Resubmissions

21-10-2021 12:23

211021-pkfx5sacd7 10

21-10-2021 11:12

211021-na81haabh3 10

Analysis

  • max time kernel
    153s
  • max time network
    169s
  • platform
    windows11_x64
  • resource
    win11
  • submitted
    21-10-2021 12:23

General

  • Target

    REE20212110575259OCT.exe

  • Size

    498KB

  • MD5

    9c00fc940483cff2a0f3f619db16ad54

  • SHA1

    6f9c746d9cfb4e0bbf829783a82b883f7317b16b

  • SHA256

    8a54e41751369783c64f56f30133b985933092324e9b2dad025641d23643280c

  • SHA512

    30451538f9ed65159280a168c711056d7bc0776d0c30f1c82bfa4dfacfe4373c01f503004f1eacc1a690104f99bf7e78c61c5436261c0813508467ff5dd4ff21

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

gab8

C2

http://www.purodetalle.com/gab8/

Decoy

amateurfeetworship.com

big-food.biz

metaversevolution.com

profecional-pacasmayo.com

royzoom.com

bekindevolution.com

hokozaki.com

waltersswholesale.com

wayfinderacu.com

schnurrgallery.com

babygearrentals.net

imggtoken.club

24x7x366.com

lakiernictwo.info

les-cours.com

dwticket.com

onarollshades.com

ramireztradepartners.com

safarparfums.com

6ngie.info

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Sets service image path in registry 2 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe
      "C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:512
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4796
      • C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe
        "C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:5028
      • C:\Windows\SysWOW64\autochk.exe
        "C:\Windows\SysWOW64\autochk.exe"
        2⤵
          PID:5108
        • C:\Windows\SysWOW64\autochk.exe
          "C:\Windows\SysWOW64\autochk.exe"
          2⤵
            PID:4872
          • C:\Windows\SysWOW64\msiexec.exe
            "C:\Windows\SysWOW64\msiexec.exe"
            2⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4040
            • C:\Windows\SysWOW64\cmd.exe
              /c del "C:\Users\Admin\AppData\Local\Temp\REE20212110575259OCT.exe"
              3⤵
                PID:1956
          • C:\Windows\System32\WaaSMedicAgent.exe
            C:\Windows\System32\WaaSMedicAgent.exe 6095c4766816601af10a4ee05997dc20 AQDsvRa7tUaC9RKl/oIxlQ.0.1.0.3.0
            1⤵
            • Modifies data under HKEY_USERS
            PID:1196
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
            1⤵
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            PID:1868
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
            1⤵
            • Checks processor information in registry
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3048
            • C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
              C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
              2⤵
                PID:1364
            • C:\Windows\System32\WaaSMedicAgent.exe
              C:\Windows\System32\WaaSMedicAgent.exe 6095c4766816601af10a4ee05997dc20 AQDsvRa7tUaC9RKl/oIxlQ.0.1.0.3.0
              1⤵
              • Modifies data under HKEY_USERS
              PID:2292
            • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe
              C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.22000.100_none_04da31ff4c67c24a\TiWorker.exe -Embedding
              1⤵
              • Drops file in Windows directory
              • Suspicious use of AdjustPrivilegeToken
              PID:2284
            • C:\Windows\System32\WaaSMedicAgent.exe
              C:\Windows\System32\WaaSMedicAgent.exe 6095c4766816601af10a4ee05997dc20 AQDsvRa7tUaC9RKl/oIxlQ.0.1.0.3.0
              1⤵
              • Modifies data under HKEY_USERS
              PID:2512
            • C:\Windows\System32\WaaSMedicAgent.exe
              C:\Windows\System32\WaaSMedicAgent.exe 6095c4766816601af10a4ee05997dc20 AQDsvRa7tUaC9RKl/oIxlQ.0.1.0.3.0
              1⤵
              • Modifies data under HKEY_USERS
              PID:2268

            Network

            MITRE ATT&CK Matrix ATT&CK v6

            Persistence

            Registry Run Keys / Startup Folder

            1
            T1060

            Defense Evasion

            Modify Registry

            1
            T1112

            Discovery

            System Information Discovery

            2
            T1082

            Query Registry

            1
            T1012

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/512-148-0x0000000005A10000-0x0000000005A11000-memory.dmp
              Filesize

              4KB

            • memory/512-149-0x0000000005380000-0x0000000005381000-memory.dmp
              Filesize

              4KB

            • memory/512-150-0x0000000005460000-0x0000000005461000-memory.dmp
              Filesize

              4KB

            • memory/512-151-0x0000000005FC0000-0x0000000005FC1000-memory.dmp
              Filesize

              4KB

            • memory/512-152-0x0000000005510000-0x0000000005511000-memory.dmp
              Filesize

              4KB

            • memory/512-153-0x0000000005460000-0x0000000005A06000-memory.dmp
              Filesize

              5.6MB

            • memory/512-154-0x00000000059F0000-0x00000000059F7000-memory.dmp
              Filesize

              28KB

            • memory/512-146-0x0000000000880000-0x0000000000881000-memory.dmp
              Filesize

