Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    16-11-2021 21:13

General

  • Target

    soa#2021011015.exe

  • Size

    286KB

  • MD5

    77f19e38f4e1eeb655d01114be0e710c

  • SHA1

    a7bbc2ed7b159f441107d43dcceca5be98623556

  • SHA256

    f9744d616627a9e5640bfb7cc0c88b03e52b53141f1647c57a3b3d77766d510d

  • SHA512

    1c0f548fe3cc9e4a7ac16d7365b7f11f475b9e78daff61b548d1a7f45b7c5b633d82fdb770b079dfd51bbb0d5ee85a8891c411d1de925720184385071101db5f

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

e8ia

C2

http://www.helpfromjames.com/e8ia/

Decoy

le-hameau-enchanteur.com

quantumsystem-au.club

engravedeeply.com

yesrecompensas.lat

cavallitowerofficials.com

800seaspray.com

skifun-jetski.com

thouartafoot.com

nft2dollar.com

petrestore.online

cjcutthecord2.com

tippimccullough.com

gadget198.xyz

djmiriam.com

bitbasepay.com

cukierniawz.com

mcclureic.xyz

inthekitchenshakinandbakin.com

busy-clicks.com

melaniemorris.online

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\soa#2021011015.exe
      "C:\Users\Admin\AppData\Local\Temp\soa#2021011015.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Users\Admin\AppData\Local\Temp\soa#2021011015.exe
        "C:\Users\Admin\AppData\Local\Temp\soa#2021011015.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3032
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:2992
      • C:\Windows\SysWOW64\rundll32.exe
        "C:\Windows\SysWOW64\rundll32.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2756
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\soa#2021011015.exe"
          3⤵
            PID:4052

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • \Users\Admin\AppData\Local\Temp\nseB4CB.tmp\hiib.dll
        MD5

        0aecec56e3ae0fb3d77c3c2c35d2a147

        SHA1

        f6478611f5048e9f7d6b79c29e4e187ae15b2ada

        SHA256

        d22526223a8d35f173f0704477783bbe564d69babbef43aa2133b8ca4172dd27

        SHA512

        5009e773fee22b766edb902b850864b062cdf01b77bdf5ada7f9cf8b889b788b0aefc73be5e6f2af0d2b252a229001b8f3aa64989cdcf917561916dd3fbae0ae

      • memory/2756-127-0x0000000002910000-0x0000000002939000-memory.dmp
        Filesize

        164KB

      • memory/2756-130-0x00000000045B0000-0x0000000004640000-memory.dmp
        Filesize

        576KB

      • memory/2756-129-0x00000000047E0000-0x0000000004B00000-memory.dmp
        Filesize

        3.1MB

      • memory/2756-125-0x0000000000000000-mapping.dmp
      • memory/2756-126-0x00000000008B0000-0x00000000008C3000-memory.dmp
        Filesize

        76KB

      • memory/3016-131-0x0000000005B80000-0x0000000005D0C000-memory.dmp
        Filesize

        1.5MB

      • memory/3016-124-0x0000000005A10000-0x0000000005B78000-memory.dmp
        Filesize

        1.4MB

      • memory/3032-123-0x0000000000490000-0x000000000053E000-memory.dmp
        Filesize

        696KB

      • memory/3032-122-0x0000000000A40000-0x0000000000D60000-memory.dmp
        Filesize

        3.1MB

      • memory/3032-120-0x000000000041D4D0-mapping.dmp
      • memory/3032-119-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

      • memory/4052-128-0x0000000000000000-mapping.dmp