Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    24-01-2022 06:15

General

  • Target

    QUOTATION REQUEST - SUPPLY OF PRODUCTS - DTD JANUARY 2022PDF.xlsx

  • Size

    187KB

  • MD5

    8ecafed44ea096b7fd229ae3497de0bf

  • SHA1

    7ebf9f0f231d66306d456abfc47bc211ce1b7b55

  • SHA256

    8f0c93c132573c57f4e96e4dfec4eab60264895f70b173b3f307476a3ff0bf47

  • SHA512

    020ae8088dccd272b3a6f8373dc8de03613c5db526fa066eea8d1e5ef739544ed36947c7f0c7fe97f8860b2128b789d9fb66338b5300a50c4afa45b05dbbc3a8

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • NSIS installer 12 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1396
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\QUOTATION REQUEST - SUPPLY OF PRODUCTS - DTD JANUARY 2022PDF.xlsx"
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:1448
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:1904
      • C:\Windows\SysWOW64\wlanext.exe
        "C:\Windows\SysWOW64\wlanext.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1164
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Public\vbc.exe"
          3⤵
            PID:556
      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        PID:1216
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1440
          • C:\Users\Public\vbc.exe
            "C:\Users\Public\vbc.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:1140

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scripting

      1
      T1064

      Exploitation for Client Execution

      1
      T1203

      Defense Evasion

      Scripting

      1
      T1064

      Modify Registry

      1
      T1112

      Discovery

      System Information Discovery

      2
      T1082

      Query Registry

      1
      T1012

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Public\vbc.exe
        MD5

        f71bfac229c8d64d9c18cb777e348f14

        SHA1

        1e91e3daa8f78813368040afbfa154284ed54e3d

        SHA256

        28a107f37e75bafd9fd49ac3ed8745d676d04d2bd5bfea8f926f04a2f393cd51

        SHA512

        a3bc2381a1fc467795d06937716a33c69d45797325c48c5d947416c64e9346218043737a60ab7844e68013415fd02d412e5e290d7c2e7beddb5f0224af5776d9

      • C:\Users\Public\vbc.exe
        MD5

        f71bfac229c8d64d9c18cb777e348f14

        SHA1

        1e91e3daa8f78813368040afbfa154284ed54e3d

        SHA256

        28a107f37e75bafd9fd49ac3ed8745d676d04d2bd5bfea8f926f04a2f393cd51

        SHA512

        a3bc2381a1fc467795d06937716a33c69d45797325c48c5d947416c64e9346218043737a60ab7844e68013415fd02d412e5e290d7c2e7beddb5f0224af5776d9

      • C:\Users\Public\vbc.exe
        MD5

        f71bfac229c8d64d9c18cb777e348f14

        SHA1

        1e91e3daa8f78813368040afbfa154284ed54e3d

        SHA256

        28a107f37e75bafd9fd49ac3ed8745d676d04d2bd5bfea8f926f04a2f393cd51

        SHA512

        a3bc2381a1fc467795d06937716a33c69d45797325c48c5d947416c64e9346218043737a60ab7844e68013415fd02d412e5e290d7c2e7beddb5f0224af5776d9

      • \Users\Admin\AppData\Local\Temp\nsy148C.tmp\axpkk.dll
        MD5

        c89f99953ab2fa059c15f14b85b5d3be

        SHA1

        688be2dbc7035ec165205d0aa4d9c3f6bfe5fa2d

        SHA256

        1d92062cc9853399967cace0559ef172a6704219bda438f4c9b353f506e6c60f

        SHA512

        947e06962dc19178ee3c1d88490e88c382cbdb06ca6a804364306b6b16368f041ec06884983248ef991b6a341df5724928aad70e5153d5d8f7c92eb7d384429d

      • \Users\Public\vbc.exe
        MD5

        f71bfac229c8d64d9c18cb777e348f14

        SHA1

        1e91e3daa8f78813368040afbfa154284ed54e3d

        SHA256

        28a107f37e75bafd9fd49ac3ed8745d676d04d2bd5bfea8f926f04a2f393cd51

        SHA512

        a3bc2381a1fc467795d06937716a33c69d45797325c48c5d947416c64e9346218043737a60ab7844e68013415fd02d412e5e290d7c2e7beddb5f0224af5776d9

      • \Users\Public\vbc.exe
        MD5

        f71bfac229c8d64d9c18cb777e348f14

        SHA1

        1e91e3daa8f78813368040afbfa154284ed54e3d

        SHA256

        28a107f37e75bafd9fd49ac3ed8745d676d04d2bd5bfea8f926f04a2f393cd51

        SHA512

        a3bc2381a1fc467795d06937716a33c69d45797325c48c5d947416c64e9346218043737a60ab7844e68013415fd02d412e5e290d7c2e7beddb5f0224af5776d9

      • \Users\Public\vbc.exe
        MD5

        f71bfac229c8d64d9c18cb777e348f14

        SHA1

        1e91e3daa8f78813368040afbfa154284ed54e3d

        SHA256

        28a107f37e75bafd9fd49ac3ed8745d676d04d2bd5bfea8f926f04a2f393cd51

        SHA512

        a3bc2381a1fc467795d06937716a33c69d45797325c48c5d947416c64e9346218043737a60ab7844e68013415fd02d412e5e290d7c2e7beddb5f0224af5776d9

      • memory/1140-69-0x0000000000730000-0x0000000000A33000-memory.dmp
        Filesize

        3.0MB

      • memory/1140-70-0x0000000000360000-0x0000000000371000-memory.dmp
        Filesize

        68KB

      • memory/1140-73-0x00000000003A0000-0x00000000003B1000-memory.dmp
        Filesize

        68KB

      • memory/1140-66-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

      • memory/1140-72-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB

      • memory/1164-76-0x0000000000080000-0x00000000000A9000-memory.dmp
        Filesize

        164KB

      • memory/1164-75-0x00000000002C0000-0x00000000002D6000-memory.dmp
        Filesize

        88KB

      • memory/1164-77-0x0000000002070000-0x0000000002373000-memory.dmp
        Filesize

        3.0MB

      • memory/1164-78-0x00000000004E0000-0x0000000000570000-memory.dmp
        Filesize

        576KB

      • memory/1396-71-0x0000000006C50000-0x0000000006D6B000-memory.dmp
        Filesize

        1.1MB

      • memory/1396-74-0x0000000007300000-0x000000000741F000-memory.dmp
        Filesize

        1.1MB

      • memory/1396-79-0x00000000069E0000-0x0000000006AD0000-memory.dmp
        Filesize

        960KB

      • memory/1448-54-0x000000002FF91000-0x000000002FF94000-memory.dmp
        Filesize

        12KB

      • memory/1448-55-0x0000000071301000-0x0000000071303000-memory.dmp
        Filesize

        8KB

      • memory/1448-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/1448-57-0x0000000076421000-0x0000000076423000-memory.dmp
        Filesize

        8KB

      • memory/1448-80-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB