Analysis

  • max time kernel
    153s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    19-01-2022 13:08

General

  • Target

    Swift Copy_pdf.exe

  • Size

    311KB

  • MD5

    9f2d01a8b5dc49ef17702e857be90889

  • SHA1

    d0a573726943bf91061ae5eb5cac521fca7a9e42

  • SHA256

    a905e72a77771c75444b5fc0fe1afb342aefdfcb16e1053eff8c7a66094c3d04

  • SHA512

    50881bf2d897bb9c249dc0981a61f59f8038f42cf74f672b5b9f54c8836f74c6a343e3fbed74287eea17e2545c87424fd422d0eef006d348038573a9934fb69c

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dtt3

Decoy

edilononlineshop.com

cursosd.com

viellacharteredland.com

increasey0urenergylevels.codes

yjy-hotel.com

claym.xyz

reelsguide.com

gives-cardano.com

ashrafannuar.com

mammalians.com

rocketleaguedads.com

yubierp.com

minimi36.com

chn-chn.com

jagojp888.com

parsian-shetab.com

273351.com

mdtouhid.com

babedads.com

vallinam2.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 2 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\Swift Copy_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Swift Copy_pdf.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1188
      • C:\Users\Admin\AppData\Local\Temp\Swift Copy_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\Swift Copy_pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1872
    • C:\Windows\SysWOW64\colorcpl.exe
      "C:\Windows\SysWOW64\colorcpl.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:572
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy_pdf.exe"
        3⤵
        • Deletes itself
        PID:544

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsiC988.tmp\ggjsh.dll
    MD5

    6022029b4dd0c5615b8fe779696eb551

    SHA1

    74eda69e2b3d116bbfa24033713abf866cb6929a

    SHA256

    ddab06f6d679089fcbe372096c40a3a0f977629596a3328f54cf4f90db10a2e7

    SHA512

    9619aa7168fe1bff9b88d4e2666029b50acb346d1cff53c1844623ac4df863291653623feb325e28f164655ea9b35b1f9b7aa2ad4206e07b7e87592c09db3112

  • memory/572-67-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

  • memory/572-69-0x0000000001DC0000-0x0000000001E50000-memory.dmp
    Filesize

    576KB

  • memory/572-68-0x0000000002090000-0x0000000002393000-memory.dmp
    Filesize

    3.0MB

  • memory/572-66-0x00000000002B0000-0x00000000002C8000-memory.dmp
    Filesize

    96KB

  • memory/1188-55-0x0000000074EC1000-0x0000000074EC3000-memory.dmp
    Filesize

    8KB

  • memory/1228-70-0x0000000008EE0000-0x000000000902C000-memory.dmp
    Filesize

    1.3MB

  • memory/1228-61-0x00000000070C0000-0x0000000007251000-memory.dmp
    Filesize

    1.6MB

  • memory/1228-64-0x0000000006AD0000-0x0000000006BBE000-memory.dmp
    Filesize

    952KB

  • memory/1872-59-0x0000000000770000-0x0000000000A73000-memory.dmp
    Filesize

    3.0MB

  • memory/1872-63-0x0000000002290000-0x00000000022A1000-memory.dmp
    Filesize

    68KB

  • memory/1872-60-0x00000000002A0000-0x0000000000429000-memory.dmp
    Filesize

    1.5MB

  • memory/1872-57-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB