022.exeIMG 29987 SHIPMENT Order 85 3.02.2022.exedescription pid process target process PID 828 set thread context of 820 828 IMG 29987 SHIPMENT Order 85 3.02.2022.exe IMG 29987 SHIPMENT Order 85 3.02.2022.exe PID 820 set thread context of 2328 820 IMG 29987 SHIPMENT Order 85 3.02.2022.exe Explorer.EXE -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
WaaSMedicAgent.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4084" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3900" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.006545" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
IMG 29987 SHIPMENT Order 85 3.02.2022.execscript.exepid process 820 IMG 29987 SHIPMENT Order 85 3.02.2022.exe 820 IMG 29987 SHIPMENT Order 85 3.02.2022.exe 820 IMG 29987 SHIPMENT Order 85 3.02.2022.exe 820 IMG 29987 SHIPMENT Order 85 3.02.2022.exe 3364 cscript.exe 3364 cscript.exe 3364 cscript.exe 3364 cscript.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
IMG 29987 SHIPMENT Order 85 3.02.2022.execscript.exepid process 820 IMG 29987 SHIPMENT Order 85 3.02.2022.exe 820 IMG 29987 SHIPMENT Order 85 3.02.2022.exe 820 IMG 29987 SHIPMENT Order 85 3.02.2022.exe 3364 cscript.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
IMG 29987 SHIPMENT Order 85 3.02.2022.exeExplorer.EXEcscript.exedescription pid process Token: SeDebugPrivilege 820 IMG 29987 SHIPMENT Order 85 3.02.2022.exe Token: SeShutdownPrivilege 2328 Explorer.EXE Token: SeCreatePagefilePrivilege 2328 Explorer.EXE Token: SeDebugPrivilege 3364 cscript.exe Token: SeShutdownPrivilege 2328 Explorer.EXE Token: SeCreatePagefilePrivilege 2328 Explorer.EXE Token: SeShutdownPrivilege 2328 Explorer.EXE Token: SeCreatePagefilePrivilege 2328 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
IMG 29987 SHIPMENT Order 85 3.02.2022.exeExplorer.EXEcscript.exedescription pid process target process PID 828 wrote to memory of 820 828 IMG 29987 SHIPMENT Order 85 3.02.2022.exe IMG 29987 SHIPMENT Order 85 3.02.2022.exe PID 828 wrote to memory of 820 828 IMG 29987 SHIPMENT Order 85 3.02.2022.exe IMG 29987 SHIPMENT Order 85 3.02.2022.exe PID 828 wrote to memory of 820 828 IMG 29987 SHIPMENT Order 85 3.02.2022.exe IMG 29987 SHIPMENT Order 85 3.02.2022.exe PID 828 wrote to memory of 820 828 IMG 29987 SHIPMENT Order 85 3.02.2022.exe IMG 29987 SHIPMENT Order 85 3.02.2022.exe PID 828 wrote to memory of 820 828 IMG 29987 SHIPMENT Order 85 3.02.2022.exe IMG 29987 SHIPMENT Order 85 3.02.2022.exe PID 828 wrote to memory of 820 828 IMG 29987 SHIPMENT Order 85 3.02.2022.exe IMG 29987 SHIPMENT Order 85 3.02.2022.exe PID 2328 wrote to memory of 3364 2328 Explorer.EXE cscript.exe PID 2328 wrote to memory of 3364 2328 Explorer.EXE cscript.exe PID 2328 wrote to memory of 3364 2328 Explorer.EXE cscript.exe PID 3364 wrote to memory of 3028 3364 cscript.exe cmd.exe PID 3364 wrote to memory of 3028 3364 cscript.exe cmd.exe PID 3364 wrote to memory of 3028 3364 cscript.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG 29987 SHIPMENT Order 85 3.02.2022.exe"C:\Users\Admin\AppData\Local\Temp\IMG 29987 SHIPMENT Order 85 3.02.2022.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG 29987 SHIPMENT Order 85 3.02.2022.exe"C:\Users\Admin\AppData\Local\Temp\IMG 29987 SHIPMENT Order 85 3.02.2022.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IMG 29987 SHIPMENT Order 85 3.02.2022.exe"3⤵
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 7a3930a051db2f78b12d8d3b516b027f 56J+OO/JnEWglzfMAQ6rcg.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/820-137-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/820-140-0x0000000001590000-0x0000000001D4A000-memory.dmpFilesize
7.7MB
-
memory/820-139-0x0000000001590000-0x0000000001D4A000-memory.dmpFilesize
7.7MB
-
memory/828-133-0x0000000005660000-0x00000000056F2000-memory.dmpFilesize
584KB
-
memory/828-134-0x0000000000F90000-0x000000000102C000-memory.dmpFilesize
624KB
-
memory/828-135-0x0000000002BC0000-0x0000000002C81000-memory.dmpFilesize
772KB
-
memory/828-136-0x0000000005E60000-0x0000000006404000-memory.dmpFilesize
5.6MB
-
memory/828-130-0x00000000007C0000-0x0000000000854000-memory.dmpFilesize
592KB
-
memory/828-132-0x0000000005490000-0x00000000054D0000-memory.dmpFilesize
256KB
-
memory/828-131-0x0000000002BC0000-0x0000000002C81000-memory.dmpFilesize
772KB
-
memory/2328-141-0x0000000008350000-0x0000000008405000-memory.dmpFilesize
724KB
-
memory/3364-143-0x00000000005A0000-0x00000000005C9000-memory.dmpFilesize
164KB
-
memory/3364-142-0x0000000000CB0000-0x0000000000CD7000-memory.dmpFilesize
156KB
-
memory/3364-144-0x0000000004990000-0x0000000004CDA000-memory.dmpFilesize
3.3MB