Resubmissions
16/02/2022, 14:43
220216-r31flsdagq1016/02/2022, 14:37
220216-rzmeksdagk1016/02/2022, 14:22
220216-rpkg8sdafl10Analysis
- max time kernel
148s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
16/02/2022, 14:22
Static task
static1
Behavioral task
behavioral1
Sample
DELIVERY DOCUMENTS.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target DELIVERY DOCUMENTS.exe
- Size 707KB
- Sample220216-rpkg8sdafl
- SHA256 cd4ee025ad3406b7e572952d42465eee19649cef6c0d3a6acbb0e972096988f4
- MD5 427ef5f4e1143ad34c33b26dc4681661
- SHA1 673fb1a58e4707ad783d03ca97b3fbd8b4cad73a
- SHA512 b225afbb07853516f1b741e833e1a63026c0dc5adbb0c3fcfb48f8c6681bc770558499df3d3f5c17df45395dedc3624a1e8fa6498395ac20a82f44e27a61dfbb
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
zqzw
Decoy
-
laurentmathieu.com
-
nohohonndana.com
-
hhmc.info
-
shophallows.com
-
blazebunk.com
-
goodbridge.xyz
-
flakycloud.com
-
bakermckenziegroups.com
-
formation-adistance.com
-
lovingearthbotanicals.com
-
tbrservice.plus
-
heritagehousehotels.com
-
drwbuildersco.com
-
lacsghb.com
-
wain3x.com
-
dadreview.club
-
continiutycp.com
-
cockgirls.com
-
48mpt.xyz
-
033skz.xyz
-
gmconstructionlnc.com
-
ms-mint.com
-
aenrione.xyz
-
honxuan.com
-
snowmanvila.com
-
cig-online.com
-
valetvolley.com
-
bjsnft.com
-
bennystrom.com
-
flw.ink
-
clarissagrandiart.com
-
samfamstudio.com
-
pamschams.com
-
edgar-regale.com
-
combi-tech.tech
-
00xwq.online
-
eclipseconstrucciones.com
-
plick-click.com
-
dive.education
-
regenelis.com
-
blue-chipwordtoscan-today.info
-
xn--rsso51aevf65u.com
-
maonagrana.com
-
lucasdebatintrader.com
-
cassijohnson.com
-
roeten.online
-
into-concrete.xyz
-
motovip.store
-
floryfab.com
-
slkykq.com
-
vidyakala.com
-
stairwaystowealth.com
-
meganandbobbyprine.com
-
arestradings.com
-
emilyschlueter.com
-
platanin.com
-
hnhstudios.com
-
dmembutidos.com
-
dcassorealtor.com
-
megamobil.wien
-
001skz.xyz
-
5t45urfgurkhgbvkhbuh.com
-
a3hd.com
-
newmexicotruckwrecklawyers.com
-
trabaho-academy.net
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/1428-138-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/992-145-0x0000000001080000-0x00000000010A9000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1588 set thread context of 1428 1588 DELIVERY DOCUMENTS.exe 96 PID 1428 set thread context of 2436 1428 DELIVERY DOCUMENTS.exe 44 PID 992 set thread context of 2436 992 svchost.exe 44 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Suspicious behavior: EnumeratesProcesses 50 IoCs
pid Process 1428 DELIVERY DOCUMENTS.exe 1428 DELIVERY DOCUMENTS.exe 1428 DELIVERY DOCUMENTS.exe 1428 DELIVERY DOCUMENTS.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe 992 svchost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2436 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1428 DELIVERY DOCUMENTS.exe 1428 DELIVERY DOCUMENTS.exe 1428 DELIVERY DOCUMENTS.exe 992 svchost.exe 992 svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2108 svchost.exe Token: SeCreatePagefilePrivilege 2108 svchost.exe Token: SeShutdownPrivilege 2108 svchost.exe Token: SeCreatePagefilePrivilege 2108 svchost.exe Token: SeShutdownPrivilege 2108 svchost.exe Token: SeCreatePagefilePrivilege 2108 svchost.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe Token: SeRestorePrivilege 3804 TiWorker.exe Token: SeSecurityPrivilege 3804 TiWorker.exe Token: SeBackupPrivilege 3804 TiWorker.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2436 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1588 wrote to memory of 1428 1588 DELIVERY DOCUMENTS.exe 96 PID 1588 wrote to memory of 1428 1588 DELIVERY DOCUMENTS.exe 96 PID 1588 wrote to memory of 1428 1588 DELIVERY DOCUMENTS.exe 96 PID 1588 wrote to memory of 1428 1588 DELIVERY DOCUMENTS.exe 96 PID 1588 wrote to memory of 1428 1588 DELIVERY DOCUMENTS.exe 96 PID 1588 wrote to memory of 1428 1588 DELIVERY DOCUMENTS.exe 96 PID 2436 wrote to memory of 992 2436 Explorer.EXE 97 PID 2436 wrote to memory of 992 2436 Explorer.EXE 97 PID 2436 wrote to memory of 992 2436 Explorer.EXE 97 PID 992 wrote to memory of 2332 992 svchost.exe 99 PID 992 wrote to memory of 2332 992 svchost.exe 99 PID 992 wrote to memory of 2332 992 svchost.exe 99
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1428
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe"3⤵PID:2332
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2108
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3804