Resubmissions

24-09-2021 07:31

210924-jcrrsagce4 10

24-09-2021 00:48

210924-a5ztesfdh9 10

Analysis

  • max time kernel
    300s
  • max time network
    301s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    24-09-2021 00:48

General

  • Target

    QUOTATION '.exe

  • Size

    885KB

  • MD5

    2fdc9cdf35cbdd01b4f61eaa4d8d38a6

  • SHA1

    a59e65c3ecc0c3f586bece4db3a085734c3e4da5

  • SHA256

    c7e4871bd8e22a0dfd8116206cff6631ca4a91857df75017b890768da0730041

  • SHA512

    122adec9d2185d0327f4d07b466e71a55f2689216009325aa5ffd62eb8247654a8dd659031cf07197151f1c17e654a8e4f3e343a04ad61efd5def1340bf97201

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

c2ue

C2

http://www.heidevelop.xyz/c2ue/

Decoy

isportdata.com

stellarex.energy

hsucollections.com

menuhaisan.com

joe-tzu.com

lumichargemktg.com

uae.tires

rapidcae.com

softwaresystemsolutions.com

s-galaxy.website

daewon-talks.net

northgamesnetwork.com

catalogue-bouyguestele.com

criativanet.com

theseasonalshift.com

actionfoto.online

openmaildoe.com

trashpenguin.com

ennopure.net

azurermine.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Users\Admin\AppData\Local\Temp\QUOTATION '.exe
      "C:\Users\Admin\AppData\Local\Temp\QUOTATION '.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1588
      • C:\Users\Admin\AppData\Local\Temp\QUOTATION '.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3008
    • C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\SysWOW64\wscript.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3108
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION '.exe"
        3⤵
          PID:988
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:580
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            3⤵
              PID:1788
          • C:\Program Files (x86)\Fbdf\rzphtx4hb62.exe
            "C:\Program Files (x86)\Fbdf\rzphtx4hb62.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3836
            • C:\Program Files (x86)\Fbdf\rzphtx4hb62.exe
              "{path}"
              3⤵
              • Executes dropped EXE
              PID:2640
            • C:\Program Files (x86)\Fbdf\rzphtx4hb62.exe
              "{path}"
              3⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:1688

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Defense Evasion

        Modify Registry

        2
        T1112

        Credential Access

        Credentials in Files

        1
        T1081

        Collection

        Data from Local System

        1
        T1005

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Fbdf\rzphtx4hb62.exe
          MD5

          2fdc9cdf35cbdd01b4f61eaa4d8d38a6

          SHA1

          a59e65c3ecc0c3f586bece4db3a085734c3e4da5

          SHA256

          c7e4871bd8e22a0dfd8116206cff6631ca4a91857df75017b890768da0730041

          SHA512

          122adec9d2185d0327f4d07b466e71a55f2689216009325aa5ffd62eb8247654a8dd659031cf07197151f1c17e654a8e4f3e343a04ad61efd5def1340bf97201

        • C:\Program Files (x86)\Fbdf\rzphtx4hb62.exe
          MD5

          2fdc9cdf35cbdd01b4f61eaa4d8d38a6

          SHA1

          a59e65c3ecc0c3f586bece4db3a085734c3e4da5

          SHA256

          c7e4871bd8e22a0dfd8116206cff6631ca4a91857df75017b890768da0730041

          SHA512

          122adec9d2185d0327f4d07b466e71a55f2689216009325aa5ffd62eb8247654a8dd659031cf07197151f1c17e654a8e4f3e343a04ad61efd5def1340bf97201

        • C:\Program Files (x86)\Fbdf\rzphtx4hb62.exe
          MD5

          2fdc9cdf35cbdd01b4f61eaa4d8d38a6

          SHA1

          a59e65c3ecc0c3f586bece4db3a085734c3e4da5

          SHA256

          c7e4871bd8e22a0dfd8116206cff6631ca4a91857df75017b890768da0730041

          SHA512

          122adec9d2185d0327f4d07b466e71a55f2689216009325aa5ffd62eb8247654a8dd659031cf07197151f1c17e654a8e4f3e343a04ad61efd5def1340bf97201

