Overview

overview

10

Static

static

1

payment ad...df.exe

windows7_x64

10

payment ad...df.exe

windows10_x64

10

Analysis

  • max time kernel
    166s
  • max time network
    183s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    27-01-2022 13:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    payment advice.ro9,pdf.exe

  • Size

    607KB

  • MD5

    5a3452246e02aa71c5d55a89e46cd310

  • SHA1

    07cc96501710f0d80455fe9b5e34d4b9c1a3d05a

  • SHA256

    81fc763d0863d2011499222a0683aed63c881b20ccf70d5775125451bf36b76a

  • SHA512

    7b611c4385dae6bbc09bf9c866d0011e50bbda253917861ae33862f065017424ea97867eae8a02fc69ce24d6d344a8f4af1b38dd2ae6a0681403929fdcfbe4c0

Score
10/10
xloadertod8loaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

tod8

Decoy

shabizy5.com

sattaking-delhiborder01.xyz

venetianmountains.com

vertogaastad.quest

zimalek.com

olympiacrownhotel.com

dubbostorage.online

mosescorrea.com

japanroofing.com

mashareq.store

gdetcz.com

slimmersite.com

aplintec.com

878971.com

charlottesbestroofcompany.com

into-mena.com

newlysupply.com

bianncapace.com

netrew.com

anhecapital.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata
  • Xloader Payload 2 IoCs
    rat
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\payment advice.ro9,pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\payment advice.ro9,pdf.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Users\Admin\AppData\Local\Temp\payment advice.ro9,pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\payment advice.ro9,pdf.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:2548
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Windows\SysWOW64\colorcpl.exe
      "C:\Windows\SysWOW64\colorcpl.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3300
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\payment advice.ro9,pdf.exe"
        3⤵
          PID:3588

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsn6F81.tmp\jfay.dll
      MD5

      f6303ff47a3f9ae77f90a43ce73ed4c4

      SHA1

      b8761d249917348eb9b4bbc41cac93c61cbf7dfa

      SHA256

      b133ef10c41b4dd470ba411a84c327394cdf7bc4f1277d3e7117aa13da5c05bc

      SHA512

      12b1f9fcd28e6debdaec038e679508ce4445a2f208ee5b5f0b399ead579796c51bd0c876c422536ad94d9294c58818d704d1cd531ab517f5fecfce5bb544f8df

      Download Submit
    • memory/2364-120-0x0000000002EA0000-0x0000000002F92000-memory.dmp
      Filesize

      968KB

      Download
    • memory/2364-125-0x00000000056E0000-0x00000000057EA000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/2548-116-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

      Download
    • memory/2548-117-0x00000000009C0000-0x0000000000CE0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/2548-119-0x0000000000E10000-0x0000000000E21000-memory.dmp
      Filesize

      68KB

      Download
    • memory/3300-121-0x0000000000B30000-0x0000000000B49000-memory.dmp
      Filesize

      100KB

      Download
    • memory/3300-122-0x00000000004E0000-0x0000000000509000-memory.dmp
      Filesize

      164KB

      Download
    • memory/3300-123-0x00000000044A0000-0x00000000047C0000-memory.dmp
      Filesize

      3.1MB

      Download
    • memory/3300-124-0x0000000004300000-0x0000000004498000-memory.dmp
      Filesize

      1.6MB

      Download