Overview

overview

10

Static

static

1

payment ad...df.exe

windows7_x64

10

payment ad...df.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    27-01-2022 13:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    payment advice.ro9,pdf.exe

  • Size

    607KB

  • MD5

    5a3452246e02aa71c5d55a89e46cd310

  • SHA1

    07cc96501710f0d80455fe9b5e34d4b9c1a3d05a

  • SHA256

    81fc763d0863d2011499222a0683aed63c881b20ccf70d5775125451bf36b76a

  • SHA512

    7b611c4385dae6bbc09bf9c866d0011e50bbda253917861ae33862f065017424ea97867eae8a02fc69ce24d6d344a8f4af1b38dd2ae6a0681403929fdcfbe4c0

Score
10/10
xloadertod8loaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

tod8

Decoy

shabizy5.com

sattaking-delhiborder01.xyz

venetianmountains.com

vertogaastad.quest

zimalek.com

olympiacrownhotel.com

dubbostorage.online

mosescorrea.com

japanroofing.com

mashareq.store

gdetcz.com

slimmersite.com

aplintec.com

878971.com

charlottesbestroofcompany.com

into-mena.com

newlysupply.com

bianncapace.com

netrew.com

anhecapital.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata
  • Xloader Payload 2 IoCs
    rat
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1420
    • C:\Users\Admin\AppData\Local\Temp\payment advice.ro9,pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\payment advice.ro9,pdf.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1100
      • C:\Users\Admin\AppData\Local\Temp\payment advice.ro9,pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\payment advice.ro9,pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:368
    • C:\Windows\SysWOW64\NAPSTAT.EXE
      "C:\Windows\SysWOW64\NAPSTAT.EXE"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:876
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\payment advice.ro9,pdf.exe"
        3⤵
        • Deletes itself
        PID:1480

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nsy396A.tmp\jfay.dll
    MD5

    f6303ff47a3f9ae77f90a43ce73ed4c4

    SHA1

    b8761d249917348eb9b4bbc41cac93c61cbf7dfa

    SHA256

    b133ef10c41b4dd470ba411a84c327394cdf7bc4f1277d3e7117aa13da5c05bc

    SHA512

    12b1f9fcd28e6debdaec038e679508ce4445a2f208ee5b5f0b399ead579796c51bd0c876c422536ad94d9294c58818d704d1cd531ab517f5fecfce5bb544f8df

    Download Submit
  • memory/368-57-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

    Download
  • memory/368-60-0x00000000002C0000-0x00000000002D1000-memory.dmp
    Filesize

    68KB

    Download
  • memory/368-59-0x0000000000920000-0x0000000000C23000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/876-62-0x0000000000900000-0x0000000000946000-memory.dmp
    Filesize

    280KB

    Download
  • memory/876-63-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

    Download
  • memory/876-64-0x00000000021B0000-0x00000000024B3000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/876-65-0x0000000000800000-0x0000000000890000-memory.dmp
    Filesize

    576KB

    Download
  • memory/1100-55-0x0000000075421000-0x0000000075423000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1420-61-0x0000000006A40000-0x0000000006B5E000-memory.dmp
    Filesize

    1.1MB

    Download
  • memory/1420-66-0x0000000006320000-0x000000000640D000-memory.dmp
    Filesize

    948KB

    Download