              4KB

            • memory/512-160-0x0000000006720000-0x000000000676B000-memory.dmp
              Filesize

              300KB

            • memory/512-159-0x0000000006530000-0x0000000006531000-memory.dmp
              Filesize

              4KB

            • memory/1364-158-0x0000000000000000-mapping.dmp
            • memory/1868-157-0x000001F0CDCA0000-0x000001F0CDCA4000-memory.dmp
              Filesize

              16KB

            • memory/1868-156-0x000001F0CB5A0000-0x000001F0CB5B0000-memory.dmp
              Filesize

              64KB

            • memory/1868-155-0x000001F0CB520000-0x000001F0CB530000-memory.dmp
              Filesize

              64KB

            • memory/1956-186-0x0000000000000000-mapping.dmp
            • memory/2844-162-0x0000000000000000-mapping.dmp
            • memory/2844-163-0x0000000000400000-0x0000000000429000-memory.dmp
              Filesize

              164KB

            • memory/2844-179-0x00000000010D0000-0x00000000010E1000-memory.dmp
              Filesize

              68KB

            • memory/2844-178-0x0000000001180000-0x00000000014D6000-memory.dmp
              Filesize

              3.3MB

            • memory/3208-176-0x00000000087B0000-0x000000000888A000-memory.dmp
              Filesize

              872KB

            • memory/3208-209-0x0000000008890000-0x000000000894C000-memory.dmp
              Filesize

              752KB

            • memory/4040-189-0x0000000004D90000-0x00000000050E6000-memory.dmp
              Filesize

              3.3MB

            • memory/4040-183-0x0000000000000000-mapping.dmp
            • memory/4040-208-0x0000000004C10000-0x0000000004CA0000-memory.dmp
              Filesize

              576KB

            • memory/4040-188-0x0000000002E00000-0x0000000002E29000-memory.dmp
              Filesize

              164KB

            • memory/4040-187-0x0000000000600000-0x0000000000628000-memory.dmp
              Filesize

              160KB

            • memory/4040-184-0x0000000002FF0000-0x0000000002FF1000-memory.dmp
              Filesize

              4KB

            • memory/4040-185-0x0000000002FF0000-0x0000000002FF1000-memory.dmp
              Filesize

              4KB

            • memory/4796-165-0x0000000002FC0000-0x0000000002FC1000-memory.dmp
              Filesize

              4KB

            • memory/4796-164-0x0000000002FC0000-0x0000000002FC1000-memory.dmp
              Filesize

              4KB

            • memory/4796-166-0x0000000004A90000-0x0000000004A91000-memory.dmp
              Filesize

              4KB

            • memory/4796-181-0x0000000007EB0000-0x0000000007EB1000-memory.dmp
              Filesize

              4KB

            • memory/4796-182-0x0000000008640000-0x0000000008641000-memory.dmp
              Filesize

              4KB

            • memory/4796-177-0x0000000004A42000-0x0000000004A43000-memory.dmp
              Filesize

              4KB

            • memory/4796-168-0x0000000007460000-0x0000000007461000-memory.dmp
              Filesize

              4KB

            • memory/4796-175-0x0000000004A40000-0x0000000004A41000-memory.dmp
              Filesize

              4KB

            • memory/4796-169-0x00000000074D0000-0x00000000074D1000-memory.dmp
              Filesize

              4KB

            • memory/4796-173-0x0000000008170000-0x0000000008171000-memory.dmp
              Filesize

              4KB

            • memory/4796-172-0x0000000007DA0000-0x0000000007DA1000-memory.dmp
              Filesize

              4KB

            • memory/4796-167-0x0000000007520000-0x0000000007521000-memory.dmp
              Filesize

              4KB

            • memory/4796-190-0x0000000004A45000-0x0000000004A47000-memory.dmp
              Filesize

              8KB

            • memory/4796-193-0x0000000008A10000-0x0000000008A44000-memory.dmp
              Filesize

              208KB

            • memory/4796-201-0x000000007FC60000-0x000000007FC61000-memory.dmp
              Filesize

              4KB

            • memory/4796-202-0x00000000089F0000-0x00000000089F1000-memory.dmp
              Filesize

              4KB

            • memory/4796-203-0x00000000097C0000-0x00000000097C1000-memory.dmp
              Filesize

              4KB

            • memory/4796-204-0x0000000009FA0000-0x0000000009FA1000-memory.dmp
              Filesize

              4KB

            • memory/4796-205-0x0000000009940000-0x0000000009941000-memory.dmp
              Filesize

              4KB

            • memory/4796-206-0x00000000099A0000-0x00000000099A1000-memory.dmp
              Filesize

              4KB

            • memory/4796-207-0x0000000009C30000-0x0000000009C31000-memory.dmp
              Filesize

              4KB

            • memory/4796-171-0x0000000007CC0000-0x0000000007CC1000-memory.dmp
              Filesize

              4KB

            • memory/4796-161-0x0000000000000000-mapping.dmp
            • memory/4796-210-0x0000000002FC0000-0x0000000002FC1000-memory.dmp
              Filesize

              4KB