Analysis

  • max time kernel
    110s
  • max time network
    125s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    31-01-2022 10:45

General

  • Target

    076b5c48111ac20de4e6f72cfa3393f1.exe

  • Size

    782KB

  • MD5

    076b5c48111ac20de4e6f72cfa3393f1

  • SHA1

    06439b289cdfdd08164d4bed0c7f6f2d92d8c769

  • SHA256

    11d9365302786fe34113c070a9e6ed32a7209c8de10eb21ef8d4a8eeb1215d41

  • SHA512

    a7da7825eb785b0fa31979af5c1bf9010f18cbf7f61b6b0dfc9ef9dae845d345b2df47f53a07dae012d5c33f3f890ece2473477faf33ef59aeeddaba28c18b2b

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

nt3f

Decoy

tricyclee.com

kxsw999.com

wisteria-pavilion.com

bellaclancy.com

promissioskincare.com

hzy001.xyz

checkouthomehd.com

soladere.com

point4sales.com

socalmafia.com

libertadysarmiento.online

nftthirty.com

digitalgoldcryptostock.net

tulekiloscaird.com

austinfishandchicken.com

wlxxch.com

mgav51.xyz

landbanking.global

saprove.com

babyfaces.skin

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\076b5c48111ac20de4e6f72cfa3393f1.exe
    "C:\Users\Admin\AppData\Local\Temp\076b5c48111ac20de4e6f72cfa3393f1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ubRPPGAHBbheAf.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2864
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ubRPPGAHBbheAf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp74ED.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2748
    • C:\Users\Admin\AppData\Local\Temp\076b5c48111ac20de4e6f72cfa3393f1.exe
      "C:\Users\Admin\AppData\Local\Temp\076b5c48111ac20de4e6f72cfa3393f1.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:392

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp74ED.tmp
    MD5

    9cce8df4371b5ec3462445dc611fd267

    SHA1

    efef4c5d204328b57457a5a25ba6d74611e6ffc0

    SHA256

    9ee7210d1971f9c247aeb0e4673d5b49a0d8a575fed60c7b981f1de55a91e558

    SHA512

    dce980db7325b72b6e5c37fde031e68a9b97fd85d952d02048f3fae0f5cab0b7c7f25b28be4dd854add40dbb0ededee8f13084b1863b87c2c6ceb1a7df7c7fbd

  • memory/392-131-0x00000000011E0000-0x0000000001500000-memory.dmp
    Filesize

    3.1MB

  • memory/392-125-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/2676-121-0x0000000008170000-0x00000000081CE000-memory.dmp
    Filesize

    376KB

  • memory/2676-115-0x0000000005DB0000-0x00000000062AE000-memory.dmp
    Filesize

    5.0MB

  • memory/2676-119-0x00000000058B0000-0x0000000005DAE000-memory.dmp
    Filesize

    5.0MB

  • memory/2676-120-0x0000000007F50000-0x0000000007FEC000-memory.dmp
    Filesize

    624KB

  • memory/2676-114-0x0000000000F80000-0x000000000104C000-memory.dmp
    Filesize

    816KB

  • memory/2676-117-0x0000000005880000-0x000000000588A000-memory.dmp
    Filesize

    40KB

  • memory/2676-116-0x00000000058B0000-0x0000000005942000-memory.dmp
    Filesize

    584KB

  • memory/2676-118-0x0000000005BA0000-0x0000000005BAC000-memory.dmp
    Filesize

    48KB

  • memory/2864-132-0x0000000007330000-0x0000000007396000-memory.dmp
    Filesize

    408KB

  • memory/2864-136-0x0000000007AD0000-0x0000000007B1B000-memory.dmp
    Filesize

    300KB

  • memory/2864-129-0x0000000001112000-0x0000000001113000-memory.dmp
    Filesize

    4KB

  • memory/2864-127-0x0000000006C90000-0x00000000072B8000-memory.dmp
    Filesize

    6.2MB

  • memory/2864-130-0x0000000006B30000-0x0000000006B52000-memory.dmp
    Filesize

    136KB

  • memory/2864-126-0x00000000010D0000-0x0000000001106000-memory.dmp
    Filesize

    216KB

  • memory/2864-133-0x0000000007580000-0x00000000075E6000-memory.dmp
    Filesize

    408KB

  • memory/2864-134-0x0000000007650000-0x00000000079A0000-memory.dmp
    Filesize

    3.3MB

  • memory/2864-135-0x00000000073E0000-0x00000000073FC000-memory.dmp
    Filesize

    112KB

  • memory/2864-128-0x0000000001110000-0x0000000001111000-memory.dmp
    Filesize

    4KB

  • memory/2864-137-0x0000000007D10000-0x0000000007D86000-memory.dmp
    Filesize

    472KB

  • memory/2864-146-0x0000000008B80000-0x0000000008BB3000-memory.dmp
    Filesize

    204KB

  • memory/2864-147-0x0000000008B60000-0x0000000008B7E000-memory.dmp
    Filesize

    120KB

  • memory/2864-152-0x0000000008CC0000-0x0000000008D65000-memory.dmp
    Filesize

    660KB

  • memory/2864-153-0x00000000090A0000-0x0000000009134000-memory.dmp
    Filesize

    592KB

  • memory/2864-222-0x000000007F3E0000-0x000000007F3E1000-memory.dmp
    Filesize

    4KB

  • memory/2864-223-0x0000000001113000-0x0000000001114000-memory.dmp
    Filesize

    4KB

  • memory/2864-348-0x0000000009030000-0x000000000904A000-memory.dmp
    Filesize

    104KB

  • memory/2864-353-0x0000000009020000-0x0000000009028000-memory.dmp
    Filesize

    32KB