Analysis

  • max time kernel
    160s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    26-11-2021 12:52

General

  • Target

    Confirmacion del pedido.exe

  • Size

    714KB

  • MD5

    ccd3033369c99ff56f71d9d8e3aa80e6

  • SHA1

    bc325d0a1cfdfccb5816b8fb9f77fef0b9493da4

  • SHA256

    34443c2f4cf165f96c3eaffb93f2a7b3628ebed8ed119b3ef2ad3e5dc450e0a0

  • SHA512

    68bfda7b188cb25acc75af7d86c25b30a19ce00d53b16b50df251bb289280baf4a467266323a07f19c9dcf5eb9366a0e5c8c268d33598bb3d40864b24aba085b

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pvxz

C2

http://www.finetipster.com/pvxz/

Decoy

imt-token.club

abravewayocen.online

shcloudcar.com

mshoppingworld.online

ncgf08.xyz

stuinfo.xyz

wesavetheplanetofficial.com

tourbox.xyz

believeinyourselftraining.com

jsboyat.com

aaeconomy.info

9etmorea.info

purosepeti7.com

goticketly.com

pinkmemorypt.com

mylifewellnesscentre.com

iridina.online

petrestore.online

neema.xyz

novelfooditalia.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\Confirmacion del pedido.exe
      "C:\Users\Admin\AppData\Local\Temp\Confirmacion del pedido.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3536
      • C:\Users\Admin\AppData\Local\Temp\Confirmacion del pedido.exe
        "C:\Users\Admin\AppData\Local\Temp\Confirmacion del pedido.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4532
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:696
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Confirmacion del pedido.exe"
        3⤵
          PID:3696

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/696-126-0x0000000000000000-mapping.dmp
    • memory/696-131-0x00000000047F0000-0x0000000004880000-memory.dmp
      Filesize

      576KB

    • memory/696-129-0x0000000000F10000-0x0000000001230000-memory.dmp
      Filesize

      3.1MB

    • memory/696-128-0x0000000000600000-0x0000000000629000-memory.dmp
      Filesize

      164KB

    • memory/696-127-0x0000000001240000-0x000000000125F000-memory.dmp
      Filesize

      124KB

    • memory/2060-125-0x0000000005D60000-0x0000000005E83000-memory.dmp
      Filesize

      1.1MB

    • memory/2060-132-0x0000000005E90000-0x0000000006017000-memory.dmp
      Filesize

      1.5MB

    • memory/3536-118-0x00000000020E0000-0x00000000020E1000-memory.dmp
      Filesize

      4KB

    • memory/3536-119-0x00000000025B1000-0x00000000025C5000-memory.dmp
      Filesize

      80KB

    • memory/3696-130-0x0000000000000000-mapping.dmp
    • memory/4532-123-0x0000000000A00000-0x0000000000D20000-memory.dmp
      Filesize

      3.1MB

    • memory/4532-124-0x00000000009C0000-0x00000000009D1000-memory.dmp
      Filesize

      68KB

    • memory/4532-121-0x000000000041D460-mapping.dmp
    • memory/4532-120-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB