Resubmissions

21-10-2021 12:22

211021-pkcwgsacd6 10

21-10-2021 11:37

211021-nq6kbabahj 10

Analysis

  • max time kernel
    600s
  • max time network
    607s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    21-10-2021 12:22

General

  • Target

    HTK TT600202109300860048866 Payment Proof.pdf.exe

  • Size

    461KB

  • MD5

    f12bf73a1cb81b5ddd8dd6ed66e610f1

  • SHA1

    cb8b0497c95512bf9233823f7d20937424c87207

  • SHA256

    6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

  • SHA512

    385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Sets service image path in registry 2 TTPs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 8 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1076
      • C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2196
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
      • Adds policy Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2780
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
        3⤵
          PID:2852
      • C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe
        "C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:548
        • C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe
          "C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe"
          3⤵
          • Executes dropped EXE
          PID:1064
        • C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe
          "C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe"
          3⤵
          • Executes dropped EXE
          PID:1520
        • C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe
          "C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe"
          3⤵
          • Executes dropped EXE
          PID:2244
    • C:\Windows\System32\WaaSMedicAgent.exe
      C:\Windows\System32\WaaSMedicAgent.exe 0b25b5bfc3b9ca6b5c62a25068ac76f1 fhCsUJm4OEOxqeCJfuCV9w.0.1.0.3.0
      1⤵
      • Modifies data under HKEY_USERS
      PID:1692
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2136
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
      1⤵
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1404
      • C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
        C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
        2⤵
          PID:3100
      • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe
        C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding
        1⤵
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:1108
      • C:\Windows\System32\WaaSMedicAgent.exe
        C:\Windows\System32\WaaSMedicAgent.exe 0b25b5bfc3b9ca6b5c62a25068ac76f1 fhCsUJm4OEOxqeCJfuCV9w.0.1.0.3.0
        1⤵
        • Modifies data under HKEY_USERS
        PID:2480
      • C:\Windows\System32\WaaSMedicAgent.exe
        C:\Windows\System32\WaaSMedicAgent.exe 0b25b5bfc3b9ca6b5c62a25068ac76f1 fhCsUJm4OEOxqeCJfuCV9w.0.1.0.3.0
        1⤵
        • Modifies data under HKEY_USERS
        PID:2512

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      2
      T1060

      Defense Evasion

      Modify Registry

      3
      T1112

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe
        MD5

        f12bf73a1cb81b5ddd8dd6ed66e610f1

        SHA1

        cb8b0497c95512bf9233823f7d20937424c87207

        SHA256

        6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

        SHA512

        385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

      • C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe
        MD5

        f12bf73a1cb81b5ddd8dd6ed66e610f1

        SHA1

        cb8b0497c95512bf9233823f7d20937424c87207

        SHA256

        6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

        SHA512

        385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

      • C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe
        MD5

        f12bf73a1cb81b5ddd8dd6ed66e610f1

        SHA1

        cb8b0497c95512bf9233823f7d20937424c87207

        SHA256

        6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

        SHA512

        385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

      • C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe
        MD5

        f12bf73a1cb81b5ddd8dd6ed66e610f1

        SHA1

        cb8b0497c95512bf9233823f7d20937424c87207

        SHA256

        6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

        SHA512

        385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

      • C:\Program Files (x86)\O9rlhn\l8tpyvvl_r6x.exe
        MD5

        f12bf73a1cb81b5ddd8dd6ed66e610f1

        SHA1

        cb8b0497c95512bf9233823f7d20937424c87207

        SHA256

        6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

        SHA512

        385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

      • memory/548-185-0x0000000004F90000-0x0000000005536000-memory.dmp
        Filesize

        5.6MB

      • memory/548-174-0x0000000000000000-mapping.dmp
      • memory/1064-188-0x0000000000000000-mapping.dmp
      • memory/1076-151-0x0000000006270000-0x0000000006271000-memory.dmp
        Filesize

        4KB

      • memory/1076-146-0x0000000000C20000-0x0000000000C21000-memory.dmp
        Filesize

        4KB

      • memory/1076-154-0x0000000005C30000-0x0000000005C37000-memory.dmp
        Filesize

        28KB

      • memory/1076-159-0x00000000068F0000-0x00000000068F1000-memory.dmp
        Filesize

        4KB

      • memory/1076-160-0x0000000006BE0000-0x0000000006C2B000-memory.dmp
        Filesize

        300KB

      • memory/1076-153-0x0000000005780000-0x0000000005781000-memory.dmp
        Filesize

        4KB

      • memory/1076-152-0x0000000005710000-0x0000000005CB6000-memory.dmp
        Filesize

        5.6MB

      • memory/1076-150-0x0000000005850000-0x0000000005851000-memory.dmp
        Filesize

        4KB

      • memory/1076-149-0x00000000057B0000-0x00000000057B1000-memory.dmp
        Filesize

        4KB

      • memory/1076-148-0x0000000005CC0000-0x0000000005CC1000-memory.dmp
        Filesize

        4KB

      • memory/1520-190-0x0000000000000000-mapping.dmp
      • memory/2136-156-0x000001B1A8BB0000-0x000001B1A8BC0000-memory.dmp
        Filesize

        64KB

      • memory/2136-157-0x000001B1AB2F0000-0x000001B1AB2F4000-memory.dmp
        Filesize

        16KB

      • memory/2136-155-0x000001B1A8B30000-0x000001B1A8B40000-memory.dmp
        Filesize

        64KB

      • memory/2196-165-0x0000000000F90000-0x0000000000FA1000-memory.dmp
        Filesize

        68KB

      • memory/2196-161-0x0000000000000000-mapping.dmp
      • memory/2196-162-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

      • memory/2196-164-0x00000000011C0000-0x0000000001516000-memory.dmp
        Filesize

        3.3MB

      • memory/2244-192-0x0000000000000000-mapping.dmp
      • memory/2244-195-0x00000000011A0000-0x00000000014F6000-memory.dmp
        Filesize

        3.3MB

      • memory/2780-171-0x0000000003500000-0x0000000003856000-memory.dmp
        Filesize

        3.3MB

      • memory/2780-167-0x0000000000000000-mapping.dmp
      • memory/2780-172-0x0000000003400000-0x0000000003490000-memory.dmp
        Filesize

        576KB

      • memory/2780-168-0x00000000002B0000-0x00000000002BE000-memory.dmp
        Filesize

        56KB

      • memory/2780-169-0x0000000002A10000-0x0000000002A39000-memory.dmp
        Filesize

        164KB

      • memory/2852-170-0x0000000000000000-mapping.dmp
      • memory/3100-158-0x0000000000000000-mapping.dmp
      • memory/3208-166-0x0000000006F50000-0x00000000070D8000-memory.dmp
        Filesize

        1.5MB

      • memory/3208-173-0x0000000007D30000-0x0000000007EB6000-memory.dmp
        Filesize

        1.5MB