Analysis

  • max time kernel
    152s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    09-12-2021 08:33

General

  • Target

    tmp/19f62fdd0c1ca0d335c9ed2ae709637e2ab541041560c832dda236ea0823f328.xls

  • Size

    229KB

  • MD5

    a9d8f1f85206f809e72b738ecbc910fc

  • SHA1

    3e7ca57c49da25b596f9b5e6d3e5a89ff7eb37a5

  • SHA256

    19f62fdd0c1ca0d335c9ed2ae709637e2ab541041560c832dda236ea0823f328

  • SHA512

    659c34b559725de451075384b6f5d79133d9769d4ce4782527605f233b6de7ca3d4e8f40e6419ba66e35152c9a30258c95530be12d94223469bcca815b9f39b7

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ef6c

C2

http://www.fis.photos/ef6c/

Decoy

gicaredocs.com

govusergroup.com

conversationspit.com

brondairy.com

rjtherealest.com

xn--9m1bq8wgkag3rjvb.com

mylori.net

softandcute.store

ahljsm.com

shacksolid.com

weekendmusecollection.com

gaminghallarna.net

pgonline111.online

44mpt.xyz

ambrandt.com

eddytattoo.com

blendeqes.com

upinmyfeels.com

lacucinadesign.com

docomoau.xyz

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:1436
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\tmp\19f62fdd0c1ca0d335c9ed2ae709637e2ab541041560c832dda236ea0823f328.xls
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:800
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Launches Equation Editor
    • Suspicious use of WriteProcessMemory
    PID:576
    • C:\Users\Public\vbc.exe
      "C:\Users\Public\vbc.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1904
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:968
        • C:\Windows\SysWOW64\control.exe
          "C:\Windows\SysWOW64\control.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:584
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Public\vbc.exe"
            5⤵
              PID:1588

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Exploitation for Client Execution

    1
    T1203

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\vbc.exe
      MD5

      35cba6887bbfec435d5756c7cc594e46

      SHA1

      091cf75c18fe06b74e0ab9df38bac6319046b35e

      SHA256

      b9899f8fb99acdf4315b884d1289bab11aa6d7935e3b3d4744898c4aa88f8eaf

      SHA512

      dcf79711e776819667b7254900a0fcc30124cc8271d357abae2057d444dd3cf230894d83f87f217291777b14e72775d60897a3450badda8a90b7e6b72bd7407c

    • C:\Users\Public\vbc.exe
      MD5

      35cba6887bbfec435d5756c7cc594e46

      SHA1

      091cf75c18fe06b74e0ab9df38bac6319046b35e

      SHA256

      b9899f8fb99acdf4315b884d1289bab11aa6d7935e3b3d4744898c4aa88f8eaf

      SHA512

      dcf79711e776819667b7254900a0fcc30124cc8271d357abae2057d444dd3cf230894d83f87f217291777b14e72775d60897a3450badda8a90b7e6b72bd7407c

    • C:\Users\Public\vbc.exe
      MD5

      35cba6887bbfec435d5756c7cc594e46

      SHA1

      091cf75c18fe06b74e0ab9df38bac6319046b35e

      SHA256

      b9899f8fb99acdf4315b884d1289bab11aa6d7935e3b3d4744898c4aa88f8eaf

      SHA512

      dcf79711e776819667b7254900a0fcc30124cc8271d357abae2057d444dd3cf230894d83f87f217291777b14e72775d60897a3450badda8a90b7e6b72bd7407c

    • \Users\Public\vbc.exe
      MD5

      35cba6887bbfec435d5756c7cc594e46

      SHA1

      091cf75c18fe06b74e0ab9df38bac6319046b35e

      SHA256

      b9899f8fb99acdf4315b884d1289bab11aa6d7935e3b3d4744898c4aa88f8eaf

      SHA512

      dcf79711e776819667b7254900a0fcc30124cc8271d357abae2057d444dd3cf230894d83f87f217291777b14e72775d60897a3450badda8a90b7e6b72bd7407c

