Analysis

  • max time kernel
    153s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    17-01-2022 13:57

General

  • Target

    tmp/26da8ebb14184edf1c85c0d5981d81e441847856cdac50d5efe108a5e3424829.xls

  • Size

    301KB

  • MD5

    27307aea0f6f1b4b37f1e9949710d6f1

  • SHA1

    249f3fe9f387feb6abf8323043705d367063b1aa

  • SHA256

    26da8ebb14184edf1c85c0d5981d81e441847856cdac50d5efe108a5e3424829

  • SHA512

    e6847c0c946dfafbc57c2933af0e6fb4e32b44edab75a0750509c9b3b16331b0b3a4db1a9bf247d86f8d47ea2365c6e4f32d2cf36d093db9c2e4fe8b920285ae

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

nt3f

Decoy

tricyclee.com

kxsw999.com

wisteria-pavilion.com

bellaclancy.com

promissioskincare.com

hzy001.xyz

checkouthomehd.com

soladere.com

point4sales.com

socalmafia.com

libertadysarmiento.online

nftthirty.com

digitalgoldcryptostock.net

tulekiloscaird.com

austinfishandchicken.com

wlxxch.com

mgav51.xyz

landbanking.global

saprove.com

babyfaces.skin

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Xloader Payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 8 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1208
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\tmp\26da8ebb14184edf1c85c0d5981d81e441847856cdac50d5efe108a5e3424829.xls
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:944
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:540
      • C:\Windows\SysWOW64\NAPSTAT.EXE
        "C:\Windows\SysWOW64\NAPSTAT.EXE"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:580
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:1060
      • C:\Users\Public\vbc.exe
        "C:\Users\Public\vbc.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1272
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:952

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scripting

    1
    T1064

    Exploitation for Client Execution

    1
    T1203

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Scripting

    1
    T1064

    Modify Registry

    2
    T1112

    Discovery

    System Information Discovery

    2
    T1082

    Query Registry

    1
    T1012

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Public\vbc.exe
      MD5

      342e796290f50b2471ecad08f0380f50

      SHA1

      f89746b42e72a639bb19dc197c17cddf13d018d8

      SHA256

      ae73d63f2c19383818f4d71e70e0bd142b1e3dc88756272e8c2408c5059d32cc

      SHA512

      e89a57688719f5084ae3a790674626c0c4b8f0e57fa00b6d6dc7a67b72d0fdb0f19437f5f9ef04a0b3ce13a5cf7b2214744f935c3056b149cf4dbafd2fe22a82

    • C:\Users\Public\vbc.exe
      MD5

      342e796290f50b2471ecad08f0380f50

      SHA1

      f89746b42e72a639bb19dc197c17cddf13d018d8

      SHA256

      ae73d63f2c19383818f4d71e70e0bd142b1e3dc88756272e8c2408c5059d32cc

      SHA512

      e89a57688719f5084ae3a790674626c0c4b8f0e57fa00b6d6dc7a67b72d0fdb0f19437f5f9ef04a0b3ce13a5cf7b2214744f935c3056b149cf4dbafd2fe22a82

    • C:\Users\Public\vbc.exe
      MD5

      342e796290f50b2471ecad08f0380f50

      SHA1

      f89746b42e72a639bb19dc197c17cddf13d018d8

      SHA256

      ae73d63f2c19383818f4d71e70e0bd142b1e3dc88756272e8c2408c5059d32cc

      SHA512

      e89a57688719f5084ae3a790674626c0c4b8f0e57fa00b6d6dc7a67b72d0fdb0f19437f5f9ef04a0b3ce13a5cf7b2214744f935c3056b149cf4dbafd2fe22a82

    • \Users\Admin\AppData\Local\Temp\nsd3239.tmp\nmzvorfenj.dll
      MD5

      e9d7b9597f78999618e8d656b3d27592

      SHA1

      35c49b6a197b8ce49980f4308237a56fe01e1b01

      SHA256

      73f7418691f4b4c86f8b8903f921cc5f52499f34805b94f2d2b3fd555e0284bd

      SHA512

      b7227288b39c35d49814297832aa4f2b636dfd7e6e1edb37a6f13bb955053f71759ab71e4067bdf54c17b3ea0f193088eee23c79be2b9e47672efa8d2a7d4773

    • \Users\Public\vbc.exe
      MD5

      342e796290f50b2471ecad08f0380f50

      SHA1

      f89746b42e72a639bb19dc197c17cddf13d018d8

      SHA256

      ae73d63f2c19383818f4d71e70e0bd142b1e3dc88756272e8c2408c5059d32cc

      SHA512

      e89a57688719f5084ae3a790674626c0c4b8f0e57fa00b6d6dc7a67b72d0fdb0f19437f5f9ef04a0b3ce13a5cf7b2214744f935c3056b149cf4dbafd2fe22a82

    • memory/580-74-0x0000000000000000-mapping.dmp
    • memory/580-78-0x0000000001E10000-0x0000000001EA0000-memory.dmp
      Filesize

      576KB

    • memory/580-77-0x0000000001FA0000-0x00000000022A3000-memory.dmp
      Filesize

      3.0MB

    • memory/580-76-0x0000000000110000-0x0000000000139000-memory.dmp
      Filesize

      164KB

    • memory/580-75-0x0000000000450000-0x0000000000496000-memory.dmp
      Filesize

      280KB

    • memory/944-54-0x000000002FC61000-0x000000002FC64000-memory.dmp
      Filesize

      12KB

    • memory/944-80-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/944-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
      Filesize

      64KB

    • memory/944-55-0x0000000071401000-0x0000000071403000-memory.dmp
      Filesize

      8KB

    • memory/952-65-0x000000000041D460-mapping.dmp
    • memory/952-71-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/952-72-0x0000000000390000-0x00000000003A1000-memory.dmp
      Filesize

      68KB

    • memory/952-69-0x0000000000340000-0x0000000000351000-memory.dmp
      Filesize

      68KB

    • memory/952-68-0x00000000008A0000-0x0000000000BA3000-memory.dmp
      Filesize

      3.0MB

    • memory/952-64-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1060-57-0x0000000076151000-0x0000000076153000-memory.dmp
      Filesize

      8KB

    • memory/1208-73-0x00000000070C0000-0x0000000007245000-memory.dmp
      Filesize

      1.5MB

    • memory/1208-70-0x0000000006300000-0x0000000006421000-memory.dmp
      Filesize

      1.1MB

    • memory/1208-79-0x0000000006980000-0x0000000006ABB000-memory.dmp
      Filesize

      1.2MB

    • memory/1208-81-0x000007FEF62D0000-0x000007FEF6413000-memory.dmp
      Filesize

      1.3MB

    • memory/1208-82-0x000007FF3F370000-0x000007FF3F37A000-memory.dmp
      Filesize

      40KB

    • memory/1272-59-0x0000000000000000-mapping.dmp