Analysis

  • max time kernel
    156s
  • max time network
    165s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    21-01-2022 14:26

General

  • Target

    DHL_AWB# 9678547836.exe

  • Size

    326KB

  • MD5

    c8df5e6047cd338743e32c7e79067a45

  • SHA1

    848cdb2e9b7415ca7689b74ffd076fb92a8637a4

  • SHA256

    5111f4fa05b89a9d727c4686485acedc16553a7715fd36776c68972acf8e5382

  • SHA512

    c18533cd152b2ea6c395d6224f0dcbc73f3583bb4b8b902cf967c906a5c5df634976741a9f90977fa05e487277d79c4ac7e85f5216921f4c78bde1abd7f36436

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

dtt3

Decoy

edilononlineshop.com

cursosd.com

viellacharteredland.com

increasey0urenergylevels.codes

yjy-hotel.com

claym.xyz

reelsguide.com

gives-cardano.com

ashrafannuar.com

mammalians.com

rocketleaguedads.com

yubierp.com

minimi36.com

chn-chn.com

jagojp888.com

parsian-shetab.com

273351.com

mdtouhid.com

babedads.com

vallinam2.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Users\Admin\AppData\Local\Temp\DHL_AWB# 9678547836.exe
      "C:\Users\Admin\AppData\Local\Temp\DHL_AWB# 9678547836.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Users\Admin\AppData\Local\Temp\DHL_AWB# 9678547836.exe
        "C:\Users\Admin\AppData\Local\Temp\DHL_AWB# 9678547836.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2096
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3320
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\DHL_AWB# 9678547836.exe"
        3⤵
          PID:508

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsbD341.tmp\vbxaftxp.dll
      MD5

      b352c7e713aa81796cbdc8bf0827b5f0

      SHA1

      2e0a7c042322c8beb99ac7a9b66645e6f35b8c2a

      SHA256

      e096ec2151b53c081e3c7a6e712c04632dc6173f5d2f9a9ad3981da8ce718ef7

      SHA512

      22fc7ca17f8459a996823d8c37bf835927a58f564f0998aeeab77d7f1ee64484199f2be16c41c2b0ce021b4c1edda3c499b80ed1a757b957abb29d0cf3ab5e1f

    • memory/2096-119-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/2096-121-0x00000000009B0000-0x0000000000CD0000-memory.dmp
      Filesize

      3.1MB

    • memory/2096-122-0x00000000009B0000-0x0000000000ED0000-memory.dmp
      Filesize

      5.1MB

    • memory/3068-123-0x0000000001100000-0x00000000011EE000-memory.dmp
      Filesize

      952KB

    • memory/3068-128-0x0000000006870000-0x000000000698A000-memory.dmp
      Filesize

      1.1MB

    • memory/3320-124-0x00000000003E0000-0x00000000003FF000-memory.dmp
      Filesize

      124KB

    • memory/3320-125-0x00000000027B0000-0x00000000027D9000-memory.dmp
      Filesize

      164KB

    • memory/3320-126-0x00000000047A0000-0x0000000004AC0000-memory.dmp
      Filesize

      3.1MB

    • memory/3320-127-0x0000000004470000-0x00000000045FE000-memory.dmp
      Filesize

      1.6MB