Analysis

  • max time kernel
    157s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    19-01-2022 13:08

General

  • Target

    Swift Copy_pdf.exe

  • Size

    311KB

  • MD5

    9f2d01a8b5dc49ef17702e857be90889

  • SHA1

    d0a573726943bf91061ae5eb5cac521fca7a9e42

  • SHA256

    a905e72a77771c75444b5fc0fe1afb342aefdfcb16e1053eff8c7a66094c3d04

  • SHA512

    50881bf2d897bb9c249dc0981a61f59f8038f42cf74f672b5b9f54c8836f74c6a343e3fbed74287eea17e2545c87424fd422d0eef006d348038573a9934fb69c

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dtt3

Decoy

edilononlineshop.com

cursosd.com

viellacharteredland.com

increasey0urenergylevels.codes

yjy-hotel.com

claym.xyz

reelsguide.com

gives-cardano.com

ashrafannuar.com

mammalians.com

rocketleaguedads.com

yubierp.com

minimi36.com

chn-chn.com

jagojp888.com

parsian-shetab.com

273351.com

mdtouhid.com

babedads.com

vallinam2.com

Signatures

  • Mimikatz

    mimikatz is an open source tool to dump credentials on Windows.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 3 IoCs
  • mimikatz is an open source tool to dump credentials on Windows 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\Swift Copy_pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\Swift Copy_pdf.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Users\Admin\AppData\Local\Temp\Swift Copy_pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\Swift Copy_pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:216
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2584
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Swift Copy_pdf.exe"
        3⤵
          PID:3720

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsoC7D4.tmp\ggjsh.dll
      MD5

      6022029b4dd0c5615b8fe779696eb551

      SHA1

      74eda69e2b3d116bbfa24033713abf866cb6929a

      SHA256

      ddab06f6d679089fcbe372096c40a3a0f977629596a3328f54cf4f90db10a2e7

      SHA512

      9619aa7168fe1bff9b88d4e2666029b50acb346d1cff53c1844623ac4df863291653623feb325e28f164655ea9b35b1f9b7aa2ad4206e07b7e87592c09db3112

    • memory/216-131-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/216-132-0x0000000000650000-0x0000000000DFA000-memory.dmp
      Filesize

      7.7MB

    • memory/216-134-0x0000000000650000-0x0000000000DFA000-memory.dmp
      Filesize

      7.7MB

    • memory/2316-135-0x0000000008550000-0x00000000086AD000-memory.dmp
      Filesize

      1.4MB

    • memory/2316-140-0x00000000012F0000-0x00000000013B0000-memory.dmp
      Filesize

      768KB

    • memory/2584-136-0x0000000000D90000-0x0000000000D9C000-memory.dmp
      Filesize

      48KB

    • memory/2584-137-0x0000000000D30000-0x0000000000D59000-memory.dmp
      Filesize

      164KB

    • memory/2584-138-0x0000000004E40000-0x000000000518A000-memory.dmp
      Filesize

      3.3MB

    • memory/2584-139-0x0000000004C60000-0x0000000004CF0000-memory.dmp
      Filesize

      576KB