Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    15-09-2021 08:10

General

  • Target

    pay.exe

  • Size

    493KB

  • MD5

    d08e51116e789fa67fd4d535ad4f399b

  • SHA1

    1d7d28fb75910f580d75167c0b30ebadd79fe8ca

  • SHA256

    7deecd8502e99ced6aec8588840f7e972a3b030c19e0e88ef94ec3a9d2ababc9

  • SHA512

    6a576a4765cd48138989742cad201abc09941290d70459b13e9dbe3680fe6b291a4a422fbc7dfc4c26e0b554794015194f78c6d2e2082053ba9c1a2a9313bfa1

Malware Config

Extracted

Family

xloader

Version

2.4

Campaign

t75f

C2

http://www.438451.com/t75f/

Decoy

ice-lemon.pro

ar3spro.cloud

9055837.com

fucksociety.net

prettyofficialx.com

mfxw.xyz

relationshipquiz.info

customia.xyz

juanayjuan.com

zidiankj.com

facture-booking.com

secondmining.store

aboutyou.club

gongxichen.com

laurabraincreative.com

pierrot-bros.com

saintpaulaccountingservices.com

dom-maya.com

garderobamarzen.net

la-salamandre-assurances.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Users\Admin\AppData\Local\Temp\pay.exe
      "C:\Users\Admin\AppData\Local\Temp\pay.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4716
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:4840
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:4848
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\SysWOW64\cscript.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4888
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          3⤵
            PID:4928

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3008-129-0x0000000006760000-0x00000000068B8000-memory.dmp
        Filesize

        1.3MB

      • memory/3008-136-0x00000000057D0000-0x0000000005958000-memory.dmp
        Filesize

        1.5MB

      • memory/4716-117-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
        Filesize

        4KB

      • memory/4716-118-0x00000000049B0000-0x00000000049B1000-memory.dmp
        Filesize

        4KB

      • memory/4716-119-0x00000000048D0000-0x0000000004962000-memory.dmp
        Filesize

        584KB

      • memory/4716-120-0x0000000004970000-0x0000000004971000-memory.dmp
        Filesize

        4KB

      • memory/4716-121-0x0000000004C40000-0x0000000004C41000-memory.dmp
        Filesize

        4KB

      • memory/4716-122-0x0000000004B10000-0x0000000004B17000-memory.dmp
        Filesize

        28KB

      • memory/4716-123-0x0000000005680000-0x00000000056DC000-memory.dmp
        Filesize

        368KB

      • memory/4716-124-0x0000000007BD0000-0x0000000007BFB000-memory.dmp
        Filesize

        172KB

      • memory/4716-115-0x00000000000B0000-0x00000000000B1000-memory.dmp
        Filesize

        4KB

      • memory/4848-126-0x000000000041D410-mapping.dmp
      • memory/4848-127-0x00000000009A0000-0x0000000000CC0000-memory.dmp
        Filesize

        3.1MB

      • memory/4848-128-0x0000000000E70000-0x0000000000E81000-memory.dmp
        Filesize

        68KB

      • memory/4848-125-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

      • memory/4888-130-0x0000000000000000-mapping.dmp
      • memory/4888-131-0x0000000000850000-0x0000000000877000-memory.dmp
        Filesize

        156KB

      • memory/4888-132-0x0000000002990000-0x00000000029B9000-memory.dmp
        Filesize

        164KB

      • memory/4888-134-0x0000000004BD0000-0x0000000004EF0000-memory.dmp
        Filesize

        3.1MB

      • memory/4888-135-0x0000000004A20000-0x0000000004AB0000-memory.dmp
        Filesize

        576KB

      • memory/4928-133-0x0000000000000000-mapping.dmp