klSsrzxwsbxeJQh.exe

General
Target

klSsrzxwsbxeJQh.exe

Filesize

818KB

Completed

27-07-2021 22:23

Score
10 /10
MD5

3be1fa609b4f6efa9d30b5c75810f863

SHA1

61dcd8a4bd4641a7cc4800b5aea9ecaf7c6609bf

SHA256

27572043b01a99f3901af4bd40faf03cd04e722e3fb7ba866ccdb3b2d3fabb11

Malware Config

Extracted

Family xloader
Version 2.3
C2

http://www.arogyanlife.com/b82a/

Decoy

annguyet.net

parkwood.tech

readysetmortgage.net

betraywithdraw.com

incmagazine.xyz

dentistinpimplesaudagar.com

lianhx.com

prodrelease0827b.com

safehavenwellbeing.com

gehdeinweg.club

sondaggio123.space

prospecx.report

remediate.info

savylash.com

puppornstar.com

coaching-romand.com

boozeshops.com

team316media.com

ldgawydtl.icu

trezteez.com

hhtgd.com

jugoon.xyz

bsafetexting.com

imaycom.com

fakihgroups.com

pfarfour.com

organowantcreator.com

profesyoneltemizlikantalya.com

kustomdiapercakes.com

repealpna.com

seraby.com

eventsshowleads.com

naturallybossed.com

twxgbmbdkxczd.net

gahterwisdom.com

bautec-euregio.com

sarelawadisangh.com

gimedor.com

revolutionofwork.com

zpwizso.com

livinglavidalocaltexas.com

yenidea.com

smugfantasyfootball.com

myprofitvideo.com

inseparablehearts.com

dalebutano.com

bluecatsubs.com

nationwaves.com

theplantwitch.com

ffntc.com

Signatures 11

Filter: none

  • Xloader

    Description

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    Tags

  • CustAttr .NET packer

    Description

    Detects CustAttr .NET packer in memory.

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3968-122-0x0000000007260000-0x000000000726B000-memory.dmpCustAttr
  • Xloader Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/1120-125-0x0000000000400000-0x0000000000428000-memory.dmpxloader
    behavioral2/memory/1120-126-0x000000000041CFC0-mapping.dmpxloader
    behavioral2/memory/2372-133-0x0000000003200000-0x0000000003228000-memory.dmpxloader
  • Suspicious use of SetThreadContext
    klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.execmstp.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3968 set thread context of 11203968klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 1120 set thread context of 24921120klSsrzxwsbxeJQh.exeExplorer.EXE
    PID 2372 set thread context of 24922372cmstp.exeExplorer.EXE
  • Suspicious behavior: EnumeratesProcesses
    klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.execmstp.exe

    Reported IOCs

    pidprocess
    3968klSsrzxwsbxeJQh.exe
    3968klSsrzxwsbxeJQh.exe
    1120klSsrzxwsbxeJQh.exe
    1120klSsrzxwsbxeJQh.exe
    1120klSsrzxwsbxeJQh.exe
    1120klSsrzxwsbxeJQh.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
    2372cmstp.exe
  • Suspicious behavior: GetForegroundWindowSpam
    Explorer.EXE

    Reported IOCs

    pidprocess
    2492Explorer.EXE
  • Suspicious behavior: MapViewOfSection
    klSsrzxwsbxeJQh.execmstp.exe

    Reported IOCs

    pidprocess
    1120klSsrzxwsbxeJQh.exe
    1120klSsrzxwsbxeJQh.exe
    1120klSsrzxwsbxeJQh.exe
    2372cmstp.exe
    2372cmstp.exe
  • Suspicious use of AdjustPrivilegeToken
    klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.execmstp.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege3968klSsrzxwsbxeJQh.exe
    Token: SeDebugPrivilege1120klSsrzxwsbxeJQh.exe
    Token: SeDebugPrivilege2372cmstp.exe
  • Suspicious use of UnmapMainImage
    Explorer.EXE

    Reported IOCs

    pidprocess
    2492Explorer.EXE
  • Suspicious use of WriteProcessMemory
    klSsrzxwsbxeJQh.exeExplorer.EXEcmstp.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3968 wrote to memory of 10483968klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 3968 wrote to memory of 10483968klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 3968 wrote to memory of 10483968klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 3968 wrote to memory of 11203968klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 3968 wrote to memory of 11203968klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 3968 wrote to memory of 11203968klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 3968 wrote to memory of 11203968klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 3968 wrote to memory of 11203968klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 3968 wrote to memory of 11203968klSsrzxwsbxeJQh.exeklSsrzxwsbxeJQh.exe
    PID 2492 wrote to memory of 23722492Explorer.EXEcmstp.exe
    PID 2492 wrote to memory of 23722492Explorer.EXEcmstp.exe
    PID 2492 wrote to memory of 23722492Explorer.EXEcmstp.exe
    PID 2372 wrote to memory of 14322372cmstp.execmd.exe
    PID 2372 wrote to memory of 14322372cmstp.execmd.exe
    PID 2372 wrote to memory of 14322372cmstp.execmd.exe
Processes 12
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of UnmapMainImage
    Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe
      "C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3968
      • C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe
        "C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe"
        PID:1048
      • C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe
        "C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe"
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        PID:1120
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      PID:1644
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      PID:2164
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      PID:2252
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      PID:2188
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      PID:2344
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      PID:2384
    • C:\Windows\SysWOW64\cmstp.exe
      "C:\Windows\SysWOW64\cmstp.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2372
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\klSsrzxwsbxeJQh.exe"
        PID:1432
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1120-126-0x000000000041CFC0-mapping.dmp

                          • memory/1120-127-0x0000000001560000-0x0000000001880000-memory.dmp

                          • memory/1120-128-0x0000000000F80000-0x0000000000F90000-memory.dmp

                          • memory/1120-125-0x0000000000400000-0x0000000000428000-memory.dmp

                          • memory/1432-131-0x0000000000000000-mapping.dmp

                          • memory/2372-135-0x0000000004B60000-0x0000000004BEF000-memory.dmp

                          • memory/2372-130-0x0000000000000000-mapping.dmp

                          • memory/2372-134-0x00000000047B0000-0x0000000004AD0000-memory.dmp

                          • memory/2372-132-0x0000000000B10000-0x0000000000B26000-memory.dmp

                          • memory/2372-133-0x0000000003200000-0x0000000003228000-memory.dmp

                          • memory/2492-129-0x00000000059F0000-0x0000000005B23000-memory.dmp

                          • memory/2492-136-0x00000000058D0000-0x00000000059D3000-memory.dmp

                          • memory/3968-124-0x0000000008870000-0x000000000889F000-memory.dmp

                          • memory/3968-123-0x00000000087B0000-0x0000000008824000-memory.dmp

                          • memory/3968-122-0x0000000007260000-0x000000000726B000-memory.dmp

                          • memory/3968-121-0x0000000005120000-0x000000000561E000-memory.dmp

                          • memory/3968-120-0x00000000053B0000-0x00000000053B1000-memory.dmp

                          • memory/3968-119-0x0000000005130000-0x0000000005131000-memory.dmp

                          • memory/3968-118-0x00000000051C0000-0x00000000051C1000-memory.dmp

                          • memory/3968-117-0x0000000005620000-0x0000000005621000-memory.dmp

                          • memory/3968-116-0x0000000005080000-0x0000000005081000-memory.dmp

                          • memory/3968-114-0x00000000007A0000-0x00000000007A1000-memory.dmp