Analysis
- max time kernel
154s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/02/2022, 17:56
Static task
static1
Behavioral task
behavioral1
Sample
CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe
- Size 131KB
- Sample220217-wh2kdscgc9
- SHA256 fae733152e6edb47a0d4ee6e829cf8a349885b7a9223b4ef11de90825f9f05c8
- MD5 1300a5da4544ce9a971aa47ae57a1127
- SHA1 7cc6f77066f55c67eb1bc93d7aa66c829818c1b5
- SHA512 a5dd1c9c8893192c6950bfca79ebc64e855a05e78730641dca5b7911a13c75eb74591ecabf32993fe0c4be24c97f736c4f05b98a6d735bd111a379869c97603f
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
c0a7
Decoy
-
bhaleraodecoration.com
-
nicprgas.com
-
cosgarpivn.quest
-
vintagekatherine.biz
-
metagforce.club
-
corkincantorgroup.com
-
dothis.website
-
nropes.com
-
dpluspizza1.com
-
shoeloans.com
-
mu.network
-
northalabamahome.com
-
ironweedaudio.com
-
markulu.com
-
spencergulfpestcontrol.com
-
genesisgomkch.xyz
-
oncohelper.com
-
crossprime.com
-
onestory-book.com
-
viaggidafare.com
-
smibari.com
-
hokashoesingapore.com
-
emergencyprep4cast.com
-
efasthosting.com
-
dometodd.com
-
rabvervallen-pas.icu
-
unionplusgiveaway.com
-
marina4bunbury.com
-
dentalimplantspracticesbcan.com
-
knapsack.graphics
-
sunbear.net
-
lesindustriels.com
-
warungdgital.com
-
com-421.info
-
pcgamingdesk.com
-
fashiontodai1.xyz
-
capmannews.com
-
saamcoheir.quest
-
delcostudiola.com
-
perception.physio
-
iphone13.space
-
cwtproject.com
-
tinyspiel.com
-
vdcrnw.com
-
szqhkl.com
-
czechcastingglass.com
-
hotmanplayid.net
-
rarityswap.com
-
pancytopenias.com
-
astianlong.com
-
mashaalfashion.com
-
dulichsinhthaikhanhson.com
-
remembergary.com
-
maitehb66.com
-
cafes-lyovel.com
-
agenciatoro.com
-
ms-outlookonline.biz
-
westbayroatan.tours
-
v809pp.com
-
maryhillsubdivision.com
-
789bets.xyz
-
hantieluliao.com
-
defireti.com
-
sydneycarsales.net
-
thecalminglounge.com
Signatures
- Xloader Payload 2 IoCs
resource yara_rule behavioral2/memory/412-139-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4688-146-0x0000000000FA0000-0x0000000000FC9000-memory.dmp xloader - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 5044 set thread context of 412 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 114 PID 412 set thread context of 3032 412 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 61 PID 4688 set thread context of 3032 4688 wlanext.exe 61 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Runs ping.exe 1 TTPs 5 IoCs
pid Process 4956 PING.EXE 1920 PING.EXE 2748 PING.EXE 3568 PING.EXE 944 PING.EXE - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 412 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 412 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 412 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 412 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe 4688 wlanext.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3032 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 412 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 412 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 412 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 4688 wlanext.exe 4688 wlanext.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2988 svchost.exe Token: SeCreatePagefilePrivilege 2988 svchost.exe Token: SeShutdownPrivilege 2988 svchost.exe Token: SeCreatePagefilePrivilege 2988 svchost.exe Token: SeShutdownPrivilege 2988 svchost.exe Token: SeCreatePagefilePrivilege 2988 svchost.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe Token: SeRestorePrivilege 2328 TiWorker.exe Token: SeSecurityPrivilege 2328 TiWorker.exe Token: SeBackupPrivilege 2328 TiWorker.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 5044 wrote to memory of 1320 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 82 PID 5044 wrote to memory of 1320 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 82 PID 5044 wrote to memory of 1320 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 82 PID 1320 wrote to memory of 4956 1320 cmd.exe 84 PID 1320 wrote to memory of 4956 1320 cmd.exe 84 PID 1320 wrote to memory of 4956 1320 cmd.exe 84 PID 5044 wrote to memory of 4764 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 90 PID 5044 wrote to memory of 4764 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 90 PID 5044 wrote to memory of 4764 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 90 PID 4764 wrote to memory of 1920 4764 cmd.exe 92 PID 4764 wrote to memory of 1920 4764 cmd.exe 92 PID 4764 wrote to memory of 1920 4764 cmd.exe 92 PID 5044 wrote to memory of 1980 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 95 PID 5044 wrote to memory of 1980 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 95 PID 5044 wrote to memory of 1980 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 95 PID 1980 wrote to memory of 2748 1980 cmd.exe 97 PID 1980 wrote to memory of 2748 1980 cmd.exe 97 PID 1980 wrote to memory of 2748 1980 cmd.exe 97 PID 5044 wrote to memory of 5012 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 99 PID 5044 wrote to memory of 5012 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 99 PID 5044 wrote to memory of 5012 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 99 PID 5012 wrote to memory of 3568 5012 cmd.exe 101 PID 5012 wrote to memory of 3568 5012 cmd.exe 101 PID 5012 wrote to memory of 3568 5012 cmd.exe 101 PID 5044 wrote to memory of 2256 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 104 PID 5044 wrote to memory of 2256 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 104 PID 5044 wrote to memory of 2256 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 104 PID 2256 wrote to memory of 944 2256 cmd.exe 106 PID 2256 wrote to memory of 944 2256 cmd.exe 106 PID 2256 wrote to memory of 944 2256 cmd.exe 106 PID 5044 wrote to memory of 412 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 114 PID 5044 wrote to memory of 412 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 114 PID 5044 wrote to memory of 412 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 114 PID 5044 wrote to memory of 412 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 114 PID 5044 wrote to memory of 412 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 114 PID 5044 wrote to memory of 412 5044 CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe 114 PID 3032 wrote to memory of 4688 3032 Explorer.EXE 115 PID 3032 wrote to memory of 4688 3032 Explorer.EXE 115 PID 3032 wrote to memory of 4688 3032 Explorer.EXE 115 PID 4688 wrote to memory of 1780 4688 wlanext.exe 116 PID 4688 wrote to memory of 1780 4688 wlanext.exe 116 PID 4688 wrote to memory of 1780 4688 wlanext.exe 116
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe"C:\Users\Admin\AppData\Local\Temp\CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping bing.com3⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\PING.EXEping bing.com4⤵
- Runs ping.exe
PID:4956
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping bing.com3⤵
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Windows\SysWOW64\PING.EXEping bing.com4⤵
- Runs ping.exe
PID:1920
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping bing.com3⤵
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\PING.EXEping bing.com4⤵
- Runs ping.exe
PID:2748
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping bing.com3⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\PING.EXEping bing.com4⤵
- Runs ping.exe
PID:3568
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping bing.com3⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\PING.EXEping bing.com4⤵
- Runs ping.exe
PID:944
-
-
-
C:\Users\Admin\AppData\Local\Temp\CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe"C:\Users\Admin\AppData\Local\Temp\CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:412
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\CONDICIONES ESPECIALES DE DHL PARCEL ACTUALIZADAS,pdf.exe"3⤵PID:1780
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2328