Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    20-10-2021 06:31

General

  • Target

    DMS210949 MV LYDERHORN LOW MIX RATIO.xlsx

  • Size

    369KB

  • MD5

    f0431537ea328d693794cc1f76e71d4e

  • SHA1

    9f85f8521124a839bd91c1b30ee3fb069b1e3f9a

  • SHA256

    cbf141a6250e4b1ea84857caf3e715e0341ec4bac8c4f4c72733300a8b67d425

  • SHA512

    62bd083c9553775a624122b89fa1717a92820d49e05f880208baba212c5cb700abaf3dd0645457ef285419087aa601f86efe83b2b3654fb61dfa8923fc90d935

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

fqiq

C2

http://www.esyscoloradosprings.com/fqiq/

Decoy

driventow.com

ipatchwork.today

bolder.equipment

seal-brother.com

mountlaketerraceapartments.com

weeden.xyz

sanlifalan.com

athafood.com

isshinn1.com

creationslazzaroni.com

eclecticrenaissancewoman.com

satellitephonstore.com

cotchildcare.com

yamacorp.digital

ff4cuno43.xyz

quicksticks.community

govindfinance.com

farmersfirstseed.com

megacinema.club

tablescaperendezvous4two.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 3 IoCs
  • Blocklisted process makes network request 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1348
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\DMS210949 MV LYDERHORN LOW MIX RATIO.xlsx"
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1076
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1760
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Public\vbc.exe"
        3⤵
          PID:2008
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:528
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:788
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1616

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Exploitation for Client Execution

    1
    T1203

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\vbc.exe
      MD5

      0abc1f2ac325ab9baa7903f5a9e7d0cb

      SHA1

      d15ff8fc05ca6618fa17133190d3c0d0736922fd

      SHA256

      58877fce8fc8226d8ed82e6db80af591acc24372286f86518908b934ddc65e57

      SHA512

      fb793cdb57a3dc6e722724d2c4cd4a7be5fe882d9f70adfb44696159bba13128f5c7a802c8eb882f0b773b8ae2996818fc396a60a1739678686d50b01f812378

    • C:\Users\Public\vbc.exe
      MD5

      0abc1f2ac325ab9baa7903f5a9e7d0cb

      SHA1

      d15ff8fc05ca6618fa17133190d3c0d0736922fd

      SHA256

      58877fce8fc8226d8ed82e6db80af591acc24372286f86518908b934ddc65e57

      SHA512

      fb793cdb57a3dc6e722724d2c4cd4a7be5fe882d9f70adfb44696159bba13128f5c7a802c8eb882f0b773b8ae2996818fc396a60a1739678686d50b01f812378

    • C:\Users\Public\vbc.exe
      MD5

      0abc1f2ac325ab9baa7903f5a9e7d0cb

      SHA1

      d15ff8fc05ca6618fa17133190d3c0d0736922fd

      SHA256

      58877fce8fc8226d8ed82e6db80af591acc24372286f86518908b934ddc65e57

      SHA512

      fb793cdb57a3dc6e722724d2c4cd4a7be5fe882d9f70adfb44696159bba13128f5c7a802c8eb882f0b773b8ae2996818fc396a60a1739678686d50b01f812378

    • \Users\Public\vbc.exe
      MD5

      0abc1f2ac325ab9baa7903f5a9e7d0cb

      SHA1

      d15ff8fc05ca6618fa17133190d3c0d0736922fd

      SHA256

      58877fce8fc8226d8ed82e6db80af591acc24372286f86518908b934ddc65e57

      SHA512

      fb793cdb57a3dc6e722724d2c4cd4a7be5fe882d9f70adfb44696159bba13128f5c7a802c8eb882f0b773b8ae2996818fc396a60a1739678686d50b01f812378

    • \Users\Public\vbc.exe
      MD5

      0abc1f2ac325ab9baa7903f5a9e7d0cb

      SHA1

      d15ff8fc05ca6618fa17133190d3c0d0736922fd

      SHA256

      58877fce8fc8226d8ed82e6db80af591acc24372286f86518908b934ddc65e57

      SHA512

      fb793cdb57a3dc6e722724d2c4cd4a7be5fe882d9f70adfb44696159bba13128f5c7a802c8eb882f0b773b8ae2996818fc396a60a1739678686d50b01f812378

    • \Users\Public\vbc.exe
      MD5

      0abc1f2ac325ab9baa7903f5a9e7d0cb

      SHA1

      d15ff8fc05ca6618fa17133190d3c0d0736922fd

      SHA256

      58877fce8fc8226d8ed82e6db80af591acc24372286f86518908b934ddc65e57

      SHA512

      fb793cdb57a3dc6e722724d2c4cd4a7be5fe882d9f70adfb44696159bba13128f5c7a802c8eb882f0b773b8ae2996818fc396a60a1739678686d50b01f812378

    • \Users\Public\vbc.exe
      MD5

      0abc1f2ac325ab9baa7903f5a9e7d0cb

      SHA1

      d15ff8fc05ca6618fa17133190d3c0d0736922fd

      SHA256

      58877fce8fc8226d8ed82e6db80af591acc24372286f86518908b934ddc65e57

      SHA512

      fb793cdb57a3dc6e722724d2c4cd4a7be5fe882d9f70adfb44696159bba13128f5c7a802c8eb882f0b773b8ae2996818fc396a60a1739678686d50b01f812378

    • memory/528-58-0x00000000757A1000-0x00000000757A3000-memory.dmp
      Filesize

      8KB

    • memory/788-70-0x0000000004990000-0x00000000049DB000-memory.dmp
      Filesize

      300KB

    • memory/788-69-0x0000000000580000-0x0000000000587000-memory.dmp
      Filesize

      28KB

    • memory/788-63-0x0000000000000000-mapping.dmp
    • memory/788-66-0x0000000001040000-0x0000000001041000-memory.dmp
      Filesize

      4KB

    • memory/788-68-0x0000000007210000-0x0000000007211000-memory.dmp
      Filesize

      4KB

    • memory/1076-56-0x0000000071361000-0x0000000071363000-memory.dmp
      Filesize

      8KB

    • memory/1076-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1076-86-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1076-55-0x000000002F231000-0x000000002F234000-memory.dmp
      Filesize

      12KB

    • memory/1348-87-0x00000000069E0000-0x0000000006B40000-memory.dmp
      Filesize

      1.4MB

    • memory/1348-79-0x0000000007110000-0x0000000007242000-memory.dmp
      Filesize

      1.2MB

    • memory/1616-74-0x000000000041D4B0-mapping.dmp
    • memory/1616-78-0x00000000002D0000-0x00000000002E1000-memory.dmp
      Filesize

      68KB

    • memory/1616-77-0x00000000008F0000-0x0000000000BF3000-memory.dmp
      Filesize

      3.0MB

    • memory/1616-73-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1616-72-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1616-71-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1760-80-0x0000000000000000-mapping.dmp
    • memory/1760-82-0x000000004A440000-0x000000004A48C000-memory.dmp
      Filesize

      304KB

    • memory/1760-83-0x0000000000080000-0x00000000000A9000-memory.dmp
      Filesize

      164KB

    • memory/1760-84-0x0000000002140000-0x0000000002443000-memory.dmp
      Filesize

      3.0MB

    • memory/1760-85-0x0000000000470000-0x0000000000500000-memory.dmp
      Filesize

      576KB

    • memory/2008-81-0x0000000000000000-mapping.dmp