Analysis
- max time kernel
151s - max time network
151s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
25/11/2021, 07:01
General
- Target Shipping documents.exe
- Size 737KB
- Sample211125-hs8jsseeak
- SHA256 82d5d5ef76ff7a708df5ea9135cb18117428ad1cbdcaa938989a3559a6ff5b97
Malware Config
Extracted
-
xloader
-
2.5
-
ea0r
-
http://www.asiapubz-hk.com/ea0r/
-
lionheartcreativestudios.com
-
konzertmanagement.com
-
blackpanther.online
-
broychim-int.com
-
takut18.com
-
txstarsolar.com
-
herdsherpa.com
-
igorshestakov.com
-
shinesbox.com
-
reflectpkljlt.xyz
-
oiltoolshub.com
-
viralmoneychallenge.com
-
changingalphastrategies.com
-
mecitiris.com
-
rdadmin.online
-
miniambiente.com
-
kominarcine.com
-
pino-almond.com
-
heihit.xyz
-
junqi888.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 47 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QAGyjBsWtATTv.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QAGyjBsWtATTv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp81FD.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2820-117-0x0000000008050000-0x0000000008051000-memory.dmp
memory/2820-118-0x0000000007B50000-0x0000000007B51000-memory.dmp
memory/2820-119-0x0000000007B50000-0x000000000804E000-memory.dmp
memory/2820-120-0x0000000007BF0000-0x0000000007BF1000-memory.dmp
memory/2820-121-0x0000000007CF0000-0x0000000007CF4000-memory.dmp
memory/2820-122-0x000000000A140000-0x000000000A141000-memory.dmp
memory/2820-123-0x0000000002F20000-0x0000000002F90000-memory.dmp
memory/2820-115-0x0000000000D90000-0x0000000000D91000-memory.dmp
memory/3024-388-0x00000000056B0000-0x0000000005765000-memory.dmp
memory/3024-143-0x0000000002F70000-0x000000000304C000-memory.dmp
memory/3048-173-0x0000000000C00000-0x0000000000C29000-memory.dmp
memory/3048-175-0x0000000004340000-0x0000000004660000-memory.dmp
memory/3048-172-0x0000000000F20000-0x0000000000F3F000-memory.dmp
memory/3048-387-0x0000000000E00000-0x0000000000E90000-memory.dmp
memory/3312-137-0x00000000075B0000-0x00000000075B1000-memory.dmp
memory/3312-130-0x0000000006F10000-0x0000000006F11000-memory.dmp
memory/3312-134-0x0000000004462000-0x0000000004463000-memory.dmp
memory/3312-138-0x0000000007700000-0x0000000007701000-memory.dmp
memory/3312-139-0x0000000007870000-0x0000000007871000-memory.dmp
memory/3312-142-0x0000000007C40000-0x0000000007C41000-memory.dmp
memory/3312-126-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
memory/3312-133-0x0000000004460000-0x0000000004461000-memory.dmp
memory/3312-144-0x0000000008150000-0x0000000008151000-memory.dmp
memory/3312-145-0x0000000007F60000-0x0000000007F61000-memory.dmp
memory/3312-146-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
memory/3312-153-0x000000007E140000-0x000000007E141000-memory.dmp
memory/3312-154-0x0000000008D20000-0x0000000008D53000-memory.dmp
memory/3312-161-0x0000000008CE0000-0x0000000008CE1000-memory.dmp
memory/3312-127-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
memory/3312-167-0x0000000008E50000-0x0000000008E51000-memory.dmp
memory/3312-174-0x0000000004463000-0x0000000004464000-memory.dmp
memory/3312-169-0x0000000009220000-0x0000000009221000-memory.dmp
memory/3312-136-0x0000000006D90000-0x0000000006D91000-memory.dmp
memory/3312-128-0x0000000004420000-0x0000000004421000-memory.dmp
memory/3704-131-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3704-141-0x00000000015B0000-0x00000000015C1000-memory.dmp
memory/3704-140-0x0000000001650000-0x0000000001970000-memory.dmp