Analysis

  • max time kernel
    150s
  • max time network
    160s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    30-07-2021 15:25

General

  • Target

    USD $.exe

  • Size

    1.0MB

  • MD5

    7098068c07032900ff073b55a8ad8e0b

  • SHA1

    5bdda0bc06b935689f29d55b297d0523d82c6bfa

  • SHA256

    2d7aac32ea8a8329262ead70ec2f030c1a4061e4edafdf03e605bb9ce606836e

  • SHA512

    c5568a37cd6cfa600af5742acd1143d434035e2b5d7caa515ccbf182c6f72030e28a3562ee9f5e9341bcc5aeef45f498434fb8ff6835bc07c04220440d0aaf39

Malware Config

Extracted

Family

xloader

Version

2.3

C2

http://www.panyu-qqbaby.com/weni/

Decoy

sdmdwang.com

konversationswithkoshie.net

carap.club

eagldeream.com

856380585.xyz

elgallocoffee.com

magetu.info

lovertons.com

theichallenge.com

advancedautorepairsonline.com

wingsstyling.info

tapdaugusta.com

wiloasbanhsgtarewdasc.solutions

donjrisdumb.com

experienceddoctor.com

cloverhillconsultants.com

underwear.show

karensgonewild2020.com

arodsr.com

thefucktardmanual.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)
  • Xloader Payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 45 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3060
    • C:\Users\Admin\AppData\Local\Temp\USD $.exe
      "C:\Users\Admin\AppData\Local\Temp\USD $.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:656
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "{path}"
        3⤵
          PID:2276
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "{path}"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:2016
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:1868
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\SysWOW64\svchost.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:640
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            3⤵
              PID:772

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/640-134-0x00000000034C0000-0x000000000354F000-memory.dmp

          Filesize

          572KB

        • memory/640-132-0x0000000000E40000-0x0000000000E68000-memory.dmp

          Filesize

          160KB

        • memory/640-131-0x0000000000E70000-0x0000000000E7C000-memory.dmp

          Filesize

          48KB

        • memory/640-129-0x0000000000000000-mapping.dmp

        • memory/640-133-0x0000000003720000-0x0000000003A40000-memory.dmp

          Filesize

          3.1MB

        • memory/656-118-0x0000000007660000-0x0000000007B5E000-memory.dmp

          Filesize

          5.0MB

        • memory/656-121-0x0000000002AD0000-0x0000000002AD2000-memory.dmp

          Filesize

          8KB

        • memory/656-122-0x0000000009420000-0x00000000094A6000-memory.dmp

          Filesize

          536KB

        • memory/656-123-0x00000000062D0000-0x0000000006306000-memory.dmp

          Filesize

          216KB

        • memory/656-120-0x0000000009B40000-0x0000000009B41000-memory.dmp

          Filesize

          4KB

        • memory/656-119-0x00000000076D0000-0x00000000076D1000-memory.dmp

          Filesize

          4KB

        • memory/656-117-0x0000000007700000-0x0000000007701000-memory.dmp

          Filesize

          4KB

        • memory/656-116-0x0000000007B60000-0x0000000007B61000-memory.dmp

          Filesize

          4KB

        • memory/656-114-0x00000000008C0000-0x00000000008C1000-memory.dmp

          Filesize

          4KB

        • memory/772-130-0x0000000000000000-mapping.dmp

        • memory/2016-127-0x0000000000AF0000-0x0000000000B00000-memory.dmp

          Filesize

          64KB

        • memory/2016-126-0x0000000001020000-0x0000000001340000-memory.dmp

          Filesize

          3.1MB

        • memory/2016-125-0x000000000041D000-mapping.dmp

        • memory/2016-124-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/3060-128-0x0000000006950000-0x0000000006AC0000-memory.dmp

          Filesize

          1.4MB

        • memory/3060-135-0x0000000006CD0000-0x0000000006E00000-memory.dmp

          Filesize

          1.2MB