Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    17-11-2021 08:29

General

  • Target

    SHIPPPING-DOC.xlsx

  • Size

    228KB

  • MD5

    6636e37c6cf98402be8872c4fe796ae3

  • SHA1

    76116e65c89b60e54bb32de4b7140af6468e4c17

  • SHA256

    a468dfc81a56cc61da4831525f4185d374dfa4921e86125129e6b3afe8a90ebe

  • SHA512

    54aeaab0b0096480bc497cfb7f0e9bfcab4e53af55849c39d7fc78557a4e756fa4237723e18aff567a651dd8e3e7a3d4e7b27df5b57878af5563df6bc3ab5b6f

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

mwev

C2

http://www.scion-go-getter.com/mwev/

Decoy

9linefarms.com

meadow-spring.com

texascountrycharts.com

chinatowndeliver.com

grindsword.com

thegurusigavebirthto.com

rip-online.com

lm-safe-keepingtoyof6.xyz

plumbtechconsulting.com

jgoerlach.com

inbloomsolutions.com

foxandmew.com

tikomobile.store

waybunch.com

thepatriottutor.com

qask.top

pharmacylinked.com

ishii-miona.com

sugarandrocks.com

anabolenpower.net

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Xloader Payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1380
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\SHIPPPING-DOC.xlsx
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1480
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
        PID:1300
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Public\vbc.exe"
          3⤵
            PID:1716
      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        PID:1452
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1496
          • C:\Users\Public\vbc.exe
            "C:\Users\Public\vbc.exe"
            3⤵
            • Executes dropped EXE
            PID:916
          • C:\Users\Public\vbc.exe
            "C:\Users\Public\vbc.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:1712

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scripting

      1
      T1064

      Exploitation for Client Execution

      1
      T1203

      Defense Evasion

      Scripting

      1
      T1064

      Modify Registry

      1
      T1112

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Public\vbc.exe
        MD5

        c4839f9e9d80100927eb39678175bbe6

        SHA1

        f88c6cf0e37bce13bf8317f86bbd3640d6badd4d

        SHA256

        945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a

        SHA512

        0166f4b2e46b183691b57715519c7176db7f61578001b4b2cba5e1173e562eb998ad2fa6cbfeddafe408df979b4805afe94bcec478cc4eddc6111046a0c6c073

      • C:\Users\Public\vbc.exe
        MD5

        c4839f9e9d80100927eb39678175bbe6

        SHA1

        f88c6cf0e37bce13bf8317f86bbd3640d6badd4d

        SHA256

        945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a

        SHA512

        0166f4b2e46b183691b57715519c7176db7f61578001b4b2cba5e1173e562eb998ad2fa6cbfeddafe408df979b4805afe94bcec478cc4eddc6111046a0c6c073

      • C:\Users\Public\vbc.exe
        MD5

        c4839f9e9d80100927eb39678175bbe6

        SHA1

        f88c6cf0e37bce13bf8317f86bbd3640d6badd4d

        SHA256

        945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a

        SHA512

        0166f4b2e46b183691b57715519c7176db7f61578001b4b2cba5e1173e562eb998ad2fa6cbfeddafe408df979b4805afe94bcec478cc4eddc6111046a0c6c073

      • C:\Users\Public\vbc.exe
        MD5

        c4839f9e9d80100927eb39678175bbe6

        SHA1

        f88c6cf0e37bce13bf8317f86bbd3640d6badd4d

        SHA256

        945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a

        SHA512

        0166f4b2e46b183691b57715519c7176db7f61578001b4b2cba5e1173e562eb998ad2fa6cbfeddafe408df979b4805afe94bcec478cc4eddc6111046a0c6c073

      • \Users\Public\vbc.exe
        MD5

        c4839f9e9d80100927eb39678175bbe6

        SHA1

        f88c6cf0e37bce13bf8317f86bbd3640d6badd4d

        SHA256

        945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a

        SHA512

        0166f4b2e46b183691b57715519c7176db7f61578001b4b2cba5e1173e562eb998ad2fa6cbfeddafe408df979b4805afe94bcec478cc4eddc6111046a0c6c073

      • \Users\Public\vbc.exe
        MD5

        c4839f9e9d80100927eb39678175bbe6

        SHA1

        f88c6cf0e37bce13bf8317f86bbd3640d6badd4d

        SHA256

        945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a

        SHA512

        0166f4b2e46b183691b57715519c7176db7f61578001b4b2cba5e1173e562eb998ad2fa6cbfeddafe408df979b4805afe94bcec478cc4eddc6111046a0c6c073

      • \Users\Public\vbc.exe
        MD5

        c4839f9e9d80100927eb39678175bbe6

        SHA1

        f88c6cf0e37bce13bf8317f86bbd3640d6badd4d

        SHA256

        945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a

        SHA512

        0166f4b2e46b183691b57715519c7176db7f61578001b4b2cba5e1173e562eb998ad2fa6cbfeddafe408df979b4805afe94bcec478cc4eddc6111046a0c6c073

      • \Users\Public\vbc.exe
        MD5

        c4839f9e9d80100927eb39678175bbe6

        SHA1

        f88c6cf0e37bce13bf8317f86bbd3640d6badd4d

        SHA256

        945e623b814b647326ed96bc5be37010053fdc50f9dce11d96e408c22a8afd4a

        SHA512

        0166f4b2e46b183691b57715519c7176db7f61578001b4b2cba5e1173e562eb998ad2fa6cbfeddafe408df979b4805afe94bcec478cc4eddc6111046a0c6c073

      • memory/1300-87-0x0000000000080000-0x00000000000A9000-memory.dmp
        Filesize

        164KB

      • memory/1300-86-0x0000000000E00000-0x0000000000E08000-memory.dmp
        Filesize

        32KB

      • memory/1300-85-0x0000000000000000-mapping.dmp
      • memory/1380-81-0x00000000070B0000-0x00000000071D5000-memory.dmp
        Filesize

        1.1MB

      • memory/1380-84-0x00000000049D0000-0x0000000004AA0000-memory.dmp
        Filesize

        832KB

      • memory/1452-58-0x0000000075981000-0x0000000075983000-memory.dmp
        Filesize

        8KB

      • memory/1480-55-0x000000002F7F1000-0x000000002F7F4000-memory.dmp
        Filesize

        12KB

      • memory/1480-88-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/1480-56-0x0000000070EB1000-0x0000000070EB3000-memory.dmp
        Filesize

        8KB

      • memory/1480-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/1496-69-0x00000000002E0000-0x00000000002E7000-memory.dmp
        Filesize

        28KB

      • memory/1496-70-0x0000000000F10000-0x0000000000F5E000-memory.dmp
        Filesize

        312KB

      • memory/1496-71-0x00000000009D0000-0x00000000009FC000-memory.dmp
        Filesize

        176KB

      • memory/1496-66-0x00000000010C0000-0x00000000010C1000-memory.dmp
        Filesize

        4KB

      • memory/1496-68-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
        Filesize

        4KB

      • memory/1496-63-0x0000000000000000-mapping.dmp
      • memory/1712-73-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

      • memory/1712-82-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

      • memory/1712-83-0x0000000000260000-0x0000000000271000-memory.dmp
        Filesize

        68KB

      • memory/1712-80-0x0000000000210000-0x0000000000221000-memory.dmp
        Filesize

        68KB

      • memory/1712-79-0x0000000000870000-0x0000000000B73000-memory.dmp
        Filesize

        3.0MB

      • memory/1712-76-0x000000000041D480-mapping.dmp
      • memory/1712-75-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

      • memory/1712-74-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB