Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-en-20210916
  • submitted
    17-09-2021 18:06

General

  • Target

    Orsha_NSC Contract 290720 Order for new shipment.xlsx

  • Size

    556KB

  • MD5

    72d057ebfb1aa881ffee0cae72724866

  • SHA1

    a35397bed6c5368e2b9196557af225222163faf2

  • SHA256

    1707f694fc15ee93a6f06725c6a4cfe1283f6553a442a957f7b5fc646f003466

  • SHA512

    6b867c53a4ee8e1f844f170c17d98071cb11e75ef0b9ea735cc2eb8bc37d9f61223f37736ecc59010f414c91f0097da0411df6eec354d4b619d379c47295ed62

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

b6a4

C2

http://www.helpmovingandstorage.com/b6a4/

Decoy

gr2future.com

asteroid.finance

skoba-plast.com

rnerfrfw5z3ki.net

thesmartroadtoretirement.com

avisdrummondhomes.com

banban365.net

profesyonelkampcadiri.net

royalloanhs.com

yulujy.com

xn--naqejahan-n3b.com

msalee.net

dollyvee.com

albertagamehawkersclub.com

cbspecialists.com

findingforeverrealty.com

mrtireshop.com

wadamasanari.com

growtechinfo.com

qipai039.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 14 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\Orsha_NSC Contract 290720 Order for new shipment.xlsx"
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1932
    • C:\Windows\SysWOW64\wininit.exe
      "C:\Windows\SysWOW64\wininit.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:756
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Launches Equation Editor
    • Suspicious use of WriteProcessMemory
    PID:1100
    • C:\Users\Public\vbc.exe
      "C:\Users\Public\vbc.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1480
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1032

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Public\vbc.exe
    MD5

    de8a80136d8b6c2002ba8473bda2a617

    SHA1

    6ccca366fd276d0bff3197b02bfb8c192fe75cb3

    SHA256

    4e18d364c4fa2db105557cf8105e5e3d77c9d7a06590b4f897051f99014da5be

    SHA512

    d93ca922a818f387312a317ef84e22d88ac9c091a8ddb85c742983fa37801614681d22b842aacd66f6d66621700a0e4eeacc632428303f8db6c7bd0f8d607875

  • C:\Users\Public\vbc.exe
    MD5

    de8a80136d8b6c2002ba8473bda2a617

    SHA1

    6ccca366fd276d0bff3197b02bfb8c192fe75cb3

    SHA256

    4e18d364c4fa2db105557cf8105e5e3d77c9d7a06590b4f897051f99014da5be

    SHA512

    d93ca922a818f387312a317ef84e22d88ac9c091a8ddb85c742983fa37801614681d22b842aacd66f6d66621700a0e4eeacc632428303f8db6c7bd0f8d607875

  • C:\Users\Public\vbc.exe
    MD5

    de8a80136d8b6c2002ba8473bda2a617

    SHA1

    6ccca366fd276d0bff3197b02bfb8c192fe75cb3

    SHA256

    4e18d364c4fa2db105557cf8105e5e3d77c9d7a06590b4f897051f99014da5be

    SHA512

    d93ca922a818f387312a317ef84e22d88ac9c091a8ddb85c742983fa37801614681d22b842aacd66f6d66621700a0e4eeacc632428303f8db6c7bd0f8d607875

  • \Users\Admin\AppData\Local\Temp\nsqDDC1.tmp\tkxaz.dll
    MD5

    220b53f6a42f8f23f16378c8330763d1

    SHA1

    02078dc5f0d573ba4c7bb24f69c7218f31987be6

    SHA256

    3c470a8a1732a7e3e06cd561f5566c192f851e763b3694d84f546fe8ba379637

    SHA512

    6f442f207deaabb292851abae4d7c372504aa61a1ccfdce6d6f5b5d9d00fff681ff3a458731e47d227404a9bbab6f7fc61493a98075fac33db89766064cbb6f2

