Resubmissions

21-10-2021 12:22

211021-pj5j4sacd5 10

21-10-2021 12:15

211021-pew26sacc7 10

Analysis

  • max time kernel
    300s
  • max time network
    315s
  • platform
    windows10_x64
  • resource
    win10-de-20210920
  • submitted
    21-10-2021 12:22

General

  • Target

    triage_dropped_file.exe

  • Size

    253KB

  • MD5

    d0e4c13e6c8ba9fe34d86b554b595d9a

  • SHA1

    83eee2dbe00ae265af9eb13105dc1068b6b034cd

  • SHA256

    f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032

  • SHA512

    72f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

kqna

C2

http://www.surfsolutions.info/kqna/

Decoy

achyutlifesciences.com

anthemmg.com

netkopat.com

generationgirlnaturals.com

novatel-network.com

craftstockco.com

thevishantiverse.art

elkerfly.com

haerotechs.com

candypalette.com

gregdokes.com

e-commerce.company

gratitudeland.com

companyintelcloud.com

publicyazilim.com

xc6811.com

aracsozluk.com

janesgalant.quest

fraserstephendop.com

ryan.rentals

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 6 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 6 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 23 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
      "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:444
      • C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe
        "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4488
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:3172
      • C:\Windows\SysWOW64\NETSTAT.EXE
        "C:\Windows\SysWOW64\NETSTAT.EXE"
        2⤵
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Gathers network information
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3184
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\triage_dropped_file.exe"
          3⤵
            PID:700
          • C:\Windows\SysWOW64\cmd.exe
            /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
            3⤵
              PID:4544
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:2252
            • C:\Program Files (x86)\W3fs\gdigpet1nzp.exe
              "C:\Program Files (x86)\W3fs\gdigpet1nzp.exe"
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1080
              • C:\Program Files (x86)\W3fs\gdigpet1nzp.exe
                "C:\Program Files (x86)\W3fs\gdigpet1nzp.exe"
                3⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1156
          • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
            "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False
            1⤵
            • Drops file in System32 directory
            • Modifies data under HKEY_USERS
            • Suspicious use of SetWindowsHookEx
            PID:2224

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Execution

          Command-Line Interface

          1
          T1059

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Credentials in Files

          1
          T1081

          Discovery

          System Information Discovery

          2
          T1082

          Collection

          Data from Local System

          1
          T1005

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Program Files (x86)\W3fs\gdigpet1nzp.exe
            MD5

            d0e4c13e6c8ba9fe34d86b554b595d9a

            SHA1

            83eee2dbe00ae265af9eb13105dc1068b6b034cd

            SHA256

            f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032

            SHA512

            72f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d

          • C:\Program Files (x86)\W3fs\gdigpet1nzp.exe
            MD5

            d0e4c13e6c8ba9fe34d86b554b595d9a

            SHA1

            83eee2dbe00ae265af9eb13105dc1068b6b034cd

            SHA256

            f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032

            SHA512

            72f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d

          • C:\Program Files (x86)\W3fs\gdigpet1nzp.exe
            MD5

            d0e4c13e6c8ba9fe34d86b554b595d9a

            SHA1

            83eee2dbe00ae265af9eb13105dc1068b6b034cd

            SHA256

            f8d9fbcef6907460baa7c91e53d1a40865901bb50906b5519cba440fdbc65032

            SHA512

            72f5fcd367c0f0fdc83827bea529f84a85ace28550a5cd8102cb0cde2829d81defe312fb0d95d3c5a8e8728f4efd8cb433bfab0b3e1f265fffdc4e0ad687247d

          • C:\Users\Admin\AppData\Local\Temp\DB1
            MD5

            b608d407fc15adea97c26936bc6f03f6

            SHA1

            953e7420801c76393902c0d6bb56148947e41571

            SHA256

            b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

            SHA512

            cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

          • C:\Users\Admin\AppData\Local\Temp\v9o87lv0ox9o
            MD5

            d41d8cd98f00b204e9800998ecf8427e

            SHA1

            da39a3ee5e6b4b0d3255bfef95601890afd80709

            SHA256

            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

            SHA512

            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

          • \Users\Admin\AppData\Local\Temp\nsc8DD7.tmp\oirygpbyia.dll
            MD5

            6d2a0ca8aac6594e4f037d3cecdace3b

            SHA1

            2fdc815752d2483ae536ed60dd2104b0e5cc2abd

            SHA256

            f7a3aa43e037f6b25c8070b3aaac9f0c5037abb1c4d01afd30a6f52f7c44f468

            SHA512

            cacc25100aedd926141416ef443dd40f03cb6b1512129bd707fc8ece1c9db2ad9a1de559e8cb3d29b569e2b1b843822f4ef681c4ea33bc5a6a290a3f17bdb7ee

          • \Users\Admin\AppData\Local\Temp\nscD6E9.tmp\oirygpbyia.dll
            MD5

            6d2a0ca8aac6594e4f037d3cecdace3b

            SHA1

            2fdc815752d2483ae536ed60dd2104b0e5cc2abd

            SHA256

            f7a3aa43e037f6b25c8070b3aaac9f0c5037abb1c4d01afd30a6f52f7c44f468

            SHA512

            cacc25100aedd926141416ef443dd40f03cb6b1512129bd707fc8ece1c9db2ad9a1de559e8cb3d29b569e2b1b843822f4ef681c4ea33bc5a6a290a3f17bdb7ee

          • memory/700-129-0x0000000000000000-mapping.dmp
          • memory/1080-134-0x0000000000000000-mapping.dmp
          • memory/1156-140-0x000000000041D400-mapping.dmp
          • memory/1156-142-0x00000000009F0000-0x0000000000D10000-memory.dmp
            Filesize

            3.1MB

          • memory/2064-131-0x00000000060C0000-0x000000000624D000-memory.dmp
            Filesize

            1.6MB

          • memory/2064-120-0x0000000005AD0000-0x0000000005C39000-memory.dmp
            Filesize

            1.4MB

          • memory/2064-124-0x0000000005E50000-0x0000000005FBE000-memory.dmp
            Filesize

            1.4MB

          • memory/3184-128-0x00000000030B0000-0x00000000031FA000-memory.dmp
            Filesize

            1.3MB

          • memory/3184-130-0x00000000035A0000-0x0000000003630000-memory.dmp
            Filesize

            576KB

          • memory/3184-126-0x0000000000D70000-0x0000000000D7B000-memory.dmp
            Filesize

            44KB

          • memory/3184-127-0x0000000003010000-0x0000000003039000-memory.dmp
            Filesize

            164KB

          • memory/3184-125-0x0000000000000000-mapping.dmp
          • memory/4488-123-0x0000000000D60000-0x0000000000D71000-memory.dmp
            Filesize

            68KB

          • memory/4488-122-0x0000000000400000-0x0000000000429000-memory.dmp
            Filesize

            164KB

          • memory/4488-119-0x0000000000A20000-0x0000000000D40000-memory.dmp
            Filesize

            3.1MB

          • memory/4488-121-0x00000000009F0000-0x0000000000A01000-memory.dmp
            Filesize

            68KB

          • memory/4488-117-0x000000000041D400-mapping.dmp
          • memory/4488-116-0x0000000000400000-0x0000000000429000-memory.dmp
            Filesize

            164KB

          • memory/4544-132-0x0000000000000000-mapping.dmp