Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    01-11-2021 09:39

General

  • Target

    SHIPPPING-DOC.xlsx

  • Size

    178KB

  • MD5

    61dc051559f4f08663a1799a71bc9268

  • SHA1

    7e9cd8bb5f1652cb47d233d04acba4ab2bf61c59

  • SHA256

    0d751d40a03bed2ac847a0444db91dda693aed08c77a1cbbf3968345df66fed7

  • SHA512

    9d70757c20fcf79743daf3db7e094adc940cd0dad20dbadb837213e564c9647fccb5695f65c0f80abf1f9634d335c90ca2f0cf75d4f196e1892b806417338501

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mwev

C2

http://www.scion-go-getter.com/mwev/

Decoy

9linefarms.com

meadow-spring.com

texascountrycharts.com

chinatowndeliver.com

grindsword.com

thegurusigavebirthto.com

rip-online.com

lm-safe-keepingtoyof6.xyz

plumbtechconsulting.com

jgoerlach.com

inbloomsolutions.com

foxandmew.com

tikomobile.store

waybunch.com

thepatriottutor.com

qask.top

pharmacylinked.com

ishii-miona.com

sugarandrocks.com

anabolenpower.net

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Xloader Payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SHIPPPING-DOC.xlsx
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:836
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:944
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Public\vbc.exe"
        3⤵
          PID:2036
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:828
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1728
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          PID:2024
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1948

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Exploitation for Client Execution

    1
    T1203

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\vbc.exe
      MD5

      c0225f76705c05744918c724e3018649

      SHA1

      8fb4c2a855204c51c630b69ccfdf10f1135fe01e

      SHA256

      99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c

      SHA512

      04b016e7b30c59e316a5b82e42560a82892c52d2fca26e6eacb9fdc2b1254c4b544467a1617989f3166606c8f0d7ebb4e0d85400bab785d29a6cd15e71e5da1c

    • C:\Users\Public\vbc.exe
      MD5

      c0225f76705c05744918c724e3018649

      SHA1

      8fb4c2a855204c51c630b69ccfdf10f1135fe01e

      SHA256

      99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c

      SHA512

      04b016e7b30c59e316a5b82e42560a82892c52d2fca26e6eacb9fdc2b1254c4b544467a1617989f3166606c8f0d7ebb4e0d85400bab785d29a6cd15e71e5da1c

    • C:\Users\Public\vbc.exe
      MD5

      c0225f76705c05744918c724e3018649

      SHA1

      8fb4c2a855204c51c630b69ccfdf10f1135fe01e

      SHA256

      99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c

      SHA512

      04b016e7b30c59e316a5b82e42560a82892c52d2fca26e6eacb9fdc2b1254c4b544467a1617989f3166606c8f0d7ebb4e0d85400bab785d29a6cd15e71e5da1c

    • C:\Users\Public\vbc.exe
      MD5

      c0225f76705c05744918c724e3018649

      SHA1

      8fb4c2a855204c51c630b69ccfdf10f1135fe01e

      SHA256

      99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c

      SHA512

      04b016e7b30c59e316a5b82e42560a82892c52d2fca26e6eacb9fdc2b1254c4b544467a1617989f3166606c8f0d7ebb4e0d85400bab785d29a6cd15e71e5da1c

    • \Users\Public\vbc.exe
      MD5

      c0225f76705c05744918c724e3018649

      SHA1

      8fb4c2a855204c51c630b69ccfdf10f1135fe01e

      SHA256

      99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c

      SHA512

      04b016e7b30c59e316a5b82e42560a82892c52d2fca26e6eacb9fdc2b1254c4b544467a1617989f3166606c8f0d7ebb4e0d85400bab785d29a6cd15e71e5da1c

    • \Users\Public\vbc.exe
      MD5

      c0225f76705c05744918c724e3018649

      SHA1

      8fb4c2a855204c51c630b69ccfdf10f1135fe01e

      SHA256

      99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c

      SHA512

      04b016e7b30c59e316a5b82e42560a82892c52d2fca26e6eacb9fdc2b1254c4b544467a1617989f3166606c8f0d7ebb4e0d85400bab785d29a6cd15e71e5da1c

    • \Users\Public\vbc.exe
      MD5

      c0225f76705c05744918c724e3018649

      SHA1

      8fb4c2a855204c51c630b69ccfdf10f1135fe01e

      SHA256

      99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c

      SHA512

      04b016e7b30c59e316a5b82e42560a82892c52d2fca26e6eacb9fdc2b1254c4b544467a1617989f3166606c8f0d7ebb4e0d85400bab785d29a6cd15e71e5da1c

    • \Users\Public\vbc.exe
      MD5

      c0225f76705c05744918c724e3018649

      SHA1

      8fb4c2a855204c51c630b69ccfdf10f1135fe01e

      SHA256

      99889ef9126eddb7fee40e181c9832c734f8cef74736e2c577438300b468751c

      SHA512

      04b016e7b30c59e316a5b82e42560a82892c52d2fca26e6eacb9fdc2b1254c4b544467a1617989f3166606c8f0d7ebb4e0d85400bab785d29a6cd15e71e5da1c

    • memory/828-57-0x0000000076201000-0x0000000076203000-memory.dmp
      Filesize

      8KB

    • memory/836-87-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/836-55-0x0000000071251000-0x0000000071253000-memory.dmp
      Filesize

      8KB

    • memory/836-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/836-54-0x000000002FA01000-0x000000002FA04000-memory.dmp
      Filesize

      12KB

    • memory/944-85-0x0000000000E20000-0x0000000000EB0000-memory.dmp
      Filesize

      576KB

    • memory/944-84-0x0000000000B10000-0x0000000000E13000-memory.dmp
      Filesize

      3.0MB

    • memory/944-83-0x0000000000170000-0x0000000000199000-memory.dmp
      Filesize

      164KB

    • memory/944-82-0x0000000000F80000-0x0000000000FA2000-memory.dmp
      Filesize

      136KB

    • memory/944-80-0x0000000000000000-mapping.dmp
    • memory/1428-86-0x0000000006430000-0x00000000064D0000-memory.dmp
      Filesize

      640KB

    • memory/1428-79-0x0000000006370000-0x000000000642A000-memory.dmp
      Filesize

      744KB

    • memory/1728-62-0x0000000000000000-mapping.dmp
    • memory/1728-69-0x00000000047F0000-0x000000000483C000-memory.dmp
      Filesize

      304KB

    • memory/1728-68-0x0000000000320000-0x0000000000327000-memory.dmp
      Filesize

      28KB

    • memory/1728-67-0x0000000004390000-0x0000000004391000-memory.dmp
      Filesize

      4KB

    • memory/1728-65-0x0000000000080000-0x0000000000081000-memory.dmp
      Filesize

      4KB

    • memory/1948-78-0x0000000000210000-0x0000000000221000-memory.dmp
      Filesize

      68KB

    • memory/1948-77-0x0000000000AC0000-0x0000000000DC3000-memory.dmp
      Filesize

      3.0MB

    • memory/1948-73-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1948-74-0x000000000041D480-mapping.dmp
    • memory/1948-72-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1948-71-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/2036-81-0x0000000000000000-mapping.dmp