Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
19-10-2021 14:50
General
-
Target
t1.msi
-
Size
124KB
-
MD5
5262da4295e8a62d58d17991b35bf860
-
SHA1
3fba37528f6b06d2c89c7d86ce6352df438f1855
-
SHA256
058ee0434baf472713da384ee3ba273f64995b9c7f83b7e62a8b3285b334b2cf
-
SHA512
8a82d10997e8b64ab12688e6cb909e405644bfcf2ed0e47df9c16009bf1ae415c17bc5a0cc27717d34f6f5484ca27fe026893b4637ea01cb1209dd0427574c18
Malware Config
Extracted
xloader
2.5
fs3g
http://www.indigenousjobsearch.com/fs3g/
juliorodriguez.info
koglifestylegym.com
matrixrecruits.com
tes5ci.com
firlefanz.digital
funkyladybug.com
susneh.com
polistanok.space
theindiahub.com
bigmargintennis.com
ti-talk.com
onejmj.com
ff4ca2623.xyz
mtzion-tn.com
yidiaodiaosu.com
dadsgaragedoor.com
rigs-4u.com
jiaoyimaojiyu2.xyz
evcay.com
appmxt.com
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Checks QEMU agent file 2 TTPs 2 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
-
Loads dropped DLL 1 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Drops file in Windows directory 8 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 63 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\t1.msi2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Installer\MSI316E.tmp"C:\Windows\Installer\MSI316E.tmp"2⤵
- Executes dropped EXE
- Checks QEMU agent file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Installer\MSI316E.tmp"C:\Windows\Installer\MSI316E.tmp"3⤵
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Installer\MSI316E.tmp"5⤵
-
-
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
8c0ef68bfe8b4f2d72ca3599aedb6387
SHA1b6c02d95c26e2ec62ba27d0e4c3cd3b1e7f25261
SHA2564b2a32c7afbfb44a85d88bfd4f0a79306278d880c64a28bf3242dc686665c8fe
SHA51287bf4a30a191e4e7ccc4c17122868a7355d20d4666c954d0229c47bd253077565ee151b33d3a3fff439d56cf0e6360d923055ec7a4993f797a8446a86d29d733
-
MD5
8c0ef68bfe8b4f2d72ca3599aedb6387
SHA1b6c02d95c26e2ec62ba27d0e4c3cd3b1e7f25261
SHA2564b2a32c7afbfb44a85d88bfd4f0a79306278d880c64a28bf3242dc686665c8fe
SHA51287bf4a30a191e4e7ccc4c17122868a7355d20d4666c954d0229c47bd253077565ee151b33d3a3fff439d56cf0e6360d923055ec7a4993f797a8446a86d29d733
-
MD5
8c0ef68bfe8b4f2d72ca3599aedb6387
SHA1b6c02d95c26e2ec62ba27d0e4c3cd3b1e7f25261
SHA2564b2a32c7afbfb44a85d88bfd4f0a79306278d880c64a28bf3242dc686665c8fe
SHA51287bf4a30a191e4e7ccc4c17122868a7355d20d4666c954d0229c47bd253077565ee151b33d3a3fff439d56cf0e6360d923055ec7a4993f797a8446a86d29d733
-
MD5
f63a931af5eff956e83862763d34327e
SHA18eb30760a9015dec37f5cc2e41f639f366405ba4
SHA2566f84e06e3ac047aaf1ffb39bebcfb9cd0ac875ad46ef6f1fd37987a433eb11c3
SHA5129f8218a7bc2a2b857f1a95c1a0efd892ee7132df9cd17187cb61f61e9fa54e2e2df74ac185bbede682cbc3410b27de98e9ac887e72d71b46c6ff2a220bd0a7ce
-
MD5
3155e10635155fe1dc982d2baf697ad7
SHA1277566fdcb73769b93f9fe3066a35d7e96a1068a
SHA2561d0075d288c4545d6ff442f3749b863d3f522750a862a2343636e32cfe7eea6a
SHA5126001a3434e0fbfd1a8a447215fab137383252dcdcc32303e0d474f4255cad130db2debc770f5868577d0e91a24f2b509179c1bb1a58f695b1a22b642833d5210
-
-
Filesize
1.6MB
-
-
Filesize
24KB
-
Filesize
40KB
-
Filesize
1.9MB
-
Filesize
1.6MB
-
Filesize
68KB
-
Filesize
1008KB
-
Filesize
3.1MB
-
Filesize
1.3MB
-
-
Filesize
68KB
-
Filesize
1.2MB
-
Filesize
1024KB
-
Filesize
68KB
-
Filesize
1.9MB
-
Filesize
1.6MB
-
Filesize
1.2MB
-
Filesize
1.3MB
-
Filesize
1.6MB
-
Filesize
1.3MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
8KB
-
-
Filesize
8KB
-
Filesize
8KB
-
-
Filesize
120KB
-
Filesize
164KB
-
Filesize
3.1MB
-
Filesize
576KB