Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 12:39
General
-
Target
5262da4295e8a62d58d17991b35bf860.msi
-
Size
124KB
-
MD5
5262da4295e8a62d58d17991b35bf860
-
SHA1
3fba37528f6b06d2c89c7d86ce6352df438f1855
-
SHA256
058ee0434baf472713da384ee3ba273f64995b9c7f83b7e62a8b3285b334b2cf
-
SHA512
8a82d10997e8b64ab12688e6cb909e405644bfcf2ed0e47df9c16009bf1ae415c17bc5a0cc27717d34f6f5484ca27fe026893b4637ea01cb1209dd0427574c18
Malware Config
Extracted
xloader
2.5
fs3g
http://www.indigenousjobsearch.com/fs3g/
juliorodriguez.info
koglifestylegym.com
matrixrecruits.com
tes5ci.com
firlefanz.digital
funkyladybug.com
susneh.com
polistanok.space
theindiahub.com
bigmargintennis.com
ti-talk.com
onejmj.com
ff4ca2623.xyz
mtzion-tn.com
yidiaodiaosu.com
dadsgaragedoor.com
rigs-4u.com
jiaoyimaojiyu2.xyz
evcay.com
appmxt.com
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Windows directory 8 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\5262da4295e8a62d58d17991b35bf860.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSI73E6.tmp"3⤵
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Installer\MSI73E6.tmp"C:\Windows\Installer\MSI73E6.tmp"2⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI73E6.tmp"C:\Windows\Installer\MSI73E6.tmp"3⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
8c0ef68bfe8b4f2d72ca3599aedb6387
SHA1b6c02d95c26e2ec62ba27d0e4c3cd3b1e7f25261
SHA2564b2a32c7afbfb44a85d88bfd4f0a79306278d880c64a28bf3242dc686665c8fe
SHA51287bf4a30a191e4e7ccc4c17122868a7355d20d4666c954d0229c47bd253077565ee151b33d3a3fff439d56cf0e6360d923055ec7a4993f797a8446a86d29d733
-
MD5
8c0ef68bfe8b4f2d72ca3599aedb6387
SHA1b6c02d95c26e2ec62ba27d0e4c3cd3b1e7f25261
SHA2564b2a32c7afbfb44a85d88bfd4f0a79306278d880c64a28bf3242dc686665c8fe
SHA51287bf4a30a191e4e7ccc4c17122868a7355d20d4666c954d0229c47bd253077565ee151b33d3a3fff439d56cf0e6360d923055ec7a4993f797a8446a86d29d733
-
MD5
8c0ef68bfe8b4f2d72ca3599aedb6387
SHA1b6c02d95c26e2ec62ba27d0e4c3cd3b1e7f25261
SHA2564b2a32c7afbfb44a85d88bfd4f0a79306278d880c64a28bf3242dc686665c8fe
SHA51287bf4a30a191e4e7ccc4c17122868a7355d20d4666c954d0229c47bd253077565ee151b33d3a3fff439d56cf0e6360d923055ec7a4993f797a8446a86d29d733
-
MD5
6a91a8ee63624a7330fb94bec72901ab
SHA1c5dc917235e5ff686b08a95a8fc8d537e59116ec
SHA256cd48a632dc0b0e2be64f032225db1da74055ff252e811ce28eb99851627c4a9c
SHA512c43927f40388f03e36180e6423f3caa45110796702264fb6bacbf85c25235f75f3335a00668fc0ce60d38f19ac2144449ff9b1fb155bb5ee84020826cd96e190
-
MD5
f5e2cb9851638ab00730978be493eb8b
SHA1159fdc66054df82ac164b13221bbd5de7226d85a
SHA256ed39acccd951e33b0d072e8cb23cf1e56c1a2ac39b5e6a3963588273bce37927
SHA5127bc219725c46c5c81b86a84acec15901613174da2d8fc7384629fa4029d54072d0b6371ba559a7a8e4002f404d6cb957109893ff56f263a43808423196502438
-
-
Filesize
24KB
-
Filesize
40KB
-
Filesize
1.9MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
1.3MB
-
Filesize
1024KB
-
Filesize
1.9MB
-
Filesize
1008KB
-
Filesize
1.3MB
-
Filesize
1.2MB
-
-
Filesize
1.6MB
-
Filesize
3.1MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.5MB
-
Filesize
1.6MB
-
-
-
Filesize
88KB
-
Filesize
164KB
-
Filesize
3.1MB
-
Filesize
576KB
-
Filesize
8KB
-
Filesize
8KB