        • C:\Program Files (x86)\Fbdf\rzphtx4hb62.exe
          MD5

          2fdc9cdf35cbdd01b4f61eaa4d8d38a6

          SHA1

          a59e65c3ecc0c3f586bece4db3a085734c3e4da5

          SHA256

          c7e4871bd8e22a0dfd8116206cff6631ca4a91857df75017b890768da0730041

          SHA512

          122adec9d2185d0327f4d07b466e71a55f2689216009325aa5ffd62eb8247654a8dd659031cf07197151f1c17e654a8e4f3e343a04ad61efd5def1340bf97201

        • C:\Users\Admin\AppData\Local\Temp\DB1
          MD5

          b608d407fc15adea97c26936bc6f03f6

          SHA1

          953e7420801c76393902c0d6bb56148947e41571

          SHA256

          b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

          SHA512

          cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

        • memory/580-141-0x0000000000000000-mapping.dmp
        • memory/988-137-0x0000000000000000-mapping.dmp
        • memory/1588-123-0x00000000057F0000-0x00000000057F1000-memory.dmp
          Filesize

          4KB

        • memory/1588-121-0x0000000004D00000-0x0000000004D01000-memory.dmp
          Filesize

          4KB

        • memory/1588-125-0x0000000008970000-0x00000000089ED000-memory.dmp
          Filesize

          500KB

        • memory/1588-126-0x00000000089F0000-0x0000000008A1B000-memory.dmp
          Filesize

          172KB

        • memory/1588-117-0x0000000004D50000-0x0000000004D51000-memory.dmp
          Filesize

          4KB

        • memory/1588-118-0x00000000052F0000-0x00000000052F1000-memory.dmp
          Filesize

          4KB

        • memory/1588-119-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
          Filesize

          4KB

        • memory/1588-120-0x0000000004C70000-0x0000000004D0C000-memory.dmp
          Filesize

          624KB

        • memory/1588-124-0x00000000047A0000-0x00000000047AE000-memory.dmp
          Filesize

          56KB

        • memory/1588-122-0x0000000005010000-0x0000000005011000-memory.dmp
          Filesize

          4KB

        • memory/1588-115-0x0000000000400000-0x0000000000401000-memory.dmp
          Filesize

          4KB

        • memory/1688-165-0x00000000016D0000-0x00000000019F0000-memory.dmp
          Filesize

          3MB

        • memory/1688-163-0x000000000041D3A0-mapping.dmp
        • memory/1788-157-0x000001925D790000-0x000001925D849000-memory.dmp
          Filesize

          740KB

        • memory/1788-155-0x0000000000000000-mapping.dmp
        • memory/1788-156-0x00007FF7C7D50000-0x00007FF7C7DE3000-memory.dmp
          Filesize

          588KB

        • memory/3000-133-0x0000000002670000-0x0000000002756000-memory.dmp
          Filesize

          920KB

        • memory/3000-140-0x00000000049B0000-0x0000000004A59000-memory.dmp
          Filesize

          676KB

        • memory/3000-131-0x0000000005E50000-0x0000000005FE1000-memory.dmp
          Filesize

          1MB

        • memory/3008-129-0x0000000001120000-0x0000000001440000-memory.dmp
          Filesize

          3MB

        • memory/3008-130-0x0000000001000000-0x0000000001011000-memory.dmp
          Filesize

          68KB

        • memory/3008-128-0x000000000041D3A0-mapping.dmp
        • memory/3008-127-0x0000000000400000-0x0000000000429000-memory.dmp
          Filesize

          164KB

        • memory/3008-132-0x0000000002DA0000-0x0000000002DB1000-memory.dmp
          Filesize

          68KB

        • memory/3108-134-0x0000000000000000-mapping.dmp
        • memory/3108-139-0x0000000004D20000-0x0000000004DB0000-memory.dmp
          Filesize

          576KB

        • memory/3108-138-0x0000000004EB0000-0x00000000051D0000-memory.dmp
          Filesize

          3MB

        • memory/3108-135-0x0000000001190000-0x00000000011B7000-memory.dmp
          Filesize

          156KB

        • memory/3108-136-0x0000000000DA0000-0x0000000000DC9000-memory.dmp
          Filesize

          164KB

        • memory/3836-154-0x0000000005250000-0x000000000574E000-memory.dmp
          Filesize

          4MB

        • memory/3836-153-0x0000000005C50000-0x0000000005C51000-memory.dmp
          Filesize

          4KB

        • memory/3836-143-0x0000000000000000-mapping.dmp