Resubmissions

21-10-2021 12:22

211021-pkcwgsacd6 10

21-10-2021 11:37

211021-nq6kbabahj 10

Analysis

  • max time kernel
    602s
  • max time network
    607s
  • platform
    windows10_x64
  • resource
    win10-de-20210920
  • submitted
    21-10-2021 12:22

General

  • Target

    HTK TT600202109300860048866 Payment Proof.pdf.exe

  • Size

    461KB

  • MD5

    f12bf73a1cb81b5ddd8dd6ed66e610f1

  • SHA1

    cb8b0497c95512bf9233823f7d20937424c87207

  • SHA256

    6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

  • SHA512

    385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

euzn

C2

http://www.heser.net/euzn/

Decoy

235296tyc.com

gold12guide.art

baibuaherb.com

weberwines.tax

chezvitoria.com

aidenb.tech

pitchdeckservice.com

surgeryforfdf.xyz

workunvaccinated.com

hrtaro.com

yourotcs.com

sonimultispecialityclinic.com

consultantadvisors.com

pentesting-consulting.com

dantechs.digital

longshifa.online

taweilai.net

imyusuke.com

cashndashfinancial.com

fasiglimt.quest

Signatures

  • Registers COM server for autorun 1 TTPs
  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 23 IoCs
  • Modifies registry class 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1508
      • C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1416
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Blocklisted process makes network request
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\HTK TT600202109300860048866 Payment Proof.pdf.exe"
        3⤵
          PID:3040
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:2728
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            3⤵
              PID:1504
          • C:\Program Files (x86)\V8pnp5\qpu0gfupyjo0g.exe
            "C:\Program Files (x86)\V8pnp5\qpu0gfupyjo0g.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1536
            • C:\Program Files (x86)\V8pnp5\qpu0gfupyjo0g.exe
              "C:\Program Files (x86)\V8pnp5\qpu0gfupyjo0g.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:3648
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe
          "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"
          1⤵
          • Modifies registry class
          PID:2824
        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False
          1⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:1268

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Registry Run Keys / Startup Folder

        2
        T1060

        Defense Evasion

        Modify Registry

        2
        T1112

        Credential Access

        Credentials in Files

        1
        T1081

        Collection

        Data from Local System

        1
        T1005

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\V8pnp5\qpu0gfupyjo0g.exe
          MD5

          f12bf73a1cb81b5ddd8dd6ed66e610f1

          SHA1

          cb8b0497c95512bf9233823f7d20937424c87207

          SHA256

          6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

          SHA512

          385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

        • C:\Program Files (x86)\V8pnp5\qpu0gfupyjo0g.exe
          MD5

          f12bf73a1cb81b5ddd8dd6ed66e610f1

          SHA1

          cb8b0497c95512bf9233823f7d20937424c87207

          SHA256

          6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

          SHA512

          385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

        • C:\Program Files (x86)\V8pnp5\qpu0gfupyjo0g.exe
          MD5

          f12bf73a1cb81b5ddd8dd6ed66e610f1

          SHA1

          cb8b0497c95512bf9233823f7d20937424c87207

          SHA256

          6446736e3662120e1fe4c3518bc8e6d14553f6b0b27aaf1fc5676e1f73a50c33

          SHA512

          385c4de5deca014f7486f802efc9a305e2bd2c457a21b63f66bf6f3caef1acee6537f32c7cd4690ee0378939dfad4444abb832c31fb5b5cfcb5bf7ae86715bad

        • C:\Users\Admin\AppData\Local\Temp\DB1
          MD5

          b608d407fc15adea97c26936bc6f03f6

          SHA1

          953e7420801c76393902c0d6bb56148947e41571

          SHA256

          b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

          SHA512

          cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

        • memory/1416-124-0x0000000000400000-0x0000000000429000-memory.dmp
          Filesize

          164KB

        • memory/1416-127-0x0000000001120000-0x0000000001440000-memory.dmp
          Filesize

          3MB

        • memory/1416-128-0x0000000000B00000-0x0000000000C4A000-memory.dmp
          Filesize

          1MB

        • memory/1416-125-0x000000000041D420-mapping.dmp
        • memory/1508-123-0x0000000005FF0000-0x000000000603B000-memory.dmp
          Filesize

          300KB

        • memory/1508-115-0x00000000009C0000-0x00000000009C1000-memory.dmp
          Filesize

          4KB

        • memory/1508-122-0x0000000006090000-0x0000000006091000-memory.dmp
          Filesize

          4KB

        • memory/1508-121-0x00000000054F0000-0x00000000054F7000-memory.dmp
          Filesize

          28KB

        • memory/1508-117-0x00000000056F0000-0x00000000056F1000-memory.dmp
          Filesize

          4KB

        • memory/1508-118-0x0000000005290000-0x0000000005291000-memory.dmp
          Filesize

          4KB

        • memory/1508-119-0x0000000005270000-0x0000000005271000-memory.dmp
          Filesize

          4KB

        • memory/1508-120-0x00000000051F0000-0x00000000056EE000-memory.dmp
          Filesize

          4MB

        • memory/1536-147-0x0000000005270000-0x000000000576E000-memory.dmp
          Filesize

          4MB

        • memory/1536-139-0x0000000000000000-mapping.dmp
        • memory/2124-136-0x0000000002E50000-0x0000000002F41000-memory.dmp
          Filesize

          964KB

        • memory/2124-129-0x00000000065C0000-0x00000000066DD000-memory.dmp
          Filesize

          1MB

        • memory/2316-135-0x0000000004AF0000-0x0000000004B80000-memory.dmp
          Filesize

          576KB

        • memory/2316-134-0x0000000004D90000-0x00000000050B0000-memory.dmp
          Filesize

          3MB

        • memory/2316-133-0x0000000003220000-0x0000000003249000-memory.dmp
          Filesize

          164KB

        • memory/2316-132-0x0000000000820000-0x0000000000847000-memory.dmp
          Filesize

          156KB

        • memory/2316-130-0x0000000000000000-mapping.dmp
        • memory/2728-137-0x0000000000000000-mapping.dmp
        • memory/3040-131-0x0000000000000000-mapping.dmp
        • memory/3648-152-0x000000000041D420-mapping.dmp
        • memory/3648-154-0x0000000001020000-0x0000000001340000-memory.dmp
          Filesize

          3MB