Resubmissions

21-10-2021 12:22

211021-pkcwgsacd6 10

21-10-2021 11:37

211021-nq6kbabahj 10

Analysis

  • max time kernel
    600s
  • max time network
    602s
  • platform
    windows7_x64
  • resource
    win7-de-20211014
  • submitted
    21-10-2021 12:22

General

  • Target

    HTK TT600202109300860048866 Payment Proof.pdf.exe

  • Size

    461KB

  • MD5

    f12bf73a1cb81b5ddd8dd6ed66e610f1

  • SHA1

    cb8b0497c95512bf9233823f7d20937424c87207

  • SHA256

    6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

  • SHA512

    385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 4 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1892
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Gathers network information
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1568
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
        3⤵
        • Deletes itself
        PID:1280
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1636
      • C:\Program Files (x86)\Oer-p6tep\colorcplwfil_r.exe
        "C:\Program Files (x86)\Oer-p6tep\colorcplwfil_r.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1376
        • C:\Program Files (x86)\Oer-p6tep\colorcplwfil_r.exe
          "C:\Program Files (x86)\Oer-p6tep\colorcplwfil_r.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1116
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {5BBA9DD4-B588-48E2-BCD7-63BD6CFB5A5F} S-1-5-18:NT AUTHORITY\System:Service:
      1⤵
        PID:820
      • C:\Windows\system32\taskeng.exe
        taskeng.exe {5A0AB20D-B742-47E7-8641-0719BF313465} S-1-5-21-2955169046-2371869340-1800780948-1000:UKNHJUQT\Admin:Interactive:[1]
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:1136
        • C:\Program Files\Mozilla Firefox\default-browser-agent.exe
          "C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task
          2⤵
            PID:1784

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Execution

        Command-Line Interface

        1
        T1059

        Persistence

        Registry Run Keys / Startup Folder

        1
        T1060

        Defense Evasion

        Modify Registry

        2
        T1112

        Discovery

        System Information Discovery

        1
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Oer-p6tep\colorcplwfil_r.exe
          MD5

          f12bf73a1cb81b5ddd8dd6ed66e610f1

          SHA1

          cb8b0497c95512bf9233823f7d20937424c87207

          SHA256

          6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

          SHA512

          385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

        • C:\Program Files (x86)\Oer-p6tep\colorcplwfil_r.exe
          MD5

          f12bf73a1cb81b5ddd8dd6ed66e610f1

          SHA1

          cb8b0497c95512bf9233823f7d20937424c87207

          SHA256

          6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

          SHA512

          385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

        • C:\Program Files (x86)\Oer-p6tep\colorcplwfil_r.exe
          MD5

          f12bf73a1cb81b5ddd8dd6ed66e610f1

          SHA1

          cb8b0497c95512bf9233823f7d20937424c87207

          SHA256

          6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

          SHA512

          385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

        • memory/552-59-0x00000000005F0000-0x00000000005F7000-memory.dmp
          Filesize

          28KB

        • memory/552-60-0x00000000048E0000-0x000000000492B000-memory.dmp
          Filesize

          300KB

        • memory/552-58-0x0000000004960000-0x0000000004961000-memory.dmp
          Filesize

          4KB

        • memory/552-57-0x00000000755A1000-0x00000000755A3000-memory.dmp
          Filesize

          8KB

        • memory/552-55-0x0000000000EC0000-0x0000000000EC1000-memory.dmp
          Filesize

          4KB

        • memory/1116-91-0x00000000009C0000-0x0000000000CC3000-memory.dmp
          Filesize

          3.0MB

        • memory/1116-89-0x000000000041D420-mapping.dmp
        • memory/1228-76-0x0000000009300000-0x0000000009449000-memory.dmp
          Filesize

          1.3MB

        • memory/1228-68-0x00000000062E0000-0x000000000644D000-memory.dmp
          Filesize

          1.4MB

        • memory/1280-74-0x0000000000000000-mapping.dmp
        • memory/1376-84-0x00000000049C0000-0x00000000049C1000-memory.dmp
          Filesize

          4KB

        • memory/1376-78-0x0000000000000000-mapping.dmp
        • memory/1376-81-0x0000000000940000-0x0000000000941000-memory.dmp
          Filesize

          4KB

        • memory/1568-73-0x00000000022A0000-0x00000000025A3000-memory.dmp
          Filesize

          3.0MB

        • memory/1568-75-0x00000000004A0000-0x0000000000530000-memory.dmp
          Filesize

          576KB

        • memory/1568-71-0x00000000002E0000-0x00000000002EA000-memory.dmp
          Filesize

          40KB

        • memory/1568-72-0x0000000000080000-0x00000000000A9000-memory.dmp
          Filesize

          164KB

        • memory/1568-69-0x0000000000000000-mapping.dmp
        • memory/1784-77-0x0000000000000000-mapping.dmp
        • memory/1892-66-0x0000000000810000-0x0000000000B13000-memory.dmp
          Filesize

          3.0MB

        • memory/1892-67-0x00000000001A0000-0x00000000001B1000-memory.dmp
          Filesize

          68KB

        • memory/1892-63-0x0000000000400000-0x0000000000429000-memory.dmp
          Filesize

          164KB

        • memory/1892-64-0x000000000041D420-mapping.dmp
        • memory/1892-62-0x0000000000400000-0x0000000000429000-memory.dmp
          Filesize

          164KB

        • memory/1892-61-0x0000000000400000-0x0000000000429000-memory.dmp
          Filesize

          164KB