  • \Users\Public\vbc.exe
    MD5

    de8a80136d8b6c2002ba8473bda2a617

    SHA1

    6ccca366fd276d0bff3197b02bfb8c192fe75cb3

    SHA256

    4e18d364c4fa2db105557cf8105e5e3d77c9d7a06590b4f897051f99014da5be

    SHA512

    d93ca922a818f387312a317ef84e22d88ac9c091a8ddb85c742983fa37801614681d22b842aacd66f6d66621700a0e4eeacc632428303f8db6c7bd0f8d607875

  • \Users\Public\vbc.exe
    MD5

    de8a80136d8b6c2002ba8473bda2a617

    SHA1

    6ccca366fd276d0bff3197b02bfb8c192fe75cb3

    SHA256

    4e18d364c4fa2db105557cf8105e5e3d77c9d7a06590b4f897051f99014da5be

    SHA512

    d93ca922a818f387312a317ef84e22d88ac9c091a8ddb85c742983fa37801614681d22b842aacd66f6d66621700a0e4eeacc632428303f8db6c7bd0f8d607875

  • \Users\Public\vbc.exe
    MD5

    de8a80136d8b6c2002ba8473bda2a617

    SHA1

    6ccca366fd276d0bff3197b02bfb8c192fe75cb3

    SHA256

    4e18d364c4fa2db105557cf8105e5e3d77c9d7a06590b4f897051f99014da5be

    SHA512

    d93ca922a818f387312a317ef84e22d88ac9c091a8ddb85c742983fa37801614681d22b842aacd66f6d66621700a0e4eeacc632428303f8db6c7bd0f8d607875

  • \Users\Public\vbc.exe
    MD5

    de8a80136d8b6c2002ba8473bda2a617

    SHA1

    6ccca366fd276d0bff3197b02bfb8c192fe75cb3

    SHA256

    4e18d364c4fa2db105557cf8105e5e3d77c9d7a06590b4f897051f99014da5be

    SHA512

    d93ca922a818f387312a317ef84e22d88ac9c091a8ddb85c742983fa37801614681d22b842aacd66f6d66621700a0e4eeacc632428303f8db6c7bd0f8d607875

  • memory/756-78-0x0000000000710000-0x000000000072A000-memory.dmp
    Filesize

    104KB

  • memory/756-79-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

  • memory/756-80-0x0000000001E00000-0x0000000002103000-memory.dmp
    Filesize

    3.0MB

  • memory/756-81-0x0000000001D30000-0x0000000001DBF000-memory.dmp
    Filesize

    572KB

  • memory/756-77-0x0000000000000000-mapping.dmp
  • memory/1032-68-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1032-66-0x000000000041D0B0-mapping.dmp
  • memory/1032-70-0x0000000000270000-0x0000000000280000-memory.dmp
    Filesize

    64KB

  • memory/1032-69-0x0000000000990000-0x0000000000C93000-memory.dmp
    Filesize

    3.0MB

  • memory/1100-56-0x0000000076871000-0x0000000076873000-memory.dmp
    Filesize

    8KB

  • memory/1244-71-0x00000000044E0000-0x000000000459C000-memory.dmp
    Filesize

    752KB

  • memory/1244-82-0x0000000006B80000-0x0000000006CC8000-memory.dmp
    Filesize

    1.3MB

  • memory/1480-61-0x0000000000000000-mapping.dmp
  • memory/1932-76-0x0000000005C40000-0x000000000688A000-memory.dmp
    Filesize

    12.3MB

  • memory/1932-53-0x000000002F9A1000-0x000000002F9A4000-memory.dmp
    Filesize

    12KB

  • memory/1932-75-0x0000000005C40000-0x000000000688A000-memory.dmp
    Filesize

    12.3MB

  • memory/1932-74-0x0000000005C40000-0x000000000688A000-memory.dmp
    Filesize

    12.3MB

  • memory/1932-73-0x0000000005C40000-0x000000000688A000-memory.dmp
    Filesize

    12.3MB

  • memory/1932-55-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB

  • memory/1932-54-0x0000000071D91000-0x0000000071D93000-memory.dmp
    Filesize

    8KB

  • memory/1932-72-0x0000000005C40000-0x000000000688A000-memory.dmp
    Filesize

    12.3MB

  • memory/1932-83-0x000000005FFF0000-0x0000000060000000-memory.dmp
    Filesize

    64KB