Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    17-02-2022 09:53

General

  • Target

    DELIVERY DOCUMENTS.exe

  • Size

    784KB

  • MD5

    c84db8be1abc6b5c4fe423a2425c9ad6

  • SHA1

    e21d4d9a20e80be6f9310bfc281bd2c8819d2f57

  • SHA256

    3c6a613507d90d332e2d4d7f91c7c2ef3135e464e5937b1da1a9c4f749528343

  • SHA512

    af70ee5050550797a43c49a249c850b543f45ad7998d78ef5fa4d700c66fb2d677e79d213179a64cf23bdc444d2b2ce6c2ba4af129f86fe1127c5e48c94df2cf

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

zqzw

Decoy

laurentmathieu.com

nohohonndana.com

hhmc.info

shophallows.com

blazebunk.com

goodbridge.xyz

flakycloud.com

bakermckenziegroups.com

formation-adistance.com

lovingearthbotanicals.com

tbrservice.plus

heritagehousehotels.com

drwbuildersco.com

lacsghb.com

wain3x.com

dadreview.club

continiutycp.com

cockgirls.com

48mpt.xyz

033skz.xyz

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 52 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe
      "C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3632
      • C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe
        "{path}"
        3⤵
          PID:652
        • C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe
          "{path}"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          PID:3944
      • C:\Windows\SysWOW64\control.exe
        "C:\Windows\SysWOW64\control.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3628
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\DELIVERY DOCUMENTS.exe"
          3⤵
            PID:616
      • C:\Windows\system32\MusNotifyIcon.exe
        %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
        1⤵
        • Checks processor information in registry
        PID:2240
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k NetworkService -p
        1⤵
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        PID:336
      • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
        C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
        1⤵
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:1688

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2448-143-0x0000000007B40000-0x0000000007C6B000-memory.dmp
        Filesize

        1.2MB

      • memory/2448-148-0x0000000007C70000-0x0000000007D78000-memory.dmp
        Filesize

        1.0MB

      • memory/3628-147-0x0000000004760000-0x00000000047F0000-memory.dmp
        Filesize

        576KB

      • memory/3628-146-0x0000000004930000-0x0000000004C7A000-memory.dmp
        Filesize

        3.3MB

      • memory/3628-145-0x0000000000740000-0x0000000000769000-memory.dmp
        Filesize

        164KB

      • memory/3628-144-0x0000000000F90000-0x0000000000FB7000-memory.dmp
        Filesize

        156KB

      • memory/3632-136-0x00000000056A0000-0x000000000573C000-memory.dmp
        Filesize

        624KB

      • memory/3632-137-0x0000000005740000-0x00000000057D2000-memory.dmp
        Filesize

        584KB

      • memory/3632-133-0x00000000744EE000-0x00000000744EF000-memory.dmp
        Filesize

        4KB

      • memory/3632-135-0x0000000005500000-0x0000000005501000-memory.dmp
        Filesize

        4KB

      • memory/3632-134-0x0000000000AB0000-0x0000000000B7A000-memory.dmp
        Filesize

        808KB

      • memory/3944-141-0x000000000041D000-0x000000000041E000-memory.dmp
        Filesize

        4KB

      • memory/3944-142-0x0000000001C40000-0x0000000001C51000-memory.dmp
        Filesize

        68KB

      • memory/3944-140-0x00000000018F0000-0x0000000001C3A000-memory.dmp
        Filesize

        3.3MB

      • memory/3944-138-0x0000000000400000-0x0000000000429000-memory.dmp
        Filesize

        164KB