Analysis

  • max time kernel
    162s
  • max time network
    167s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    07-02-2022 08:04

General

  • Target

    TNT Shipping Documents PDF.exe

  • Size

    47KB

  • MD5

    7d50ca70bff094575182ed4a262bdfe0

  • SHA1

    3be7106531cc7a8685b09abe19420991b20f2095

  • SHA256

    a59584b56e441105efa83722c78737df246a0ed1e76d2b1c3c20e7c1581d9cae

  • SHA512

    014c99b4918c99677780205ce78f538ca2a671b1e0ba7b6245c2a974e459c9ee127893cfaaaefcf442fc04e69e50ace4e03ce164c7eadf45f61cd3bbef865b8f

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

zqzw

Decoy

laurentmathieu.com

nohohonndana.com

hhmc.info

shophallows.com

blazebunk.com

goodbridge.xyz

flakycloud.com

bakermckenziegroups.com

formation-adistance.com

lovingearthbotanicals.com

tbrservice.plus

heritagehousehotels.com

drwbuildersco.com

lacsghb.com

wain3x.com

dadreview.club

continiutycp.com

cockgirls.com

48mpt.xyz

033skz.xyz

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Users\Admin\AppData\Local\Temp\TNT Shipping Documents PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\TNT Shipping Documents PDF.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4068
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3752
    • C:\Windows\SysWOW64\wlanext.exe
      "C:\Windows\SysWOW64\wlanext.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2124
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Aspnet_compiler.exe"
        3⤵
          PID:1852
    • C:\Windows\system32\MusNotifyIcon.exe
      %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
      1⤵
      • Checks processor information in registry
      PID:3404
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -p
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      PID:428

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2124-137-0x0000000000B80000-0x0000000000B97000-memory.dmp
      Filesize

      92KB

    • memory/2124-138-0x00000000005A0000-0x00000000005C9000-memory.dmp
      Filesize

      164KB

    • memory/2124-139-0x0000000002F10000-0x000000000325A000-memory.dmp
      Filesize

      3.3MB

    • memory/2124-140-0x0000000002D30000-0x0000000002DC0000-memory.dmp
      Filesize

      576KB

    • memory/2412-136-0x00000000087F0000-0x000000000891D000-memory.dmp
      Filesize

      1.2MB

    • memory/2412-141-0x0000000008920000-0x0000000008A3D000-memory.dmp
      Filesize

      1.1MB

    • memory/3752-132-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/3752-133-0x0000000001310000-0x000000000165A000-memory.dmp
      Filesize

      3.3MB

    • memory/3752-135-0x00000000012B0000-0x00000000012C1000-memory.dmp
      Filesize

      68KB

    • memory/4068-130-0x0000016AFB610000-0x0000016AFB622000-memory.dmp
      Filesize

      72KB

    • memory/4068-131-0x0000016AFB820000-0x0000016AFB948000-memory.dmp
      Filesize

      1.2MB