ledger.exe

General
Target

ledger.exe

Filesize

746KB

Completed

10-09-2021 09:26

Score
10/10
MD5

bb7bbc40aef8439092e6345d3428c975

SHA1

9bf46b95ff700e57bc0e38d5133577bfad260ea2

SHA256

b194903f2fb1231113b2cffdd6cf47e25d4d9f99675654f70865b1f3d0a9160c

Malware Config

Extracted

Family xloader
Version 2.3
Campaign n58i
C2

http://www.biosonicmicrocurrent.com/n58i/

Decoy

electrifyz.com

silkpetalz.net

cognitivenavigation.com

poophaikus.com

orchidiris.com

arteregalos.com

dailybookmarks.info

gogoanume.pro

hushmailgmx.com

trjisa.com

notontrend.com

2020polltax.com

orderhappy.club

panggabean.net

govsathi.com

hrsbxg.com

xvideotokyo.online

lotteplaze.com

lovecleanliveclean.com

swaphomeloans.net

arcadems.info

creatingstrongerathletes.com

follaproperties.com

i-postgram.com

bootybella.fitness

avtofan.net

bimbavbi.com

yourtravelsbuddy.com

laiofit.com

ofnick.com

2g6gc6zma9g.net

phamthanhdam.com

shopteve.com

add-fast.com

studioloungemke.com

maxtoutfitness.com

mapleway.systems

login-settings.com

affoshop.com

hupubets.com

3energyservices.com

ccmfonline.com

keyhousebuyers.com

curvecue.com

developerdevelopment.com

jamesdunnandsons.com

devyassine.com

dongyilove.com

alienpuran.com

tuolp.com

Signatures 9

Filter: none

  • Xloader

    Description

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/3880-125-0x0000000000400000-0x0000000000428000-memory.dmpxloader
    behavioral2/memory/3880-126-0x000000000041D040-mapping.dmpxloader
    behavioral2/memory/3796-133-0x0000000000120000-0x0000000000148000-memory.dmpxloader
  • Suspicious use of SetThreadContext
    ledger.exeledger.execolorcpl.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3556 set thread context of 38803556ledger.exeledger.exe
    PID 3880 set thread context of 30083880ledger.exeExplorer.EXE
    PID 3796 set thread context of 30083796colorcpl.exeExplorer.EXE
  • Suspicious behavior: EnumeratesProcesses
    ledger.execolorcpl.exe

    Reported IOCs

    pidprocess
    3880ledger.exe
    3880ledger.exe
    3880ledger.exe
    3880ledger.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
    3796colorcpl.exe
  • Suspicious behavior: GetForegroundWindowSpam
    Explorer.EXE

    Reported IOCs

    pidprocess
    3008Explorer.EXE
  • Suspicious behavior: MapViewOfSection
    ledger.execolorcpl.exe

    Reported IOCs

    pidprocess
    3880ledger.exe
    3880ledger.exe
    3880ledger.exe
    3796colorcpl.exe
    3796colorcpl.exe
  • Suspicious use of AdjustPrivilegeToken
    ledger.execolorcpl.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege3880ledger.exe
    Token: SeDebugPrivilege3796colorcpl.exe
  • Suspicious use of UnmapMainImage
    Explorer.EXE

    Reported IOCs

    pidprocess
    3008Explorer.EXE
  • Suspicious use of WriteProcessMemory
    ledger.exeExplorer.EXEcolorcpl.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 3556 wrote to memory of 38803556ledger.exeledger.exe
    PID 3556 wrote to memory of 38803556ledger.exeledger.exe
    PID 3556 wrote to memory of 38803556ledger.exeledger.exe
    PID 3556 wrote to memory of 38803556ledger.exeledger.exe
    PID 3556 wrote to memory of 38803556ledger.exeledger.exe
    PID 3556 wrote to memory of 38803556ledger.exeledger.exe
    PID 3008 wrote to memory of 37963008Explorer.EXEcolorcpl.exe
    PID 3008 wrote to memory of 37963008Explorer.EXEcolorcpl.exe
    PID 3008 wrote to memory of 37963008Explorer.EXEcolorcpl.exe
    PID 3796 wrote to memory of 38283796colorcpl.execmd.exe
    PID 3796 wrote to memory of 38283796colorcpl.execmd.exe
    PID 3796 wrote to memory of 38283796colorcpl.execmd.exe
Processes 5
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of UnmapMainImage
    Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Local\Temp\ledger.exe
      "C:\Users\Admin\AppData\Local\Temp\ledger.exe"
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Users\Admin\AppData\Local\Temp\ledger.exe
        "C:\Users\Admin\AppData\Local\Temp\ledger.exe"
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        PID:3880
    • C:\Windows\SysWOW64\colorcpl.exe
      "C:\Windows\SysWOW64\colorcpl.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3796
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\ledger.exe"
        PID:3828
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/3008-129-0x0000000002420000-0x00000000024FA000-memory.dmp

                          • memory/3008-136-0x0000000004B90000-0x0000000004CD0000-memory.dmp

                          • memory/3556-117-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

                          • memory/3556-118-0x00000000049E0000-0x00000000049E1000-memory.dmp

                          • memory/3556-121-0x00000000049E0000-0x0000000004EDE000-memory.dmp

                          • memory/3556-122-0x0000000004D40000-0x0000000004D56000-memory.dmp

                          • memory/3556-120-0x00000000081E0000-0x00000000081E1000-memory.dmp

                          • memory/3556-123-0x0000000006950000-0x00000000069B0000-memory.dmp

                          • memory/3556-124-0x00000000069F0000-0x0000000006A1A000-memory.dmp

                          • memory/3556-119-0x00000000049B0000-0x00000000049B1000-memory.dmp

                          • memory/3556-115-0x00000000000C0000-0x00000000000C1000-memory.dmp

                          • memory/3796-134-0x0000000004500000-0x0000000004820000-memory.dmp

                          • memory/3796-133-0x0000000000120000-0x0000000000148000-memory.dmp

                          • memory/3796-132-0x00000000010E0000-0x00000000010F9000-memory.dmp

                          • memory/3796-130-0x0000000000000000-mapping.dmp

                          • memory/3796-135-0x0000000000D40000-0x0000000000DCF000-memory.dmp

                          • memory/3828-131-0x0000000000000000-mapping.dmp

                          • memory/3880-127-0x0000000001680000-0x00000000019A0000-memory.dmp

                          • memory/3880-128-0x00000000015F0000-0x0000000001600000-memory.dmp

                          • memory/3880-125-0x0000000000400000-0x0000000000428000-memory.dmp

                          • memory/3880-126-0x000000000041D040-mapping.dmp