Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    11-01-2022 11:04

General

  • Target

    tmp/2fe50cd698c141231db5d547de06e846312bbddaa3d5e8be0e012cc61de114ed.xls

  • Size

    310KB

  • MD5

    95cbc1f3891ed39e56fa3196a060f94e

  • SHA1

    ca003b9444c4eebeb468985bf53db7f7db52a4a8

  • SHA256

    2fe50cd698c141231db5d547de06e846312bbddaa3d5e8be0e012cc61de114ed

  • SHA512

    163f3d915abdc6042c6f7c39e0b7f7adc7a79a6e7ec96908d352ac1de3292a3c59b3bf7c5be56967249ea0dbc6a8763a0c18efd269195d3d44973aec0023b57c

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 12 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1372
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\tmp\2fe50cd698c141231db5d547de06e846312bbddaa3d5e8be0e012cc61de114ed.xls
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1520
  • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
    1⤵
    • Blocklisted process makes network request
    • Loads dropped DLL
    • Launches Equation Editor
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Users\Public\vbc.exe
      "C:\Users\Public\vbc.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1540
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:836
        • C:\Windows\SysWOW64\msiexec.exe
          "C:\Windows\SysWOW64\msiexec.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1464
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Public\vbc.exe"
            5⤵
              PID:1924

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Exploitation for Client Execution

    1
    T1203

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    1
    T1112

    Discovery

    System Information Discovery

    2
    T1082

    Query Registry

    1
    T1012

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\vbc.exe
      MD5

      886375fa6ecb64fa31dd20b8688216cc

      SHA1

      5b23e5b6fbe5add5b7a891288c66ac2df05dd52a

      SHA256

      4f64511b423d79682dfad8f6b516516d32e801f0031f07b7e3c6c19798a64b95

      SHA512

      5a9065efc8ea242a3efb66e809de949e13f214660d1f79a66a86cfee32f966ae838b5fd6d34aacb7d82d4ebc8682f44364ba917b43d5770c3d7260a99c80a849

    • C:\Users\Public\vbc.exe
      MD5

      886375fa6ecb64fa31dd20b8688216cc

      SHA1

      5b23e5b6fbe5add5b7a891288c66ac2df05dd52a

      SHA256

      4f64511b423d79682dfad8f6b516516d32e801f0031f07b7e3c6c19798a64b95

      SHA512

      5a9065efc8ea242a3efb66e809de949e13f214660d1f79a66a86cfee32f966ae838b5fd6d34aacb7d82d4ebc8682f44364ba917b43d5770c3d7260a99c80a849

    • C:\Users\Public\vbc.exe
      MD5

      886375fa6ecb64fa31dd20b8688216cc

      SHA1

      5b23e5b6fbe5add5b7a891288c66ac2df05dd52a

      SHA256

      4f64511b423d79682dfad8f6b516516d32e801f0031f07b7e3c6c19798a64b95

      SHA512

      5a9065efc8ea242a3efb66e809de949e13f214660d1f79a66a86cfee32f966ae838b5fd6d34aacb7d82d4ebc8682f44364ba917b43d5770c3d7260a99c80a849

    • \Users\Admin\AppData\Local\Temp\nstA5F.tmp\dzqcmmok.dll
      MD5

      26cc8ace0ba0757e74668322ad6c988c

      SHA1

      b6c03df73c62d5cae48365856031bb15be5f30ea

      SHA256

      7602dd51d81cac5ea4f9c90e326bcaf2c445bc4f43a382645a99a2a4b391b836

      SHA512

      ecc36935593ee4ef0092d7ae7e445c2d2665779a7a97a4fe4235f68cfe34a29040a16a343dc9a1ca93ad7f1905f9658349c1bc6768c91822a72eeaa277c7ffac

    • \Users\Public\vbc.exe
      MD5

      886375fa6ecb64fa31dd20b8688216cc

      SHA1

      5b23e5b6fbe5add5b7a891288c66ac2df05dd52a

      SHA256

      4f64511b423d79682dfad8f6b516516d32e801f0031f07b7e3c6c19798a64b95

      SHA512

      5a9065efc8ea242a3efb66e809de949e13f214660d1f79a66a86cfee32f966ae838b5fd6d34aacb7d82d4ebc8682f44364ba917b43d5770c3d7260a99c80a849

    • \Users\Public\vbc.exe
      MD5

      886375fa6ecb64fa31dd20b8688216cc

      SHA1

      5b23e5b6fbe5add5b7a891288c66ac2df05dd52a

      SHA256

      4f64511b423d79682dfad8f6b516516d32e801f0031f07b7e3c6c19798a64b95

      SHA512

      5a9065efc8ea242a3efb66e809de949e13f214660d1f79a66a86cfee32f966ae838b5fd6d34aacb7d82d4ebc8682f44364ba917b43d5770c3d7260a99c80a849

    • \Users\Public\vbc.exe
      MD5

      886375fa6ecb64fa31dd20b8688216cc

      SHA1

      5b23e5b6fbe5add5b7a891288c66ac2df05dd52a

      SHA256

      4f64511b423d79682dfad8f6b516516d32e801f0031f07b7e3c6c19798a64b95

      SHA512

      5a9065efc8ea242a3efb66e809de949e13f214660d1f79a66a86cfee32f966ae838b5fd6d34aacb7d82d4ebc8682f44364ba917b43d5770c3d7260a99c80a849

    • memory/836-74-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/836-75-0x00000000005C0000-0x00000000005D1000-memory.dmp
      Filesize

      68KB

    • memory/836-67-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/836-68-0x000000000041D400-mapping.dmp
    • memory/836-71-0x0000000000770000-0x0000000000A73000-memory.dmp
      Filesize

      3.0MB

    • memory/836-72-0x00000000002D0000-0x00000000002E1000-memory.dmp
      Filesize

      68KB

    • memory/1372-85-0x0000000008D00000-0x0000000008E11000-memory.dmp
      Filesize

      1.1MB

    • memory/1372-76-0x0000000006C70000-0x0000000006D95000-memory.dmp
      Filesize

      1.1MB

    • memory/1372-73-0x0000000006A20000-0x0000000006B54000-memory.dmp
      Filesize

      1.2MB

    • memory/1392-58-0x0000000076371000-0x0000000076373000-memory.dmp
      Filesize

      8KB

    • memory/1464-79-0x0000000000A40000-0x0000000000A54000-memory.dmp
      Filesize

      80KB

    • memory/1464-77-0x0000000000000000-mapping.dmp
    • memory/1464-80-0x0000000000090000-0x00000000000B9000-memory.dmp
      Filesize

      164KB

    • memory/1464-82-0x0000000002220000-0x0000000002523000-memory.dmp
      Filesize

      3.0MB

    • memory/1464-83-0x0000000001E60000-0x0000000001EF0000-memory.dmp
      Filesize

      576KB

    • memory/1520-57-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1520-55-0x000000002FB81000-0x000000002FB84000-memory.dmp
      Filesize

      12KB

    • memory/1520-84-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/1520-56-0x0000000071251000-0x0000000071253000-memory.dmp
      Filesize

      8KB

    • memory/1540-62-0x0000000000000000-mapping.dmp
    • memory/1924-81-0x0000000000000000-mapping.dmp