Resubmissions

21-10-2021 12:22

211021-pkcwgsacd6 10

21-10-2021 11:37

211021-nq6kbabahj 10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    21-10-2021 11:37

General

  • Target

    HTK TT600202109300860048866 Payment Proof.pdf.exe

  • Size

    461KB

  • MD5

    f12bf73a1cb81b5ddd8dd6ed66e610f1

  • SHA1

    cb8b0497c95512bf9233823f7d20937424c87207

  • SHA256

    6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

  • SHA512

    385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4072
      • C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
        3⤵
          PID:3168
        • C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:3300
      • C:\Windows\SysWOW64\cscript.exe
        "C:\Windows\SysWOW64\cscript.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
          3⤵
            PID:1640

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1640-136-0x0000000000000000-mapping.dmp
      • memory/1672-138-0x0000000004730000-0x00000000047C0000-memory.dmp
        Filesize

        576KB

      • memory/1672-137-0x00000000049E0000-0x0000000004D00000-memory.dmp
        Filesize

        3.1MB

      • memory/1672-135-0x0000000000820000-0x0000000000849000-memory.dmp
        Filesize

        164KB

      • memory/1672-134-0x0000000000B30000-0x0000000000B57000-memory.dmp
        Filesize

        156KB

      • memory/1672-133-0x0000000000000000-mapping.dmp
      • memory/3028-129-0x0000000005610000-0x000000000577A000-memory.dmp
        Filesize

        1.4MB

      • memory/3028-139-0x0000000006DE0000-0x0000000006F2D000-memory.dmp
        Filesize

        1.3MB

      • memory/3028-132-0x0000000006C60000-0x0000000006DD1000-memory.dmp
        Filesize

        1.4MB

      • memory/3300-128-0x0000000001E10000-0x0000000001E21000-memory.dmp
        Filesize

        68KB

      • memory/3300-125-0x000000000041D420-mapping.dmp
      • memory/3300-127-0x0000000001960000-0x0000000001C80000-memory.dmp
        Filesize

        3.1MB

      • memory/3300-124-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

      • memory/3300-130-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

      • memory/3300-131-0x0000000003790000-0x00000000037A1000-memory.dmp
        Filesize

        68KB

      • memory/4072-123-0x0000000005A70000-0x0000000005ABB000-memory.dmp
        Filesize

        300KB

      • memory/4072-115-0x00000000003B0000-0x00000000003B1000-memory.dmp
        Filesize

        4KB

      • memory/4072-122-0x00000000059D0000-0x00000000059D1000-memory.dmp
        Filesize

        4KB

      • memory/4072-121-0x00000000051A0000-0x00000000051A7000-memory.dmp
        Filesize

        28KB

      • memory/4072-120-0x0000000004D30000-0x000000000522E000-memory.dmp
        Filesize

        5.0MB

      • memory/4072-119-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
        Filesize

        4KB

      • memory/4072-118-0x0000000004D30000-0x0000000004D31000-memory.dmp
        Filesize

        4KB

      • memory/4072-117-0x0000000005230000-0x0000000005231000-memory.dmp
        Filesize

        4KB