Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
16/02/2022, 15:18
Static task
static1
Behavioral task
behavioral1
Sample
INVOICE_0097WE8.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target INVOICE_0097WE8.exe
- Size 794KB
- Sample220216-splwqsdbar
- SHA256 555948e64ed4825dea5e57865e80d764aab3dbf4b973a223f7590ee9b72d23f5
- MD5 b854d01747abc6ce5af8d14c9aaf5d15
- SHA1 2383fdf2826e5b4b75cefc0b0ae767ec831840be
- SHA512 6136a6b560ff5cef18e5f7d3963b16a44e5a1c949f683adac2eb6d2cfd44b47a103e5baa3b19645c0bbb933fc24a4437916655bd7e45fbe6f25e52bdff5bed68
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
rmpc
Decoy
-
lrsdh.com
-
sugarcurd.com
-
genussqmzg.online
-
warkulat.net
-
topstitched.com
-
sman1kotatambaloka.xyz
-
hireprowriter.com
-
robroyrecords.com
-
merlinreport.com
-
topofluna.com
-
planident.com
-
hokashoesingapore.com
-
buckitload.com
-
xn--0k1a.com
-
mynba2k22.com
-
thiccblanket.com
-
zayedhealth.clinic
-
alfer-srl.com
-
sunnysikka.com
-
sdtcbh.com
-
izzat.green
-
princealwaleed.com
-
cesiesis.com
-
alternativedata.company
-
chriscrown.xyz
-
fsyetuo.com
-
gmat-easy.online
-
daadoosh.com
-
sectorfarmaceutico.com
-
loueofficial.com
-
daddybearbodywork.com
-
dtmrealtyspi.com
-
contact-europe.com
-
meltingpotspot.com
-
baojiangou.com
-
escuelaacupunturaimai.com
-
bboldit.com
-
drawerfuid.com
-
sdysjskj.com
-
nbslktwx.com
-
nashvilleholdings.com
-
bajrangiexch9.com
-
cryptowhaledone.com
-
kai6agfw.com
-
silhouette-consult.com
-
vegane-adventskalender.info
-
6dianliu.com
-
virboss.online
-
mocmynghe.com
-
lilbimbi.com
-
dpsxsec.com
-
odnamyslowa.xyz
-
meetmedubai.com
-
rafke.online
-
unusual696.club
-
chathamwaste.com
-
yjaxx.com
-
eurostyl.net
-
krnlfree.com
-
urbandevelopers.net
-
k9surg.com
-
eazlabor.net
-
ttt-asia.com
-
12y0-blog.com
-
lktdjvbwepiw.mobi
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/1628-140-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/908-147-0x0000000000EF0000-0x0000000000F19000-memory.dmp xloader - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3388 set thread context of 1628 3388 INVOICE_0097WE8.exe 97 PID 1628 set thread context of 2216 1628 INVOICE_0097WE8.exe 25 PID 908 set thread context of 2216 908 rundll32.exe 25 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1628 INVOICE_0097WE8.exe 1628 INVOICE_0097WE8.exe 1628 INVOICE_0097WE8.exe 1628 INVOICE_0097WE8.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe 908 rundll32.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2216 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 1628 INVOICE_0097WE8.exe 1628 INVOICE_0097WE8.exe 1628 INVOICE_0097WE8.exe 908 rundll32.exe 908 rundll32.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4204 svchost.exe Token: SeCreatePagefilePrivilege 4204 svchost.exe Token: SeShutdownPrivilege 4204 svchost.exe Token: SeCreatePagefilePrivilege 4204 svchost.exe Token: SeShutdownPrivilege 4204 svchost.exe Token: SeCreatePagefilePrivilege 4204 svchost.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe Token: SeRestorePrivilege 216 TiWorker.exe Token: SeSecurityPrivilege 216 TiWorker.exe Token: SeBackupPrivilege 216 TiWorker.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3388 wrote to memory of 1628 3388 INVOICE_0097WE8.exe 97 PID 3388 wrote to memory of 1628 3388 INVOICE_0097WE8.exe 97 PID 3388 wrote to memory of 1628 3388 INVOICE_0097WE8.exe 97 PID 3388 wrote to memory of 1628 3388 INVOICE_0097WE8.exe 97 PID 3388 wrote to memory of 1628 3388 INVOICE_0097WE8.exe 97 PID 3388 wrote to memory of 1628 3388 INVOICE_0097WE8.exe 97 PID 2216 wrote to memory of 908 2216 Explorer.EXE 98 PID 2216 wrote to memory of 908 2216 Explorer.EXE 98 PID 2216 wrote to memory of 908 2216 Explorer.EXE 98 PID 908 wrote to memory of 2608 908 rundll32.exe 101 PID 908 wrote to memory of 2608 908 rundll32.exe 101 PID 908 wrote to memory of 2608 908 rundll32.exe 101
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\INVOICE_0097WE8.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE_0097WE8.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\INVOICE_0097WE8.exe"C:\Users\Admin\AppData\Local\Temp\INVOICE_0097WE8.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1628
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\INVOICE_0097WE8.exe"3⤵PID:2608
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4204
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:216