Analysis
- max time kernel
151s - max time network
152s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
02/11/2021, 10:31
General
- Target Halkbank_Ekstre_20211102_082357_541079.exe
- Size 918KB
- Sample211102-mkdfxahcdq
- SHA256 a5f047cd5a1f181b220f8a68e01f7003c3f81d5b6601a4578977b89cf4ea5246
Malware Config
Extracted
-
xloader
-
2.5
-
n5fq
-
http://www.hanseionlinemarketing.com/n5fq/
-
refinanceforblue.com
-
davantra.com
-
bigdroneparts.com
-
reno-ottawa.com
-
jnwgjn.com
-
vatikanlottery.com
-
swat.solutions
-
specialist-david.com
-
donnagennaro.com
-
f9store.com
-
acabarcomaherpes.com
-
covapa2.com
-
ampillfy.com
-
yourealways.space
-
caffeetcompany.online
-
brimstrategy.com
-
neumaticosjhoma.com
-
fortuneacademytrading.com
-
web-control.biz
-
quickiter.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies registry key 1 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20211102_082357_541079.exe"C:\Users\Admin\AppData\Local\Temp\Halkbank_Ekstre_20211102_082357_541079.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mobsync.exeC:\Windows\System32\mobsync.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f5⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "5⤵
- Modifies registry key
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I5⤵
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
-
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1792-184-0x0000000005590000-0x00000000058B0000-memory.dmp
memory/1792-188-0x00000000053E0000-0x0000000005470000-memory.dmp
memory/1792-182-0x0000000000A20000-0x0000000000A2A000-memory.dmp
memory/1792-183-0x00000000050A0000-0x00000000050C9000-memory.dmp
memory/2372-125-0x0000000072480000-0x00000000724AA000-memory.dmp
memory/2372-141-0x00000000047A0000-0x0000000004AC0000-memory.dmp
memory/2372-127-0x0000000072480000-0x00000000724AA000-memory.dmp
memory/2372-124-0x0000000000540000-0x0000000000541000-memory.dmp
memory/2372-143-0x0000000002CE0000-0x0000000002CF1000-memory.dmp
memory/3028-178-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-208-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-139-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-140-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-137-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-136-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-144-0x00000000021A0000-0x00000000021B0000-memory.dmp
memory/3028-142-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-145-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-147-0x0000000000750000-0x0000000000760000-memory.dmp
memory/3028-148-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-149-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-151-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-152-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-150-0x0000000002150000-0x0000000002160000-memory.dmp
memory/3028-146-0x0000000005D30000-0x0000000005E99000-memory.dmp
memory/3028-156-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-154-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-158-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-160-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-159-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-157-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-155-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-153-0x00000000021A0000-0x00000000021B0000-memory.dmp
memory/3028-162-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-161-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-164-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-165-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-163-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-167-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-169-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-168-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-166-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-171-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-170-0x00000000021A0000-0x00000000021B0000-memory.dmp
memory/3028-173-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-174-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-175-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-176-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-135-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-179-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-180-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-177-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-172-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-134-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-133-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-132-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-131-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-232-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-231-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-230-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-130-0x0000000000750000-0x0000000000760000-memory.dmp
memory/3028-128-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-129-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-189-0x0000000006AB0000-0x0000000006C10000-memory.dmp
memory/3028-190-0x0000000000750000-0x0000000000760000-memory.dmp
memory/3028-191-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-192-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-193-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-194-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-195-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-196-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-197-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-198-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-199-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-200-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-201-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-202-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-203-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-205-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-204-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-206-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-207-0x00000000007A0000-0x00000000007A2000-memory.dmp
memory/3028-138-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-209-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-210-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-211-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-212-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-214-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-213-0x0000000000750000-0x0000000000760000-memory.dmp
memory/3028-216-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-215-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-218-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-217-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-219-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-220-0x00000000007C0000-0x00000000007D0000-memory.dmp
memory/3028-222-0x00000000007C0000-0x00000000007D0000-memory.dmp
memory/3028-221-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-223-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-224-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-225-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-226-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-227-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-229-0x0000000000840000-0x0000000000850000-memory.dmp
memory/3028-228-0x00000000007C0000-0x00000000007D0000-memory.dmp
memory/3220-115-0x0000000000600000-0x000000000074A000-memory.dmp