Analysis

  • max time kernel
    159s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    09-02-2022 10:21

General

  • Target

    QUOTATION.exe

  • Size

    564KB

  • MD5

    98baccb2a35dcd64991688d8c2f9863e

  • SHA1

    2cf34e18ccb91d2e0572ec833f8656178f4e834b

  • SHA256

    33b08940d5a2fdd70c73fddf7e359193eb86a1d42e7cce27dba02718b7279c49

  • SHA512

    caf53ba7e93e0f781877cfc318b429dbec9490b443ff8e5533f5ef0c89a1f612ac6e7cc245c99b34ffbf4c9bad95c8e2a183e7faffba3ce78a8b23b1c4757e54

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

nt3f

Decoy

tricyclee.com

kxsw999.com

wisteria-pavilion.com

bellaclancy.com

promissioskincare.com

hzy001.xyz

checkouthomehd.com

soladere.com

point4sales.com

socalmafia.com

libertadysarmiento.online

nftthirty.com

digitalgoldcryptostock.net

tulekiloscaird.com

austinfishandchicken.com

wlxxch.com

mgav51.xyz

landbanking.global

saprove.com

babyfaces.skin

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1412
    • C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe
      "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1664
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svUINqq.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1552
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\svUINqq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp228E.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:392
      • C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe
        "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"
        3⤵
          PID:1152
        • C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe
          "C:\Users\Admin\AppData\Local\Temp\QUOTATION.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1000
      • C:\Windows\SysWOW64\help.exe
        "C:\Windows\SysWOW64\help.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1764

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp228E.tmp
      MD5

      50fc2656039aafe59fd8b3f7f5d66ee3

      SHA1

      5c2fca903ad405f3da1f3f01dcd55ca9197bc9d5

      SHA256

      6e454cd13c0d0575932cddad9dc9198899b729b71473a213ec5ae5cbe2a5fda1

      SHA512

      3c969e910ca5b521598514ee06ecc161908036ab7d9fa85306ddf93e3e2f46a8402dd815c593ab9e04cba9f581994f2fc50929aca3494c7e9155bd733b83dabd

    • memory/1000-68-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1000-67-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1000-77-0x00000000001D0000-0x00000000001E1000-memory.dmp
      Filesize

      68KB

    • memory/1000-76-0x000000000041D000-0x000000000041E000-memory.dmp
      Filesize

      4KB

    • memory/1000-75-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1000-69-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1000-73-0x0000000000190000-0x00000000001A1000-memory.dmp
      Filesize

      68KB

    • memory/1000-72-0x000000000041D000-0x000000000041E000-memory.dmp
      Filesize

      4KB

    • memory/1000-71-0x0000000000A20000-0x0000000000D23000-memory.dmp
      Filesize

      3.0MB

    • memory/1412-83-0x0000000006F00000-0x0000000006FD0000-memory.dmp
      Filesize

      832KB

    • memory/1412-78-0x0000000004FB0000-0x0000000005086000-memory.dmp
      Filesize

      856KB

    • memory/1412-74-0x0000000003E30000-0x0000000003F1C000-memory.dmp
      Filesize

      944KB

    • memory/1552-62-0x000000006C911000-0x000000006C912000-memory.dmp
      Filesize

      4KB

    • memory/1552-60-0x0000000076491000-0x0000000076493000-memory.dmp
      Filesize

      8KB

    • memory/1552-66-0x0000000002562000-0x0000000002564000-memory.dmp
      Filesize

      8KB

    • memory/1552-65-0x0000000002561000-0x0000000002562000-memory.dmp
      Filesize

      4KB

    • memory/1552-63-0x0000000002560000-0x0000000002561000-memory.dmp
      Filesize

      4KB

    • memory/1552-64-0x000000006C912000-0x000000006C914000-memory.dmp
      Filesize

      8KB

    • memory/1664-55-0x0000000074E4E000-0x0000000074E4F000-memory.dmp
      Filesize

      4KB

    • memory/1664-56-0x0000000000500000-0x0000000000501000-memory.dmp
      Filesize

      4KB

    • memory/1664-59-0x0000000000505000-0x0000000000516000-memory.dmp
      Filesize

      68KB

    • memory/1664-58-0x0000000004C40000-0x0000000004C9E000-memory.dmp
      Filesize

      376KB

    • memory/1664-54-0x0000000000D80000-0x0000000000E14000-memory.dmp
      Filesize

      592KB

    • memory/1664-57-0x00000000004F0000-0x00000000004FC000-memory.dmp
      Filesize

      48KB

    • memory/1764-81-0x00000000006C0000-0x00000000009C3000-memory.dmp
      Filesize

      3.0MB

    • memory/1764-79-0x00000000006B0000-0x00000000006B6000-memory.dmp
      Filesize

      24KB

    • memory/1764-80-0x0000000000080000-0x00000000000A9000-memory.dmp
      Filesize

      164KB

    • memory/1764-82-0x0000000000600000-0x0000000000690000-memory.dmp
      Filesize

      576KB