    • \Users\Public\vbc.exe
      MD5

      35cba6887bbfec435d5756c7cc594e46

      SHA1

      091cf75c18fe06b74e0ab9df38bac6319046b35e

      SHA256

      b9899f8fb99acdf4315b884d1289bab11aa6d7935e3b3d4744898c4aa88f8eaf

      SHA512

      dcf79711e776819667b7254900a0fcc30124cc8271d357abae2057d444dd3cf230894d83f87f217291777b14e72775d60897a3450badda8a90b7e6b72bd7407c

    • \Users\Public\vbc.exe
      MD5

      35cba6887bbfec435d5756c7cc594e46

      SHA1

      091cf75c18fe06b74e0ab9df38bac6319046b35e

      SHA256

      b9899f8fb99acdf4315b884d1289bab11aa6d7935e3b3d4744898c4aa88f8eaf

      SHA512

      dcf79711e776819667b7254900a0fcc30124cc8271d357abae2057d444dd3cf230894d83f87f217291777b14e72775d60897a3450badda8a90b7e6b72bd7407c

    • \Users\Public\vbc.exe
      MD5

      35cba6887bbfec435d5756c7cc594e46

      SHA1

      091cf75c18fe06b74e0ab9df38bac6319046b35e

      SHA256

      b9899f8fb99acdf4315b884d1289bab11aa6d7935e3b3d4744898c4aa88f8eaf

      SHA512

      dcf79711e776819667b7254900a0fcc30124cc8271d357abae2057d444dd3cf230894d83f87f217291777b14e72775d60897a3450badda8a90b7e6b72bd7407c

    • memory/576-56-0x0000000075F21000-0x0000000075F23000-memory.dmp
      Filesize

      8KB

    • memory/584-86-0x0000000001F90000-0x0000000002293000-memory.dmp
      Filesize

      3.0MB

    • memory/584-81-0x0000000000000000-mapping.dmp
    • memory/584-88-0x0000000000A90000-0x0000000000B20000-memory.dmp
      Filesize

      576KB

    • memory/584-84-0x0000000000080000-0x00000000000A9000-memory.dmp
      Filesize

      164KB

    • memory/584-83-0x0000000000B70000-0x0000000000B8F000-memory.dmp
      Filesize

      124KB

    • memory/800-87-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/800-54-0x0000000071121000-0x0000000071123000-memory.dmp
      Filesize

      8KB

    • memory/800-55-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/800-53-0x000000002F701000-0x000000002F704000-memory.dmp
      Filesize

      12KB

    • memory/968-79-0x0000000000250000-0x0000000000261000-memory.dmp
      Filesize

      68KB

    • memory/968-69-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/968-70-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/968-72-0x000000000041D3D0-mapping.dmp
    • memory/968-71-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/968-77-0x0000000000110000-0x0000000000121000-memory.dmp
      Filesize

      68KB

    • memory/968-75-0x0000000000850000-0x0000000000B53000-memory.dmp
      Filesize

      3.0MB

    • memory/968-78-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1436-80-0x0000000007510000-0x0000000007616000-memory.dmp
      Filesize

      1.0MB

    • memory/1436-76-0x0000000006C90000-0x0000000006E1F000-memory.dmp
      Filesize

      1.6MB

    • memory/1436-89-0x0000000006060000-0x00000000060FA000-memory.dmp
      Filesize

      616KB

    • memory/1588-85-0x0000000000000000-mapping.dmp
    • memory/1904-68-0x0000000007E00000-0x0000000007F16000-memory.dmp
      Filesize

      1.1MB

    • memory/1904-67-0x0000000000430000-0x0000000000437000-memory.dmp
      Filesize

      28KB

    • memory/1904-66-0x0000000000F60000-0x0000000000F61000-memory.dmp
      Filesize

      4KB

    • memory/1904-64-0x0000000001290000-0x0000000001291000-memory.dmp
      Filesize

      4KB

    • memory/1904-61-0x0000000000000000-mapping.dmp