Analysis
- max time kernel
166s - max time network
161s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
07/02/2022, 14:00
Static task
static1
Behavioral task
behavioral1
Sample
Invoice request.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target Invoice request.exe
- Size 807KB
- Sample220207-raz95scfep
- SHA256 894cebc6da151cbe64ab4094b2e779f433dc0865ba1cff8063747ca407454629
- MD5 a5ffb999f20c34fbfb66b7adb4d79150
- SHA1 d0306b0ee9bf0d23609868c12257df1053aaad82
- SHA512 58479022567b5c163a433b5b02706638624df1e6c42974a14cca74c1bb9eda924ca70c75d7a24ba6d20f2ccd9e066ec62e882d7954987b916e7a091f51305388
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
m4ro
Decoy
-
schedulekeymail.com
-
ruteglobe.net
-
makspeed.online
-
legalsoftsolutions.info
-
sportdemands.com
-
ci-ohio.com
-
ge-endoscopy.com
-
edp7.com
-
teammississippistate.club
-
risingrecovery.info
-
shouldimint.com
-
haxeo0d1wo.com
-
tjxinglin.com
-
immigrationformsus.com
-
best-free-soccer-academy.com
-
iamvitalessence.com
-
hellranch.net
-
creamydickmail.com
-
standshopping.com
-
slayhernail.com
-
flawlessfinisher.com
-
nexusbalance.com
-
teamselflovecollection.com
-
nicotimes.net
-
gatewayeastdevelopment.com
-
judoclubalbigny.com
-
c365sl.com
-
improvequote.com
-
drivesize.com
-
allensoldit.com
-
nioasu.com
-
glensfallsgobblewobble.com
-
lifement-test.com
-
donkolireti.online
-
qiuma.net
-
angelsconsultingservices.com
-
sozdavay.com
-
arrow-industries.com
-
indotogel369.com
-
aradhyagroups.net
-
kalayeshi.com
-
teambelda.com
-
fastlendr.com
-
directresults.biz
-
productshopify.store
-
charlimarketplace.com
-
anightintheforest.com
-
gloriamcarter.com
-
amor-vincit.com
-
villagecrossingapartments.com
-
cbdterapeutico.lat
-
workingholiday5.com
-
getbutton.net
-
cncwarp.net
-
kltfonbki.xyz
-
bgralife.com
-
businessinbrickell.com
-
shaalanrealestate.com
-
jrnarval.com
-
cafetuktuk.net
-
mauroadrianbioexistencia.com
-
senaifcresources.com
-
fe9muunu.xyz
-
dreamdrawings.art
-
vear.club
Signatures
- Xloader Payload 5 IoCs
resource yara_rule behavioral2/memory/3372-136-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3372-139-0x0000000000CE0000-0x000000000149A000-memory.dmp xloader behavioral2/memory/3920-142-0x00000000004E0000-0x0000000000509000-memory.dmp xloader behavioral2/memory/3920-143-0x0000000000870000-0x00000000048EA000-memory.dmp xloader behavioral2/memory/3920-144-0x0000000000870000-0x00000000048EA000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1264 set thread context of 3372 1264 Invoice request.exe 67 PID 3372 set thread context of 2448 3372 Invoice request.exe 33 PID 3920 set thread context of 2448 3920 cmstp.exe 33 - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe - Modifies data under HKEY_USERS 45 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132888930883392885" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4056" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.097977" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe - Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 1264 Invoice request.exe 1264 Invoice request.exe 1264 Invoice request.exe 1264 Invoice request.exe 1264 Invoice request.exe 3372 Invoice request.exe 3372 Invoice request.exe 3372 Invoice request.exe 3372 Invoice request.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe 3920 cmstp.exe - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 3372 Invoice request.exe 3372 Invoice request.exe 3372 Invoice request.exe 3920 cmstp.exe 3920 cmstp.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 1264 Invoice request.exe Token: SeDebugPrivilege 3372 Invoice request.exe Token: SeShutdownPrivilege 2448 Explorer.EXE Token: SeCreatePagefilePrivilege 2448 Explorer.EXE Token: SeShutdownPrivilege 2448 Explorer.EXE Token: SeCreatePagefilePrivilege 2448 Explorer.EXE Token: SeDebugPrivilege 3920 cmstp.exe Token: SeShutdownPrivilege 2448 Explorer.EXE Token: SeCreatePagefilePrivilege 2448 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1264 wrote to memory of 3376 1264 Invoice request.exe 66 PID 1264 wrote to memory of 3376 1264 Invoice request.exe 66 PID 1264 wrote to memory of 3376 1264 Invoice request.exe 66 PID 1264 wrote to memory of 3372 1264 Invoice request.exe 67 PID 1264 wrote to memory of 3372 1264 Invoice request.exe 67 PID 1264 wrote to memory of 3372 1264 Invoice request.exe 67 PID 1264 wrote to memory of 3372 1264 Invoice request.exe 67 PID 1264 wrote to memory of 3372 1264 Invoice request.exe 67 PID 1264 wrote to memory of 3372 1264 Invoice request.exe 67 PID 2448 wrote to memory of 3920 2448 Explorer.EXE 68 PID 2448 wrote to memory of 3920 2448 Explorer.EXE 68 PID 2448 wrote to memory of 3920 2448 Explorer.EXE 68 PID 3920 wrote to memory of 3460 3920 cmstp.exe 69 PID 3920 wrote to memory of 3460 3920 cmstp.exe 69 PID 3920 wrote to memory of 3460 3920 cmstp.exe 69
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\Invoice request.exe"C:\Users\Admin\AppData\Local\Temp\Invoice request.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\Invoice request.exe"C:\Users\Admin\AppData\Local\Temp\Invoice request.exe"3⤵PID:3376
-
-
C:\Users\Admin\AppData\Local\Temp\Invoice request.exe"C:\Users\Admin\AppData\Local\Temp\Invoice request.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3372
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Invoice request.exe"3⤵PID:3460
-
-
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
PID:2004
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:392