Analysis

  • max time kernel
    151s
  • max time network
    174s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    28-10-2021 09:49

General

  • Target

    SHIPPING DOCUMENT.xlsx

  • Size

    348KB

  • MD5

    d06a6959f9509d332146ec0eb044e1ed

  • SHA1

    a064afda4a92f851f09be30cee6bd2bdeed6e483

  • SHA256

    521964cfa8b86e5b68055ebc945e1c9f269579c7bdcc67cadddd74914671a86d

  • SHA512

    386fed9a54c60e9716d861d5897c018dcad76ebc12c86b6712230229b862696411088cd142691426af24efca6e1f190d83cb0c97aebd575229a22240dfe36065

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mwev

C2

http://www.scion-go-getter.com/mwev/

Decoy

9linefarms.com

meadow-spring.com

texascountrycharts.com

chinatowndeliver.com

grindsword.com

thegurusigavebirthto.com

rip-online.com

lm-safe-keepingtoyof6.xyz

plumbtechconsulting.com

jgoerlach.com

inbloomsolutions.com

foxandmew.com

tikomobile.store

waybunch.com

thepatriottutor.com

qask.top

pharmacylinked.com

ishii-miona.com

sugarandrocks.com

anabolenpower.net

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1244
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.xlsx"
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:520
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Public\vbc.exe"
        3⤵
          PID:2044
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1812
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1560
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1708

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Exploitation for Client Execution

    1
    T1203

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\vbc.exe
      MD5

      ff1c94584214d5eef525a0d3ff196a8b

      SHA1

      64841f419c3d8bff98b1ada134ecb8d63be07ec4

      SHA256

      92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8

      SHA512

      9070de7cca07bde86414050f16a73f51c8573e07dca0e8cbac09c870d6f902890d1282dc6f9b1702feb059ad96938ca05dc466bd2004b2c2f670e60ad32f6daa

    • C:\Users\Public\vbc.exe
      MD5

      ff1c94584214d5eef525a0d3ff196a8b

      SHA1

      64841f419c3d8bff98b1ada134ecb8d63be07ec4

      SHA256

      92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8

      SHA512

      9070de7cca07bde86414050f16a73f51c8573e07dca0e8cbac09c870d6f902890d1282dc6f9b1702feb059ad96938ca05dc466bd2004b2c2f670e60ad32f6daa

    • C:\Users\Public\vbc.exe
      MD5

      ff1c94584214d5eef525a0d3ff196a8b

      SHA1

      64841f419c3d8bff98b1ada134ecb8d63be07ec4

      SHA256

      92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8

      SHA512

      9070de7cca07bde86414050f16a73f51c8573e07dca0e8cbac09c870d6f902890d1282dc6f9b1702feb059ad96938ca05dc466bd2004b2c2f670e60ad32f6daa

    • \Users\Public\vbc.exe
      MD5

      ff1c94584214d5eef525a0d3ff196a8b

      SHA1

      64841f419c3d8bff98b1ada134ecb8d63be07ec4

      SHA256

      92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8

      SHA512

      9070de7cca07bde86414050f16a73f51c8573e07dca0e8cbac09c870d6f902890d1282dc6f9b1702feb059ad96938ca05dc466bd2004b2c2f670e60ad32f6daa

    • \Users\Public\vbc.exe
      MD5

      ff1c94584214d5eef525a0d3ff196a8b

      SHA1

      64841f419c3d8bff98b1ada134ecb8d63be07ec4

      SHA256

      92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8

      SHA512

      9070de7cca07bde86414050f16a73f51c8573e07dca0e8cbac09c870d6f902890d1282dc6f9b1702feb059ad96938ca05dc466bd2004b2c2f670e60ad32f6daa

    • \Users\Public\vbc.exe
      MD5

      ff1c94584214d5eef525a0d3ff196a8b

      SHA1

      64841f419c3d8bff98b1ada134ecb8d63be07ec4

      SHA256

      92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8

      SHA512

      9070de7cca07bde86414050f16a73f51c8573e07dca0e8cbac09c870d6f902890d1282dc6f9b1702feb059ad96938ca05dc466bd2004b2c2f670e60ad32f6daa

    • \Users\Public\vbc.exe
      MD5

      ff1c94584214d5eef525a0d3ff196a8b

      SHA1

      64841f419c3d8bff98b1ada134ecb8d63be07ec4

      SHA256

      92206b9fa1251b589ab6d14b4828cafe0ec9d9b44df469602b7d3d1ed16ae0e8

      SHA512

      9070de7cca07bde86414050f16a73f51c8573e07dca0e8cbac09c870d6f902890d1282dc6f9b1702feb059ad96938ca05dc466bd2004b2c2f670e60ad32f6daa

    • memory/520-69-0x00000000059D7000-0x00000000059DA000-memory.dmp
      Filesize

      12KB

    • memory/520-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/520-89-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/520-55-0x00000000716A1000-0x00000000716A3000-memory.dmp
      Filesize

      8KB

    • memory/520-54-0x000000002F5E1000-0x000000002F5E4000-memory.dmp
      Filesize

      12KB

    • memory/520-70-0x00000000059D5000-0x00000000059D7000-memory.dmp
      Filesize

      8KB

    • memory/520-68-0x00000000059D0000-0x00000000059D3000-memory.dmp
      Filesize

      12KB

    • memory/940-86-0x0000000002120000-0x0000000002423000-memory.dmp
      Filesize

      3.0MB

    • memory/940-85-0x00000000000D0000-0x00000000000F9000-memory.dmp
      Filesize

      164KB

    • memory/940-87-0x0000000000900000-0x0000000000990000-memory.dmp
      Filesize

      576KB

    • memory/940-84-0x0000000000D10000-0x0000000000D15000-memory.dmp
      Filesize

      20KB

    • memory/940-82-0x0000000000000000-mapping.dmp
    • memory/1244-88-0x0000000004AA0000-0x0000000004B37000-memory.dmp
      Filesize

      604KB

    • memory/1244-81-0x00000000074C0000-0x0000000007605000-memory.dmp
      Filesize

      1.3MB

    • memory/1560-71-0x00000000006C0000-0x00000000006C6000-memory.dmp
      Filesize

      24KB

    • memory/1560-72-0x0000000004D70000-0x0000000004DBB000-memory.dmp
      Filesize

      300KB

    • memory/1560-67-0x00000000049D0000-0x00000000049D1000-memory.dmp
      Filesize

      4KB

    • memory/1560-65-0x0000000000B40000-0x0000000000B41000-memory.dmp
      Filesize

      4KB

    • memory/1560-62-0x0000000000000000-mapping.dmp
    • memory/1708-76-0x000000000041D480-mapping.dmp
    • memory/1708-80-0x0000000000150000-0x0000000000161000-memory.dmp
      Filesize

      68KB

    • memory/1708-79-0x0000000000BB0000-0x0000000000EB3000-memory.dmp
      Filesize

      3.0MB

    • memory/1708-75-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1708-74-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1708-73-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1812-57-0x0000000075661000-0x0000000075663000-memory.dmp
      Filesize

      8KB

    • memory/2044-83-0x0000000000000000-mapping.dmp