Analysis
- max time kernel
153s - max time network
157s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/10/2021, 13:54
Static task
static1
Behavioral task
behavioral1
Sample
FanCourier54488203expediere doc202177.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target FanCourier54488203expediere doc202177.exe
- Size 260KB
- Sample211005-q7kehsacar
- SHA256 bf8bfab0557ff010ee03db046d493da9b0deeaa5e5fb55d9e5750f280a0289ac
- MD5 4c7f34b23f003c872c8f2d05fc76ce15
- SHA1 d9b767d6703a8ed0d99e666c360a104c6dd4c1f9
- SHA512 66f088b1af7283a95696988f2b041a44a33045701e559b31750a0f27f28b3470bb26a089ef256230612f6dc4f47ce110a05d4480279255b037370e894b4c55c9
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
ni8b
C2
-
http://www.nottryingdoing.com/ni8b/
Decoy
-
billaning.com
-
nhmingwei.com
-
sapphiremodule.com
-
533washingtonave.com
-
dlscord-partners.com
-
303cf.com
-
hooleyfamilygoods.com
-
productiongv.com
-
intaom.com
-
juanmarket.net
-
thecrystalconsciousness.com
-
sgosthirxz.sbs
-
solobookings.com
-
formulaonline.xyz
-
gulliblegirls.com
-
pureselva.com
-
rusporn.xxx
-
ed-institute.com
-
serviciosgeneralesjba.online
-
4x4pac.com
-
trpgame.com
-
shopbeerbelly.com
-
box-770.com
-
3tshaircreations.com
-
nstyle.one
-
txsports.club
-
chirmano.com
-
herehardcore.com
-
shoetowers.com
-
flipkartsdealscart.xyz
-
lechila.com
-
aag-trading.com
-
werloshop.com
-
bcmegroupbrd.xyz
-
bogosamba.com
-
sehermughal.com
-
flexzapato.online
-
citestaccnt1631552650.com
-
anisyuko.xyz
-
norllix.com
-
socichat.one
-
mia-mania.net
-
web3designstudio.com
-
eastsidescooters.com
-
mymillionmission.com
-
media777.club
-
undeclined.info
-
zhongrct.com
-
sifangktv.mobi
-
lindseystirlingvip.com
-
kiccleaningservicesfl.com
-
rafaelelais.com
-
davewalkergreenberet.com
-
prideparties.com
-
ouzoudcaro.com
-
ps-sac.com
-
holmdelfirst.com
-
ville-fogalmam.com
-
sellmycarhudsoncounty.com
-
celltecstore.com
-
australiapost.digital
-
rajinderbeas.com
-
cabofishingreport.com
-
purpari.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
resource yara_rule behavioral2/memory/1200-115-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1200-116-0x000000000041D420-mapping.dmp xloader behavioral2/memory/1360-126-0x0000000000940000-0x0000000000969000-memory.dmp xloader - Loads dropped DLL 1 IoCs
pid Process 912 FanCourier54488203expediere doc202177.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 912 set thread context of 1200 912 FanCourier54488203expediere doc202177.exe 68 PID 1200 set thread context of 2740 1200 FanCourier54488203expediere doc202177.exe 12 PID 1200 set thread context of 2740 1200 FanCourier54488203expediere doc202177.exe 12 PID 1360 set thread context of 2740 1360 msiexec.exe 12 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Explorer.EXE - Suspicious behavior: EnumeratesProcesses 60 IoCs
pid Process 1200 FanCourier54488203expediere doc202177.exe 1200 FanCourier54488203expediere doc202177.exe 1200 FanCourier54488203expediere doc202177.exe 1200 FanCourier54488203expediere doc202177.exe 1200 FanCourier54488203expediere doc202177.exe 1200 FanCourier54488203expediere doc202177.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe 1360 msiexec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2740 Explorer.EXE - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1200 FanCourier54488203expediere doc202177.exe 1200 FanCourier54488203expediere doc202177.exe 1200 FanCourier54488203expediere doc202177.exe 1200 FanCourier54488203expediere doc202177.exe 1360 msiexec.exe 1360 msiexec.exe - Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 1200 FanCourier54488203expediere doc202177.exe Token: SeDebugPrivilege 1360 msiexec.exe Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE Token: SeShutdownPrivilege 2740 Explorer.EXE Token: SeCreatePagefilePrivilege 2740 Explorer.EXE - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2740 Explorer.EXE 2740 Explorer.EXE 2740 Explorer.EXE 2740 Explorer.EXE 2740 Explorer.EXE 2740 Explorer.EXE 2740 Explorer.EXE 2740 Explorer.EXE - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 912 wrote to memory of 1200 912 FanCourier54488203expediere doc202177.exe 68 PID 912 wrote to memory of 1200 912 FanCourier54488203expediere doc202177.exe 68 PID 912 wrote to memory of 1200 912 FanCourier54488203expediere doc202177.exe 68 PID 912 wrote to memory of 1200 912 FanCourier54488203expediere doc202177.exe 68 PID 912 wrote to memory of 1200 912 FanCourier54488203expediere doc202177.exe 68 PID 912 wrote to memory of 1200 912 FanCourier54488203expediere doc202177.exe 68 PID 2740 wrote to memory of 1360 2740 Explorer.EXE 69 PID 2740 wrote to memory of 1360 2740 Explorer.EXE 69 PID 2740 wrote to memory of 1360 2740 Explorer.EXE 69 PID 1360 wrote to memory of 1572 1360 msiexec.exe 70 PID 1360 wrote to memory of 1572 1360 msiexec.exe 70 PID 1360 wrote to memory of 1572 1360 msiexec.exe 70
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\FanCourier54488203expediere doc202177.exe"C:\Users\Admin\AppData\Local\Temp\FanCourier54488203expediere doc202177.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\FanCourier54488203expediere doc202177.exe"C:\Users\Admin\AppData\Local\Temp\FanCourier54488203expediere doc202177.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1200
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\FanCourier54488203expediere doc202177.exe"3⤵PID:1572
-
-