Resubmissions

24-09-2021 07:31

210924-jcrrsagce4 10

24-09-2021 00:48

210924-a5ztesfdh9 10

Analysis

  • max time kernel
    302s
  • max time network
    302s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    24-09-2021 00:48

General

  • Target

    QUOTATION '.exe

  • Size

    885KB

  • MD5

    2fdc9cdf35cbdd01b4f61eaa4d8d38a6

  • SHA1

    a59e65c3ecc0c3f586bece4db3a085734c3e4da5

  • SHA256

    c7e4871bd8e22a0dfd8116206cff6631ca4a91857df75017b890768da0730041

  • SHA512

    122adec9d2185d0327f4d07b466e71a55f2689216009325aa5ffd62eb8247654a8dd659031cf07197151f1c17e654a8e4f3e343a04ad61efd5def1340bf97201

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

c2ue

C2

http://www.heidevelop.xyz/c2ue/

Decoy

isportdata.com

stellarex.energy

hsucollections.com

menuhaisan.com

joe-tzu.com

lumichargemktg.com

uae.tires

rapidcae.com

softwaresystemsolutions.com

s-galaxy.website

daewon-talks.net

northgamesnetwork.com

catalogue-bouyguestele.com

criativanet.com

theseasonalshift.com

actionfoto.online

openmaildoe.com

trashpenguin.com

ennopure.net

azurermine.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\QUOTATION '.exe
      "C:\Users\Admin\AppData\Local\Temp\QUOTATION '.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:784
      • C:\Users\Admin\AppData\Local\Temp\QUOTATION '.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1736
        • C:\Windows\SysWOW64\chkdsk.exe
          "C:\Windows\SysWOW64\chkdsk.exe"
          4⤵
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Drops file in Program Files directory
          • Enumerates system info in registry
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2020
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION '.exe"
            5⤵
            • Deletes itself
            PID:1252
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            5⤵
              PID:1516
      • C:\Program Files (x86)\G5jgl2x_h\regsvcpbctjlp.exe
        "C:\Program Files (x86)\G5jgl2x_h\regsvcpbctjlp.exe"
        2⤵
        • Executes dropped EXE
        PID:1924

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    2
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\G5jgl2x_h\regsvcpbctjlp.exe
      MD5

      2fdc9cdf35cbdd01b4f61eaa4d8d38a6

      SHA1

      a59e65c3ecc0c3f586bece4db3a085734c3e4da5

      SHA256

      c7e4871bd8e22a0dfd8116206cff6631ca4a91857df75017b890768da0730041

      SHA512

      122adec9d2185d0327f4d07b466e71a55f2689216009325aa5ffd62eb8247654a8dd659031cf07197151f1c17e654a8e4f3e343a04ad61efd5def1340bf97201

    • C:\Program Files (x86)\G5jgl2x_h\regsvcpbctjlp.exe
      MD5

      2fdc9cdf35cbdd01b4f61eaa4d8d38a6

      SHA1

      a59e65c3ecc0c3f586bece4db3a085734c3e4da5

      SHA256

      c7e4871bd8e22a0dfd8116206cff6631ca4a91857df75017b890768da0730041

      SHA512

      122adec9d2185d0327f4d07b466e71a55f2689216009325aa5ffd62eb8247654a8dd659031cf07197151f1c17e654a8e4f3e343a04ad61efd5def1340bf97201

    • memory/784-60-0x0000000000E40000-0x0000000000E41000-memory.dmp
      Filesize

      4KB

    • memory/784-62-0x0000000004E60000-0x0000000004E61000-memory.dmp
      Filesize

      4KB

    • memory/784-63-0x00000000003A0000-0x00000000003AE000-memory.dmp
      Filesize

      56KB

    • memory/784-64-0x0000000005280000-0x00000000052FD000-memory.dmp
      Filesize

      500KB

    • memory/784-65-0x0000000000E00000-0x0000000000E2B000-memory.dmp
      Filesize

      172KB

    • memory/1180-70-0x0000000004C60000-0x0000000004D0C000-memory.dmp
      Filesize

      688KB

    • memory/1180-72-0x0000000007420000-0x00000000075A3000-memory.dmp
      Filesize

      1MB

    • memory/1180-79-0x0000000004E70000-0x0000000004F4D000-memory.dmp
      Filesize

      884KB

    • memory/1252-77-0x0000000000000000-mapping.dmp
    • memory/1516-88-0x0000000000000000-mapping.dmp
    • memory/1516-89-0x000000013FB90000-0x000000013FC23000-memory.dmp
      Filesize

      588KB

    • memory/1516-90-0x00000000024E0000-0x000000000266A000-memory.dmp
      Filesize

      1MB

    • memory/1736-69-0x0000000000150000-0x0000000000161000-memory.dmp
      Filesize

      68KB

    • memory/1736-71-0x0000000000380000-0x0000000000391000-memory.dmp
      Filesize

      68KB

    • memory/1736-66-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1736-67-0x000000000041D3A0-mapping.dmp
    • memory/1736-68-0x0000000000900000-0x0000000000C03000-memory.dmp
      Filesize

      3MB

    • memory/1924-86-0x0000000004510000-0x0000000004511000-memory.dmp
      Filesize

      4KB

    • memory/1924-81-0x0000000000000000-mapping.dmp
    • memory/1924-84-0x0000000000810000-0x0000000000811000-memory.dmp
      Filesize

      4KB

    • memory/2020-78-0x0000000001EE0000-0x0000000001F70000-memory.dmp
      Filesize

      576KB

    • memory/2020-73-0x0000000000000000-mapping.dmp
    • memory/2020-80-0x0000000075211000-0x0000000075213000-memory.dmp
      Filesize

      8KB

    • memory/2020-76-0x0000000000110000-0x0000000000139000-memory.dmp
      Filesize

      164KB

    • memory/2020-75-0x0000000002040000-0x0000000002343000-memory.dmp
      Filesize

      3MB

    • memory/2020-74-0x0000000000960000-0x0000000000967000-memory.dmp
      Filesize

      28KB