Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    20-10-2021 05:37

General

  • Target

    Drawing.exe

  • Size

    572KB

  • MD5

    da60dccf62e5dd00e76531b6e0e74794

  • SHA1

    a9bb11bbb6bcc1cb69b302bcec25ec29d770e6d4

  • SHA256

    88f9f44e6cb13da79a3967ffa56a9d8c46d8d49623518df5e90c3d4cf72b3b79

  • SHA512

    e6e25dbcc0b8669f781da4533783f5cf9abb568762837c03768369b4b9d99e4b637ff1a06f1829d53b683e2dc2ade14831bc5df804e42d2516f9ed96e6f6a74f

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dq6e

C2

http://www.nihiufypsz.quest/dq6e/

Decoy

one80.center

buymorefun.store

wiew-bkjm.com

elvalordesertu.com

tallyeyeglassery.net

nuhive.net

supportsmercari.com

h5625.com

dfgroup.website

personlig-almanacka.com

gunpow3r.com

xn--tiergesttzt-0hb.com

mpochip.com

accreditslots.com

gameplancyber.com

clickonline.website

bhagyashreerestaurant.com

lunaenglish.online

kidsorange.com

reshapers.art

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 1 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1360
    • C:\Users\Admin\AppData\Local\Temp\Drawing.exe
      "C:\Users\Admin\AppData\Local\Temp\Drawing.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1604
      • C:\Users\Admin\AppData\Local\Temp\Drawing.exe
        "C:\Users\Admin\AppData\Local\Temp\Drawing.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1660
    • C:\Windows\SysWOW64\NETSTAT.EXE
      "C:\Windows\SysWOW64\NETSTAT.EXE"
      2⤵
      • Suspicious use of SetThreadContext
      • Gathers network information
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1456
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Drawing.exe"
        3⤵
        • Deletes itself
        PID:544

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/544-61-0x0000000000000000-mapping.dmp
  • memory/1360-59-0x0000000007000000-0x0000000007168000-memory.dmp
    Filesize

    1.4MB

  • memory/1360-66-0x0000000005F90000-0x000000000602B000-memory.dmp
    Filesize

    620KB

  • memory/1456-60-0x0000000000000000-mapping.dmp
  • memory/1456-62-0x0000000000C70000-0x0000000000C79000-memory.dmp
    Filesize

    36KB

  • memory/1456-63-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

  • memory/1456-64-0x0000000002210000-0x0000000002513000-memory.dmp
    Filesize

    3.0MB

  • memory/1456-65-0x0000000000AF0000-0x0000000000B80000-memory.dmp
    Filesize

    576KB

  • memory/1604-55-0x0000000075F41000-0x0000000075F43000-memory.dmp
    Filesize

    8KB

  • memory/1660-56-0x000000000041D430-mapping.dmp
  • memory/1660-58-0x0000000000330000-0x0000000000341000-memory.dmp
    Filesize

    68KB

  • memory/1660-57-0x00000000008E0000-0x0000000000BE3000-memory.dmp
    Filesize

    3.0MB