Analysis

  • max time kernel
    157s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    29-10-2021 08:39

General

  • Target

    shipping docs 07853 draft CI+PL_pdf.exe

  • Size

    405KB

  • MD5

    d2416ffd6622325de15094f298d46498

  • SHA1

    5a732449aded6f18071dc053ba23031effd9ce1a

  • SHA256

    66ebc2bbaf8ea07be988cce296542d9e1d7d24fbfe4523894bfd5a8c4474502e

  • SHA512

    14df50fdde872c1f11f68dba2fad672dee8c4473abe3ee05f4a1ad7c97d573e08b4bf15dca6bfe63a5d8ebc2d43eb93d9397bd59dbd030b429359e5992b263fe

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

bs8f

C2

http://www.rwilogisticsandbrokerage.com/bs8f/

Decoy

vasilnikov.com

parkate.club

pol360.com

handmadequatang.com

consult-set.com

nourkoki.com

theveganfusspot.com

dreamssail.com

pinpinyouqian.xyz

satellitphonestore.com

yotosunny.com

telosaolympics.com

gogetemm.com

yozotnpasumo2.xyz

avantgardemarket.com

glenndcp.com

dirtydriverz.com

avaui.com

anchoredtheblog.com

marianaoliveiraarquitetura.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 3 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\shipping docs 07853 draft CI+PL_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\shipping docs 07853 draft CI+PL_pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:668
      • C:\Users\Admin\AppData\Local\Temp\shipping docs 07853 draft CI+PL_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\shipping docs 07853 draft CI+PL_pdf.exe"
        3⤵
          PID:1464
        • C:\Users\Admin\AppData\Local\Temp\shipping docs 07853 draft CI+PL_pdf.exe
          "C:\Users\Admin\AppData\Local\Temp\shipping docs 07853 draft CI+PL_pdf.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:852
      • C:\Windows\SysWOW64\cmstp.exe
        "C:\Windows\SysWOW64\cmstp.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:816
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\shipping docs 07853 draft CI+PL_pdf.exe"
          3⤵
          • Deletes itself
          PID:1092

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/668-55-0x00000000000E0000-0x00000000000E1000-memory.dmp
      Filesize

      4KB

    • memory/668-57-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
      Filesize

      8KB

    • memory/668-58-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
      Filesize

      4KB

    • memory/668-59-0x0000000000780000-0x0000000000786000-memory.dmp
      Filesize

      24KB

    • memory/668-60-0x0000000004B00000-0x0000000004B4A000-memory.dmp
      Filesize

      296KB

    • memory/816-69-0x0000000000000000-mapping.dmp
    • memory/816-72-0x00000000007E0000-0x00000000007F8000-memory.dmp
      Filesize

      96KB

    • memory/816-75-0x0000000000740000-0x00000000007D0000-memory.dmp
      Filesize

      576KB

    • memory/816-74-0x0000000001F20000-0x0000000002223000-memory.dmp
      Filesize

      3.0MB

    • memory/816-73-0x0000000000090000-0x00000000000B9000-memory.dmp
      Filesize

      164KB

    • memory/852-67-0x0000000000250000-0x0000000000261000-memory.dmp
      Filesize

      68KB

    • memory/852-61-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/852-66-0x0000000000880000-0x0000000000B83000-memory.dmp
      Filesize

      3.0MB

    • memory/852-62-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/852-63-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/852-64-0x000000000041D4C0-mapping.dmp
    • memory/1092-71-0x0000000000000000-mapping.dmp
    • memory/1268-68-0x00000000065C0000-0x00000000066F8000-memory.dmp
      Filesize

      1.2MB

    • memory/1268-76-0x0000000003DB0000-0x0000000003E76000-memory.dmp
      Filesize

      792KB