Analysis

  • max time kernel
    119s
  • max time network
    128s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    25-01-2022 11:32

General

  • Target

    ee0a3d31b64011310ae0a4fde697aa25.exe

  • Size

    441KB

  • MD5

    ee0a3d31b64011310ae0a4fde697aa25

  • SHA1

    5d9fd5352b9e0f268cd495d2061e31c9fada2c53

  • SHA256

    a632daf4953367bf3024b3e84d13b5beb03d77719cca10b155355e474b3173e3

  • SHA512

    2ee81b14384fded53344ce3501d30188b65d7ffa94ca54cb57ff5c291db9dc8334760ebc4735da3a0ecae3fa89bc40841064918aac738eee5b1b9943426ac8f4

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pnug

Decoy

natureate.com

ita-pots.website

sucohansmushroom.com

produrielrosen.com

gosystemupdatenow.online

jiskra.art

janwiench.com

norfolkfoodhall.com

iloveaddictss.com

pogozip.com

buyinstapva.com

teardirectionfreedom.xyz

0205168.com

apaixonadosporpugs.online

jawscoinc.com

crafter.quest

wikipedianow.com

radiopuls.net

kendama-co.com

goodstudycanada.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe
    "C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3336
    • C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe
      "C:\Users\Admin\AppData\Local\Temp\ee0a3d31b64011310ae0a4fde697aa25.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:1288

Network

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsj2614.tmp\ltnehpemyq.dll
    MD5

    4438b2bb74143e0dc75d88ff3cf9c3c6

    SHA1

    9bf6b14d33509bfbf10d967812857728595a5d8e

    SHA256

    5b870a41f4559e86d3f3d0cec40364a6bd8aa606d044ade4f7d488f714523751

    SHA512

    fed4113ec2d28c9f9aa8c04524fa1f4d803189edcecda9743ae8550fa28e6ff92d1247466e2bf420622812cf238e8be4cf61eb5f9768f578c7de5a0101c285ef

  • memory/1288-116-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1288-117-0x0000000000A20000-0x0000000000D40000-memory.dmp
    Filesize

    3.1MB