Overview

overview

10

Static

static

1

Famex0002345.exe

windows7_x64

10

Famex0002345.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    23-09-2021 10:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Famex0002345.exe

  • Size

    369KB

  • MD5

    e4e56f7fefe037591b5115092d6ee990

  • SHA1

    b8d25f0e321c32e22af6df64d513c1d88e9f592c

  • SHA256

    e881ca5d0fedf03389648c542b240467572cb0c1ffae147d30c0e2d521f53862

  • SHA512

    c90369ee2284a101d964a850bca76f18608eed6c74c6f38f4e457006a227b9b504e22ebdddaed267e69293d98fe1e2d7c9f2e18fc213b1aeeb55243a4295dd02

Score
10/10
xloaderdhualoaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dhua

C2

http://www.segurosramosroman.com/dhua/

Decoy

ketostar.club

icanmakeyoufamous.com

claimygdejection.com

garlicinterestedparent.xyz

bits-clicks.com

030atk.xyz

ballwiegand.com

logs-illumidesk.com

785686.com

flnewsfeed.com

transporteshrj.net

agenciamundodigital.online

bowersllc.com

urchncenw.com

wuauwuaumx.com

littlesportsacademy.com

xn--m3chb3ax0abdta3fwhk.com

prmarketings.com

jiaozhanlianmeng.com

whenisthestore.space

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata
  • Xloader Payload 3 IoCs
    rat
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\Famex0002345.exe
      "C:\Users\Admin\AppData\Local\Temp\Famex0002345.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:4648
      • C:\Users\Admin\AppData\Local\Temp\Famex0002345.exe
        "C:\Users\Admin\AppData\Local\Temp\Famex0002345.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4680
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Gathers network information
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4708
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Famex0002345.exe"
        3⤵
          PID:4740

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Command-Line Interface

    1
    T1059

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nso54C3.tmp\nbjkg.dll
      MD5

      ff488c7d8f8f03c34e67a7ac3ebeaafe

      SHA1

      bbc4aacac09047d12f6ea5b54a24255e9389ba0e

      SHA256

      b6f7a133237e590893ca7e6aceb76d96c8bfff8c767dcd4db53a57b366366dfa

      SHA512

      9955013d4f601507ab35453a5b38063cadd2f75946ed998169d7fc42fe133deed31a0927693c8f131161df5281e0a2499b2b37359f7662b3e948c2cf407e11f1

      Download Submit
    • memory/3048-126-0x0000000006150000-0x000000000626F000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/3048-119-0x0000000009040000-0x00000000091DD000-memory.dmp
      Filesize

      1.6MB

      Download
    • memory/4680-115-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

      Download
    • memory/4680-116-0x000000000041D4E0-mapping.dmp
      Download
    • memory/4680-117-0x0000000000AC0000-0x0000000000DE0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/4680-118-0x0000000000A00000-0x0000000000A11000-memory.dmp
      Filesize

      68KB

      Download
    • memory/4708-120-0x0000000000000000-mapping.dmp
      Download
    • memory/4708-122-0x0000000000FA0000-0x0000000000FAB000-memory.dmp
      Filesize

      44KB

      Download
    • memory/4708-123-0x0000000000AD0000-0x0000000000AF9000-memory.dmp
      Filesize

      164KB

      Download
    • memory/4708-124-0x0000000002FB0000-0x00000000032D0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/4708-125-0x0000000000D20000-0x0000000000DB0000-memory.dmp
      Filesize

      576KB

      Download
    • memory/4740-121-0x0000000000000000-mapping.dmp
      Download