Analysis
- max time kernel
152s - max time network
151s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
09/11/2021, 11:27
General
- Target REQUEST FOR QUOTATION.exe
- Size 481KB
- Sample211109-nkeveacbdj
- SHA256 84bbdc0b303d03c1ef4ee6d48dedd94181d8fc5650a20b557a555b0917aaf879
Malware Config
Extracted
-
xloader
-
2.5
-
p0se
-
http://www.graylinkelectric.com/p0se/
-
gayko.info
-
mgav67.xyz
-
serestovfleacollar.com
-
thievingfo.rest
-
theleadersmanifesto.com
-
mrteez.club
-
veryimportantagent.club
-
equitymedia.biz
-
standoutbeseen.com
-
antelbd.com
-
bailios.com
-
ftmex.net
-
oprimanumerodos.com
-
cbtnightmares.com
-
y0heykod2.xyz
-
iscinet.com
-
nutri6si.com
-
heavensplacerc.net
-
trungtambtx.com
-
tkxjx.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR QUOTATION.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/752-125-0x0000000004400000-0x0000000004720000-memory.dmp
memory/752-124-0x0000000002A00000-0x0000000002A29000-memory.dmp
memory/752-123-0x0000000000370000-0x0000000000383000-memory.dmp
memory/752-127-0x0000000004180000-0x0000000004210000-memory.dmp
memory/2792-121-0x0000000006E30000-0x0000000006F93000-memory.dmp
memory/2792-128-0x0000000001250000-0x00000000012F7000-memory.dmp
memory/2992-119-0x0000000000AF0000-0x0000000000E10000-memory.dmp
memory/2992-120-0x00000000009D0000-0x00000000009E1000-memory.dmp
memory/2992-116-0x0000000000400000-0x0000000000429000-memory.dmp