Resubmissions

21-10-2021 12:22

211021-pj5j4sacd5 10

21-10-2021 12:15

211021-pew26sacc7 10

Analysis

  • max time kernel
    302s
  • max time network
    302s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    21-10-2021 12:22

General

  • Target

    triage_dropped_file.exe

  • Size

    253KB

  • MD5

    d0e4c13e6c8ba9fe34d86b554b595d9a

  • SHA1

    83eee2dbe00ae265af9eb13105dc1068b6b034cd

  • SHA256

    f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032

  • SHA512

    72f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

kqna

C2

http://www.surfsolutions.info/kqna/

Decoy

achyutlifesciences.com

anthemmg.com

netkopat.com

generationgirlnaturals.com

novatel-network.com

craftstockco.com

thevishantiverse.art

elkerfly.com

haerotechs.com

candypalette.com

gregdokes.com

e-commerce.company

gratitudeland.com

companyintelcloud.com

publicyazilim.com

xc6811.com

aracsozluk.com

janesgalant.quest

fraserstephendop.com

ryan.rentals

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
      "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3996
      • C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
        "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1444
    • C:\Windows\SysWOW64\colorcpl.exe
      "C:\Windows\SysWOW64\colorcpl.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
        3⤵
          PID:2544
      • C:\Program Files (x86)\Zbpxhyd\5j5xan6pifj8m8ix.exe
        "C:\Program Files (x86)\Zbpxhyd\5j5xan6pifj8m8ix.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1176
        • C:\Program Files (x86)\Zbpxhyd\5j5xan6pifj8m8ix.exe
          "C:\Program Files (x86)\Zbpxhyd\5j5xan6pifj8m8ix.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1092

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    2
    T1112

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Zbpxhyd\5j5xan6pifj8m8ix.exe
      MD5

      d0e4c13e6c8ba9fe34d86b554b595d9a

      SHA1

      83eee2dbe00ae265af9eb13105dc1068b6b034cd

      SHA256

      f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032

      SHA512

      72f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d

    • C:\Program Files (x86)\Zbpxhyd\5j5xan6pifj8m8ix.exe
      MD5

      d0e4c13e6c8ba9fe34d86b554b595d9a

      SHA1

      83eee2dbe00ae265af9eb13105dc1068b6b034cd

      SHA256

      f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032

      SHA512

      72f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d

    • C:\Program Files (x86)\Zbpxhyd\5j5xan6pifj8m8ix.exe
      MD5

      d0e4c13e6c8ba9fe34d86b554b595d9a

      SHA1

      83eee2dbe00ae265af9eb13105dc1068b6b034cd

      SHA256

      f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032

      SHA512

      72f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d

    • C:\Users\Admin\AppData\Local\Temp\nstA9E8.tmp\oirygpbyia.dll
      MD5

      6d2a0ca8aac6594e4f037d3cecdace3b

      SHA1

      2fdc815752d2483ae536ed60dd2104b0e5cc2abd

      SHA256

      f7a3aa43e037f6b25c8070b3aaac9f0c5037abb1c4d01afd30a6f52f7c44f468

      SHA512

      cacc25100aedd926141416ef443dd40f03cb6b1512129bd707fc8ece1c9db2ad9a1de559e8cb3d29b569e2b1b843822f4ef681c4ea33bc5a6a290a3f17bdb7ee

    • C:\Users\Admin\AppData\Local\Temp\nsy7193.tmp\oirygpbyia.dll
      MD5

      6d2a0ca8aac6594e4f037d3cecdace3b

      SHA1

      2fdc815752d2483ae536ed60dd2104b0e5cc2abd

      SHA256

      f7a3aa43e037f6b25c8070b3aaac9f0c5037abb1c4d01afd30a6f52f7c44f468

      SHA512

      cacc25100aedd926141416ef443dd40f03cb6b1512129bd707fc8ece1c9db2ad9a1de559e8cb3d29b569e2b1b843822f4ef681c4ea33bc5a6a290a3f17bdb7ee

    • C:\Users\Admin\AppData\Local\Temp\v9o87lv0ox9o
      MD5

      6dd6b2f57140830efdc0592e13806717

      SHA1

      309088c2e4ace855e4befd9973eaf9fd6b942ddb

      SHA256

      f2ef3b579ffd5f12c77522967c2b41725d0f72a1865ee0e32bc5747324fb9cdb

      SHA512

      8edbc94afc1ebce3d2a41c6b72b8270326f16b5a1ab6718edbd0554dfb7433ec34c82158fb12d561aeb51ab9c3e77cbc31b8307cf7f954e728975667f9057caf

    • memory/1092-168-0x0000000000BF0000-0x0000000000F46000-memory.dmp
      Filesize

      3.3MB

    • memory/1092-165-0x0000000000000000-mapping.dmp
    • memory/1176-160-0x0000000000000000-mapping.dmp
    • memory/1444-150-0x0000000000AD0000-0x0000000000E26000-memory.dmp
      Filesize

      3.3MB

    • memory/1444-151-0x0000000000FD0000-0x0000000000FE1000-memory.dmp
      Filesize

      68KB

    • memory/1444-148-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1444-147-0x0000000000000000-mapping.dmp
    • memory/1828-155-0x00000000006D0000-0x00000000006E9000-memory.dmp
      Filesize

      100KB

    • memory/1828-158-0x0000000004890000-0x0000000004920000-memory.dmp
      Filesize

      576KB

    • memory/1828-157-0x0000000004B20000-0x0000000004E76000-memory.dmp
      Filesize

      3.3MB

    • memory/1828-156-0x0000000002A00000-0x0000000002A29000-memory.dmp
      Filesize

      164KB

    • memory/1828-153-0x0000000000000000-mapping.dmp
    • memory/2544-154-0x0000000000000000-mapping.dmp
    • memory/3208-159-0x000000000A9E0000-0x000000000AB42000-memory.dmp
      Filesize

      1.4MB

    • memory/3208-152-0x0000000008480000-0x00000000085EE000-memory.dmp
      Filesize

      1.4MB