Analysis

  • max time kernel
    151s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    05-11-2021 09:01

General

  • Target

    Potvrda narudzbe je u prilogu.exe

  • Size

    1017KB

  • MD5

    d1fba67f9bf438b8678a2a5d27091658

  • SHA1

    3723e2f1964c30c891c920a602447d65d1e43b52

  • SHA256

    4060e631308ba8b6a91a0c9c567296b39f5bf2e041f3f822fdaaba5c83a37a59

  • SHA512

    8bd2c5330f6687d67d4057fcb613482d396cbcef4b1f9efd4b60d1edfb14504c357b3ccdfbcc589af5086258ac92826a7fb6fcd94ca0ad2e34ce37a46581a860

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pvxz

C2

http://www.finetipster.com/pvxz/

Decoy

imt-token.club

abravewayocen.online

shcloudcar.com

mshoppingworld.online

ncgf08.xyz

stuinfo.xyz

wesavetheplanetofficial.com

tourbox.xyz

believeinyourselftraining.com

jsboyat.com

aaeconomy.info

9etmorea.info

purosepeti7.com

goticketly.com

pinkmemorypt.com

mylifewellnesscentre.com

iridina.online

petrestore.online

neema.xyz

novelfooditalia.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\Potvrda narudzbe je u prilogu.exe
      "C:\Users\Admin\AppData\Local\Temp\Potvrda narudzbe je u prilogu.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2436
      • C:\Windows\SysWOW64\logagent.exe
        C:\Windows\System32\logagent.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3084
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:3296
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:1284
        • C:\Windows\SysWOW64\autoconv.exe
          "C:\Windows\SysWOW64\autoconv.exe"
          2⤵
            PID:1132
          • C:\Windows\SysWOW64\autoconv.exe
            "C:\Windows\SysWOW64\autoconv.exe"
            2⤵
              PID:292
            • C:\Windows\SysWOW64\autoconv.exe
              "C:\Windows\SysWOW64\autoconv.exe"
              2⤵
                PID:844
              • C:\Windows\SysWOW64\autoconv.exe
                "C:\Windows\SysWOW64\autoconv.exe"
                2⤵
                  PID:944
                • C:\Windows\SysWOW64\autoconv.exe
                  "C:\Windows\SysWOW64\autoconv.exe"
                  2⤵
                    PID:1336
                  • C:\Windows\SysWOW64\autoconv.exe
                    "C:\Windows\SysWOW64\autoconv.exe"
                    2⤵
                      PID:1972
                    • C:\Windows\SysWOW64\autoconv.exe
                      "C:\Windows\SysWOW64\autoconv.exe"
                      2⤵
                        PID:2292
                      • C:\Windows\SysWOW64\autoconv.exe
                        "C:\Windows\SysWOW64\autoconv.exe"
                        2⤵
                          PID:2512
                        • C:\Windows\SysWOW64\raserver.exe
                          "C:\Windows\SysWOW64\raserver.exe"
                          2⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2896
                          • C:\Windows\SysWOW64\cmd.exe
                            /c del "C:\Windows\SysWOW64\logagent.exe"
                            3⤵
                              PID:3724

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Persistence

                        Registry Run Keys / Startup Folder

                        1
                        T1060

                        Defense Evasion

                        Modify Registry

                        1
                        T1112

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/2436-119-0x0000000002131000-0x0000000002145000-memory.dmp
                          Filesize

                          80KB

                        • memory/2436-118-0x0000000000660000-0x00000000007AA000-memory.dmp
                          Filesize

                          1.3MB

                        • memory/2896-129-0x0000000001220000-0x000000000123F000-memory.dmp
                          Filesize

                          124KB

                        • memory/2896-132-0x0000000000D00000-0x0000000000D90000-memory.dmp
                          Filesize

                          576KB

                        • memory/2896-131-0x0000000000EB0000-0x00000000011D0000-memory.dmp
                          Filesize

                          3.1MB

                        • memory/2896-130-0x0000000000600000-0x0000000000629000-memory.dmp
                          Filesize

                          164KB

                        • memory/2896-127-0x0000000000000000-mapping.dmp
                        • memory/3040-133-0x0000000006AD0000-0x0000000006C4E000-memory.dmp
                          Filesize

                          1.5MB

                        • memory/3040-126-0x0000000006930000-0x0000000006ACE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/3084-125-0x0000000004550000-0x0000000004561000-memory.dmp
                          Filesize

                          68KB

                        • memory/3084-124-0x0000000004670000-0x0000000004990000-memory.dmp
                          Filesize

                          3.1MB

                        • memory/3084-121-0x00000000026E0000-0x00000000026E1000-memory.dmp
                          Filesize

                          4KB

                        • memory/3084-122-0x0000000072480000-0x00000000724A9000-memory.dmp
                          Filesize

                          164KB

                        • memory/3084-120-0x0000000000000000-mapping.dmp
                        • memory/3724-128-0x0000000000000000-mapping.dmp