Analysis

  • max time kernel
    150s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    26-11-2021 12:52

General

  • Target

    Confirmacion del pedido.exe

  • Size

    714KB

  • MD5

    ccd3033369c99ff56f71d9d8e3aa80e6

  • SHA1

    bc325d0a1cfdfccb5816b8fb9f77fef0b9493da4

  • SHA256

    34443c2f4cf165f96c3eaffb93f2a7b3628ebed8ed119b3ef2ad3e5dc450e0a0

  • SHA512

    68bfda7b188cb25acc75af7d86c25b30a19ce00d53b16b50df251bb289280baf4a467266323a07f19c9dcf5eb9366a0e5c8c268d33598bb3d40864b24aba085b

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pvxz

C2

http://www.finetipster.com/pvxz/

Decoy

imt-token.club

abravewayocen.online

shcloudcar.com

mshoppingworld.online

ncgf08.xyz

stuinfo.xyz

wesavetheplanetofficial.com

tourbox.xyz

believeinyourselftraining.com

jsboyat.com

aaeconomy.info

9etmorea.info

purosepeti7.com

goticketly.com

pinkmemorypt.com

mylifewellnesscentre.com

iridina.online

petrestore.online

neema.xyz

novelfooditalia.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 4 IoCs
  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\Confirmacion del pedido.exe
      "C:\Users\Admin\AppData\Local\Temp\Confirmacion del pedido.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:852
      • C:\Users\Admin\AppData\Local\Temp\Confirmacion del pedido.exe
        "C:\Users\Admin\AppData\Local\Temp\Confirmacion del pedido.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1036
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1440
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Confirmacion del pedido.exe"
        3⤵
        • Deletes itself
        PID:1776

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/852-56-0x0000000000230000-0x0000000000231000-memory.dmp
    Filesize

    4KB

  • memory/852-57-0x0000000000381000-0x0000000000395000-memory.dmp
    Filesize

    80KB

  • memory/852-55-0x0000000075491000-0x0000000075493000-memory.dmp
    Filesize

    8KB

  • memory/1036-66-0x0000000000730000-0x0000000000741000-memory.dmp
    Filesize

    68KB

  • memory/1036-58-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1036-59-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1036-60-0x000000000041D460-mapping.dmp
  • memory/1036-63-0x0000000000460000-0x0000000000471000-memory.dmp
    Filesize

    68KB

  • memory/1036-62-0x0000000000750000-0x0000000000A53000-memory.dmp
    Filesize

    3.0MB

  • memory/1036-65-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1192-64-0x0000000007210000-0x0000000007375000-memory.dmp
    Filesize

    1.4MB

  • memory/1192-67-0x0000000006390000-0x00000000064A0000-memory.dmp
    Filesize

    1.1MB

  • memory/1192-74-0x0000000004360000-0x0000000004432000-memory.dmp
    Filesize

    840KB

  • memory/1440-68-0x0000000000000000-mapping.dmp
  • memory/1440-70-0x0000000000A30000-0x0000000000A38000-memory.dmp
    Filesize

    32KB

  • memory/1440-71-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

  • memory/1440-72-0x0000000000A40000-0x0000000000D43000-memory.dmp
    Filesize

    3.0MB

  • memory/1440-73-0x0000000000600000-0x0000000000690000-memory.dmp
    Filesize

    576KB

  • memory/1776-69-0x0000000000000000-mapping.dmp