Analysis
- max time kernel
149s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
21/10/2021, 13:45
General
- Target QUOTATION.exe
- Size 253KB
- Sample211021-q2ebbabcbq
- SHA256 18e91cbaa2d04fa969e97e947ccd011d494f68eb6375b067f0342a7765fb3119
Malware Config
Extracted
-
xloader
-
2.5
-
d6pu
-
http://www.bonitaspringshomesearch.com/d6pu/
-
ifixcreditatl.com
-
productgeekout.com
-
electricvehicle-insurance.com
-
kuiper.business
-
cloudenglabs.com
-
gorbepari.com
-
collecthappy.com
-
amykrussell.store
-
clubhousebusinesscourse.com
-
aplussinifiklima.com
-
slewis.design
-
atticwitt.com
-
galenota.com
-
griphook.xyz
-
gsjbd1.club
-
bootystrapfitness.com
-
emflawrhks.com
-
alternativedata.investments
-
eyehealthtnpasumo3.xyz
-
naturanzaec.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
suricata: ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
- Xloader Payload 4 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1180-128-0x00000000000B0000-0x00000000000BB000-memory.dmp
memory/1180-129-0x00000000032D0000-0x00000000032F9000-memory.dmp
memory/1180-131-0x0000000003830000-0x00000000038C0000-memory.dmp
memory/1180-130-0x0000000003480000-0x00000000037A0000-memory.dmp
memory/3028-172-0x0000000002190000-0x00000000021A0000-memory.dmp
memory/3028-145-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-222-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-125-0x0000000006750000-0x0000000006879000-memory.dmp
memory/3028-132-0x0000000002700000-0x00000000027D9000-memory.dmp
memory/3028-134-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-133-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-135-0x0000000000750000-0x0000000000760000-memory.dmp
memory/3028-136-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-138-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-137-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-139-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-140-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-141-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-142-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-143-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-144-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-179-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-146-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-147-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-148-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-149-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-150-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-151-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-152-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-153-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-154-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-155-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-156-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-157-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-158-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-159-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-160-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-161-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-163-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-162-0x0000000000750000-0x0000000000760000-memory.dmp
memory/3028-165-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-164-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-166-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-167-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-169-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-168-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-171-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-170-0x0000000002190000-0x00000000021A0000-memory.dmp
memory/3028-173-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-122-0x0000000005D30000-0x0000000005E5F000-memory.dmp
memory/3028-174-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-175-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-220-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-213-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-177-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-178-0x0000000002190000-0x00000000021A0000-memory.dmp
memory/3028-181-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-180-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-182-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-183-0x0000000000750000-0x0000000000760000-memory.dmp
memory/3028-184-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-185-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-186-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-187-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-188-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-189-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-190-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-191-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-192-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-193-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-194-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-195-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-196-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-197-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-198-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-199-0x0000000000760000-0x0000000000762000-memory.dmp
memory/3028-200-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-201-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-202-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-203-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-205-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-204-0x0000000000750000-0x0000000000760000-memory.dmp
memory/3028-207-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-206-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-209-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-208-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-211-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-210-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-176-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-212-0x00000000007C0000-0x00000000007D0000-memory.dmp
memory/3028-215-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-214-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-217-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-216-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-218-0x00000000007C0000-0x00000000007D0000-memory.dmp
memory/3028-219-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3028-221-0x0000000000830000-0x0000000000840000-memory.dmp
memory/3652-117-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3652-120-0x0000000000AB0000-0x0000000000DD0000-memory.dmp
memory/3652-121-0x00000000009F0000-0x0000000000A01000-memory.dmp
memory/3652-123-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3652-124-0x0000000000A30000-0x0000000000A41000-memory.dmp