klSsrzxwsbxeJQh.exe

General
Target

klSsrzxwsbxeJQh.exe

Filesize

818KB

Completed

27-07-2021 22:24

Score
10 /10
MD5

3be1fa609b4f6efa9d30b5c75810f863

SHA1

61dcd8a4bd4641a7cc4800b5aea9ecaf7c6609bf

SHA256

27572043b01a99f3901af4bd40faf03cd04e722e3fb7ba866ccdb3b2d3fabb11

Malware Config

Extracted

Family xloader
Version 2.3
C2

http://www.arogyanlife.com/b82a/

Decoy

annguyet.net

parkwood.tech

readysetmortgage.net

betraywithdraw.com

incmagazine.xyz

dentistinpimplesaudagar.com

lianhx.com

prodrelease0827b.com

safehavenwellbeing.com

gehdeinweg.club

sondaggio123.space

prospecx.report

remediate.info

savylash.com

puppornstar.com

coaching-romand.com

boozeshops.com

team316media.com

ldgawydtl.icu

trezteez.com

hhtgd.com

jugoon.xyz

bsafetexting.com

imaycom.com

fakihgroups.com

pfarfour.com

organowantcreator.com

profesyoneltemizlikantalya.com

kustomdiapercakes.com

repealpna.com

seraby.com

eventsshowleads.com

naturallybossed.com

twxgbmbdkxczd.net

gahterwisdom.com

bautec-euregio.com

sarelawadisangh.com

gimedor.com

revolutionofwork.com

zpwizso.com

livinglavidalocaltexas.com

yenidea.com

smugfantasyfootball.com

myprofitvideo.com

inseparablehearts.com

dalebutano.com

bluecatsubs.com

nationwaves.com

theplantwitch.com

ffntc.com

Signatures 12

Filter: none

  • Xloader

    Description

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    Tags

  • CustAttr .NET packer

    Description

    Detects CustAttr .NET packer in memory.

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/752-63-0x0000000000270000-0x000000000027B000-memory.dmpCustAttr
  • Xloader Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/612-66-0x0000000000400000-0x0000000000428000-memory.dmpxloader
    behavioral1/memory/612-67-0x000000000041CFC0-mapping.dmpxloader
    behavioral1/memory/1100-75-0x0000000000080000-0x00000000000A8000-memory.dmpxloader
  • Deletes itself
    cmd.exe

    Reported IOCs

    pidprocess
    1828cmd.exe
  • Suspicious use of SetThreadContext
    klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exesvchost.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 752 set thread context of 612752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 612 set thread context of 1200612klSsrzxwsbxeJQh.exeExplorer.EXE
    PID 612 set thread context of 1200612klSsrzxwsbxeJQh.exeExplorer.EXE
    PID 1100 set thread context of 12001100svchost.exeExplorer.EXE
  • Suspicious behavior: EnumeratesProcesses
    klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exesvchost.exe

    Reported IOCs

    pidprocess
    752klSsrzxwsbxeJQh.exe
    752klSsrzxwsbxeJQh.exe
    612klSsrzxwsbxeJQh.exe
    612klSsrzxwsbxeJQh.exe
    612klSsrzxwsbxeJQh.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
    1100svchost.exe
  • Suspicious behavior: MapViewOfSection
    klSsrzxwsbxeJQh.exesvchost.exe

    Reported IOCs

    pidprocess
    612klSsrzxwsbxeJQh.exe
    612klSsrzxwsbxeJQh.exe
    612klSsrzxwsbxeJQh.exe
    612klSsrzxwsbxeJQh.exe
    1100svchost.exe
    1100svchost.exe
  • Suspicious use of AdjustPrivilegeToken
    klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exesvchost.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege752klSsrzxwsbxeJQh.exe
    Token: SeDebugPrivilege612klSsrzxwsbxeJQh.exe
    Token: SeDebugPrivilege1100svchost.exe
  • Suspicious use of FindShellTrayWindow
    Explorer.EXE

    Reported IOCs

    pidprocess
    1200Explorer.EXE
    1200Explorer.EXE
    1200Explorer.EXE
    1200Explorer.EXE
  • Suspicious use of SendNotifyMessage
    Explorer.EXE

    Reported IOCs

    pidprocess
    1200Explorer.EXE
    1200Explorer.EXE
    1200Explorer.EXE
    1200Explorer.EXE
  • Suspicious use of WriteProcessMemory
    klSsrzxwsbxeJQh.exeExplorer.EXEsvchost.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 752 wrote to memory of 472752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 752 wrote to memory of 472752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 752 wrote to memory of 472752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 752 wrote to memory of 472752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 752 wrote to memory of 612752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 752 wrote to memory of 612752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 752 wrote to memory of 612752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 752 wrote to memory of 612752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 752 wrote to memory of 612752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 752 wrote to memory of 612752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 752 wrote to memory of 612752klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 1200 wrote to memory of 11001200Explorer.EXEsvchost.exe
    PID 1200 wrote to memory of 11001200Explorer.EXEsvchost.exe
    PID 1200 wrote to memory of 11001200Explorer.EXEsvchost.exe
    PID 1200 wrote to memory of 11001200Explorer.EXEsvchost.exe
    PID 1100 wrote to memory of 18281100svchost.execmd.exe
    PID 1100 wrote to memory of 18281100svchost.execmd.exe
    PID 1100 wrote to memory of 18281100svchost.execmd.exe
    PID 1100 wrote to memory of 18281100svchost.execmd.exe
Processes 6
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe
      "C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:752
      • C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe
        "C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe"
        PID:472
      • C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe
        "C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe"
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        PID:612
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe"
        Deletes itself
        PID:1828
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/612-71-0x0000000000350000-0x0000000000360000-memory.dmp

                          • memory/612-68-0x00000000006E0000-0x00000000009E3000-memory.dmp

                          • memory/612-69-0x0000000000310000-0x0000000000320000-memory.dmp

                          • memory/612-66-0x0000000000400000-0x0000000000428000-memory.dmp

                          • memory/612-67-0x000000000041CFC0-mapping.dmp

                          • memory/752-64-0x0000000004F10000-0x0000000004F84000-memory.dmp

                          • memory/752-65-0x0000000000560000-0x000000000058F000-memory.dmp

                          • memory/752-62-0x0000000004D20000-0x0000000004D21000-memory.dmp

                          • memory/752-63-0x0000000000270000-0x000000000027B000-memory.dmp

                          • memory/752-60-0x00000000010B0000-0x00000000010B1000-memory.dmp

                          • memory/1100-78-0x0000000000540000-0x00000000005CF000-memory.dmp

                          • memory/1100-73-0x0000000000000000-mapping.dmp

                          • memory/1100-75-0x0000000000080000-0x00000000000A8000-memory.dmp

                          • memory/1100-76-0x0000000000990000-0x0000000000C93000-memory.dmp

                          • memory/1100-74-0x0000000000350000-0x0000000000358000-memory.dmp

                          • memory/1100-80-0x0000000075451000-0x0000000075453000-memory.dmp

                          • memory/1200-70-0x0000000003D70000-0x0000000003E20000-memory.dmp

                          • memory/1200-72-0x0000000006270000-0x00000000063B8000-memory.dmp

                          • memory/1200-79-0x0000000005ED0000-0x0000000005F84000-memory.dmp

                          • memory/1828-77-0x0000000000000000-mapping.dmp