Analysis
- max time kernel
147s - max time network
132s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
05/10/2021, 13:54
General
- Target FanCourier54488203expediere doc202177.exe
- Size 260KB
- Sample211005-q7kehsacar
- SHA256 bf8bfab0557ff010ee03db046d493da9b0deeaa5e5fb55d9e5750f280a0289ac
Malware Config
Extracted
-
xloader
-
2.5
-
ni8b
-
http://www.nottryingdoing.com/ni8b/
-
billaning.com
-
nhmingwei.com
-
sapphiremodule.com
-
533washingtonave.com
-
dlscord-partners.com
-
303cf.com
-
hooleyfamilygoods.com
-
productiongv.com
-
intaom.com
-
juanmarket.net
-
thecrystalconsciousness.com
-
sgosthirxz.sbs
-
solobookings.com
-
formulaonline.xyz
-
gulliblegirls.com
-
pureselva.com
-
rusporn.xxx
-
ed-institute.com
-
serviciosgeneralesjba.online
-
4x4pac.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 30 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FanCourier54488203expediere doc202177.exe"C:\Users\Admin\AppData\Local\Temp\FanCourier54488203expediere doc202177.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FanCourier54488203expediere doc202177.exe"C:\Users\Admin\AppData\Local\Temp\FanCourier54488203expediere doc202177.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\FanCourier54488203expediere doc202177.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1244-59-0x0000000004AB0000-0x0000000004B8D000-memory.dmp
memory/1244-68-0x0000000006010000-0x000000000610B000-memory.dmp
memory/1324-53-0x0000000075661000-0x0000000075663000-memory.dmp
memory/1584-57-0x0000000000700000-0x0000000000A03000-memory.dmp
memory/1584-58-0x0000000000260000-0x0000000000271000-memory.dmp
memory/1584-55-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1640-62-0x0000000074F01000-0x0000000074F03000-memory.dmp
memory/1640-64-0x0000000000E70000-0x00000000010F1000-memory.dmp
memory/1640-66-0x0000000002500000-0x0000000002803000-memory.dmp
memory/1640-65-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1640-67-0x0000000000AB0000-0x0000000000B40000-memory.dmp