ledger.exe

General
Target

ledger.exe

Filesize

746KB

Completed

24-09-2021 12:44

Score
10 /10
MD5

bb7bbc40aef8439092e6345d3428c975

SHA1

9bf46b95ff700e57bc0e38d5133577bfad260ea2

SHA256

b194903f2fb1231113b2cffdd6cf47e25d4d9f99675654f70865b1f3d0a9160c

Malware Config

Extracted

Family xloader
Version 2.3
Campaign n58i
C2

http://www.biosonicmicrocurrent.com/n58i/

Decoy

electrifyz.com

silkpetalz.net

cognitivenavigation.com

poophaikus.com

orchidiris.com

arteregalos.com

dailybookmarks.info

gogoanume.pro

hushmailgmx.com

trjisa.com

notontrend.com

2020polltax.com

orderhappy.club

panggabean.net

govsathi.com

hrsbxg.com

xvideotokyo.online

lotteplaze.com

lovecleanliveclean.com

swaphomeloans.net

arcadems.info

creatingstrongerathletes.com

follaproperties.com

i-postgram.com

bootybella.fitness

avtofan.net

bimbavbi.com

yourtravelsbuddy.com

laiofit.com

ofnick.com

2g6gc6zma9g.net

phamthanhdam.com

shopteve.com

add-fast.com

studioloungemke.com

maxtoutfitness.com

mapleway.systems

login-settings.com

affoshop.com

hupubets.com

3energyservices.com

ccmfonline.com

keyhousebuyers.com

curvecue.com

developerdevelopment.com

jamesdunnandsons.com

devyassine.com

dongyilove.com

alienpuran.com

tuolp.com

Signatures 11

Filter: none

  • Xloader

    Description

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/316-59-0x0000000000400000-0x0000000000428000-memory.dmpxloader
    behavioral1/memory/316-60-0x000000000041D040-mapping.dmpxloader
    behavioral1/memory/368-70-0x0000000000130000-0x0000000000158000-memory.dmpxloader
  • Deletes itself
    cmd.exe

    Reported IOCs

    pidprocess
    740cmd.exe
  • Suspicious use of SetThreadContext
    ledger.exeledger.execmstp.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1392 set thread context of 3161392ledger.exeledger.exe
    PID 316 set thread context of 1404316ledger.exeExplorer.EXE
    PID 316 set thread context of 1404316ledger.exeExplorer.EXE
    PID 368 set thread context of 1404368cmstp.exeExplorer.EXE
  • Suspicious behavior: EnumeratesProcesses
    ledger.execmstp.exe

    Reported IOCs

    pidprocess
    316ledger.exe
    316ledger.exe
    316ledger.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
    368cmstp.exe
  • Suspicious behavior: GetForegroundWindowSpam
    Explorer.EXE

    Reported IOCs

    pidprocess
    1404Explorer.EXE
  • Suspicious behavior: MapViewOfSection
    ledger.execmstp.exe

    Reported IOCs

    pidprocess
    316ledger.exe
    316ledger.exe
    316ledger.exe
    316ledger.exe
    368cmstp.exe
    368cmstp.exe
  • Suspicious use of AdjustPrivilegeToken
    ledger.execmstp.exeExplorer.EXE

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege316ledger.exe
    Token: SeDebugPrivilege368cmstp.exe
    Token: SeShutdownPrivilege1404Explorer.EXE
  • Suspicious use of FindShellTrayWindow
    Explorer.EXE

    Reported IOCs

    pidprocess
    1404Explorer.EXE
    1404Explorer.EXE
  • Suspicious use of SendNotifyMessage
    Explorer.EXE

    Reported IOCs

    pidprocess
    1404Explorer.EXE
    1404Explorer.EXE
  • Suspicious use of WriteProcessMemory
    ledger.exeExplorer.EXEcmstp.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1392 wrote to memory of 3161392ledger.exeledger.exe
    PID 1392 wrote to memory of 3161392ledger.exeledger.exe
    PID 1392 wrote to memory of 3161392ledger.exeledger.exe
    PID 1392 wrote to memory of 3161392ledger.exeledger.exe
    PID 1392 wrote to memory of 3161392ledger.exeledger.exe
    PID 1392 wrote to memory of 3161392ledger.exeledger.exe
    PID 1392 wrote to memory of 3161392ledger.exeledger.exe
    PID 1404 wrote to memory of 3681404Explorer.EXEcmstp.exe
    PID 1404 wrote to memory of 3681404Explorer.EXEcmstp.exe
    PID 1404 wrote to memory of 3681404Explorer.EXEcmstp.exe
    PID 1404 wrote to memory of 3681404Explorer.EXEcmstp.exe
    PID 1404 wrote to memory of 3681404Explorer.EXEcmstp.exe
    PID 1404 wrote to memory of 3681404Explorer.EXEcmstp.exe
    PID 1404 wrote to memory of 3681404Explorer.EXEcmstp.exe
    PID 368 wrote to memory of 740368cmstp.execmd.exe
    PID 368 wrote to memory of 740368cmstp.execmd.exe
    PID 368 wrote to memory of 740368cmstp.execmd.exe
    PID 368 wrote to memory of 740368cmstp.execmd.exe
Processes 5
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    Suspicious behavior: GetForegroundWindowSpam
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Users\Admin\AppData\Local\Temp\ledger.exe
      "C:\Users\Admin\AppData\Local\Temp\ledger.exe"
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1392
      • C:\Users\Admin\AppData\Local\Temp\ledger.exe
        "C:\Users\Admin\AppData\Local\Temp\ledger.exe"
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: MapViewOfSection
        Suspicious use of AdjustPrivilegeToken
        PID:316
    • C:\Windows\SysWOW64\cmstp.exe
      "C:\Windows\SysWOW64\cmstp.exe"
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:368
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\ledger.exe"
        Deletes itself
        PID:740
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/316-60-0x000000000041D040-mapping.dmp

                          • memory/316-62-0x0000000000120000-0x0000000000130000-memory.dmp

                          • memory/316-61-0x0000000000950000-0x0000000000C53000-memory.dmp

                          • memory/316-64-0x00000000001A0000-0x00000000001B0000-memory.dmp

                          • memory/316-59-0x0000000000400000-0x0000000000428000-memory.dmp

                          • memory/368-68-0x0000000000C00000-0x0000000000C18000-memory.dmp

                          • memory/368-66-0x0000000000000000-mapping.dmp

                          • memory/368-70-0x0000000000130000-0x0000000000158000-memory.dmp

                          • memory/368-69-0x0000000002020000-0x0000000002323000-memory.dmp

                          • memory/368-72-0x0000000000970000-0x00000000009FF000-memory.dmp

                          • memory/368-67-0x00000000751D1000-0x00000000751D3000-memory.dmp

                          • memory/740-71-0x0000000000000000-mapping.dmp

                          • memory/1392-53-0x00000000010D0000-0x00000000010D1000-memory.dmp

                          • memory/1392-58-0x00000000049A0000-0x00000000049CA000-memory.dmp

                          • memory/1392-57-0x0000000004C50000-0x0000000004CB0000-memory.dmp

                          • memory/1392-56-0x0000000000600000-0x0000000000616000-memory.dmp

                          • memory/1392-55-0x0000000001090000-0x0000000001091000-memory.dmp

                          • memory/1404-65-0x0000000007160000-0x00000000072DE000-memory.dmp

                          • memory/1404-63-0x0000000006FC0000-0x0000000007153000-memory.dmp

                          • memory/1404-73-0x0000000008E40000-0x0000000008FBA000-memory.dmp