Analysis
-
max time kernel
301s -
max time network
299s -
platform
windows10_x64 -
resource
win10-ja-20210920 -
submitted
21-10-2021 12:22
General
-
Target
triage_dropped_file.exe
-
Size
253KB
-
MD5
d0e4c13e6c8ba9fe34d86b554b595d9a
-
SHA1
83eee2dbe00ae265af9eb13105dc1068b6b034cd
-
SHA256
f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032
-
SHA512
72f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d
Malware Config
Extracted
xloader
2.5
kqna
http://www.surfsolutions.info/kqna/
achyutlifesciences.com
anthemmg.com
netkopat.com
generationgirlnaturals.com
novatel-network.com
craftstockco.com
thevishantiverse.art
elkerfly.com
haerotechs.com
candypalette.com
gregdokes.com
e-commerce.company
gratitudeland.com
companyintelcloud.com
publicyazilim.com
xc6811.com
aracsozluk.com
janesgalant.quest
fraserstephendop.com
ryan.rentals
Signatures
-
Registers COM server for autorun 1 TTPs
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 5 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Drops file in System32 directory 4 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 6 IoCs
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Modifies data under HKEY_USERS 23 IoCs
-
Modifies registry class 47 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 7 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 27 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Gathers network information
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Program Files (x86)\S5j6\audiodgib28hj.exe"C:\Program Files (x86)\S5j6\audiodgib28hj.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\S5j6\audiodgib28hj.exe"C:\Program Files (x86)\S5j6\audiodgib28hj.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"1⤵
- Modifies registry class
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\S5j6\audiodgib28hj.exeMD5
d0e4c13e6c8ba9fe34d86b554b595d9a
SHA183eee2dbe00ae265af9eb13105dc1068b6b034cd
SHA256f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032
SHA51272f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d
-
C:\Program Files (x86)\S5j6\audiodgib28hj.exeMD5
d0e4c13e6c8ba9fe34d86b554b595d9a
SHA183eee2dbe00ae265af9eb13105dc1068b6b034cd
SHA256f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032
SHA51272f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d
-
C:\Program Files (x86)\S5j6\audiodgib28hj.exeMD5
d0e4c13e6c8ba9fe34d86b554b595d9a
SHA183eee2dbe00ae265af9eb13105dc1068b6b034cd
SHA256f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032
SHA51272f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d
-
C:\Users\Admin\AppData\Local\Temp\DB1MD5
b608d407fc15adea97c26936bc6f03f6
SHA1953e7420801c76393902c0d6bb56148947e41571
SHA256b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf
SHA512cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4
-
C:\Users\Admin\AppData\Local\Temp\v9o87lv0ox9oMD5
6dd6b2f57140830efdc0592e13806717
SHA1309088c2e4ace855e4befd9973eaf9fd6b942ddb
SHA256f2ef3b579ffd5f12c77522967c2b41725d0f72a1865ee0e32bc5747324fb9cdb
SHA5128edbc94afc1ebce3d2a41c6b72b8270326f16b5a1ab6718edbd0554dfb7433ec34c82158fb12d561aeb51ab9c3e77cbc31b8307cf7f954e728975667f9057caf
-
\Users\Admin\AppData\Local\Temp\nsaEB6B.tmp\oirygpbyia.dllMD5
6d2a0ca8aac6594e4f037d3cecdace3b
SHA12fdc815752d2483ae536ed60dd2104b0e5cc2abd
SHA256f7a3aa43e037f6b25c8070b3aaac9f0c5037abb1c4d01afd30a6f52f7c44f468
SHA512cacc25100aedd926141416ef443dd40f03cb6b1512129bd707fc8ece1c9db2ad9a1de559e8cb3d29b569e2b1b843822f4ef681c4ea33bc5a6a290a3f17bdb7ee
-
\Users\Admin\AppData\Local\Temp\nspD530.tmp\oirygpbyia.dllMD5
6d2a0ca8aac6594e4f037d3cecdace3b
SHA12fdc815752d2483ae536ed60dd2104b0e5cc2abd
SHA256f7a3aa43e037f6b25c8070b3aaac9f0c5037abb1c4d01afd30a6f52f7c44f468
SHA512cacc25100aedd926141416ef443dd40f03cb6b1512129bd707fc8ece1c9db2ad9a1de559e8cb3d29b569e2b1b843822f4ef681c4ea33bc5a6a290a3f17bdb7ee
-
memory/1488-131-0x0000000000000000-mapping.dmp
-
memory/1568-125-0x0000000000000000-mapping.dmp
-
memory/1976-137-0x000000000041D400-mapping.dmp
-
memory/1976-139-0x0000000000B00000-0x0000000000E20000-memory.dmpFilesize
3.1MB
-
memory/2296-121-0x0000000002D20000-0x0000000002DE2000-memory.dmpFilesize
776KB
-
memory/2296-128-0x0000000002EA0000-0x0000000002F5A000-memory.dmpFilesize
744KB
-
memory/3964-129-0x0000000000000000-mapping.dmp
-
memory/4856-126-0x0000000003200000-0x000000000334A000-memory.dmpFilesize
1.3MB
-
memory/4856-127-0x00000000036F0000-0x0000000003780000-memory.dmpFilesize
576KB
-
memory/4856-124-0x0000000002F50000-0x0000000002F79000-memory.dmpFilesize
164KB
-
memory/4856-123-0x0000000000EA0000-0x0000000000EAB000-memory.dmpFilesize
44KB
-
memory/4856-122-0x0000000000000000-mapping.dmp
-
memory/4880-119-0x0000000000AD0000-0x0000000000DF0000-memory.dmpFilesize
3.1MB
-
memory/4880-120-0x00000000009D0000-0x00000000009E1000-memory.dmpFilesize
68KB
-
memory/4880-117-0x000000000041D400-mapping.dmp
-
memory/4880-116-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB