Analysis

  • max time kernel
    170s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    21-02-2022 06:03

General

  • Target

    JPG.087654443356.PDF.exe

  • Size

    816KB

  • MD5

    b9e30dedab75a4a3a3394e72f4245959

  • SHA1

    00ce18c3ee60fe09ffefa790484a36fac9b9a6bd

  • SHA256

    d4a859db98f9fd7473592c49c36ac926a2a29b27d7db8fc311f468bf82e64588

  • SHA512

    182c549a2d2bc8216bae7fe11632883941daf86d4727a68e526be0c9be023674659ac978691e8d0a6f1e0befbb5b15cd5c8a892a5887acd63344191a46b41a94

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pvxz

Decoy

imt-token.club

abravewayocen.online

shcloudcar.com

mshoppingworld.online

ncgf08.xyz

stuinfo.xyz

wesavetheplanetofficial.com

tourbox.xyz

believeinyourselftraining.com

jsboyat.com

aaeconomy.info

9etmorea.info

purosepeti7.com

goticketly.com

pinkmemorypt.com

mylifewellnesscentre.com

iridina.online

petrestore.online

neema.xyz

novelfooditalia.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 54 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Users\Admin\AppData\Local\Temp\JPG.087654443356.PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\JPG.087654443356.PDF.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1128
      • C:\Windows\SysWOW64\logagent.exe
        C:\Windows\System32\logagent.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1544
    • C:\Windows\SysWOW64\WWAHost.exe
      "C:\Windows\SysWOW64\WWAHost.exe"
      2⤵
        PID:724
      • C:\Windows\SysWOW64\explorer.exe
        "C:\Windows\SysWOW64\explorer.exe"
        2⤵
          PID:400
      • C:\Windows\system32\MusNotifyIcon.exe
        %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
        1⤵
        • Checks processor information in registry
        PID:776
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k NetworkService -p
        1⤵
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        PID:3248
      • C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
        C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
        1⤵
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        PID:2376

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Modify Registry

      1
      T1112

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1128-130-0x0000000002270000-0x0000000002271000-memory.dmp
        Filesize

        4KB

      • memory/1128-132-0x0000000000406000-0x0000000000407000-memory.dmp
        Filesize

        4KB

      • memory/1128-134-0x0000000000736000-0x0000000000737000-memory.dmp
        Filesize

        4KB

      • memory/1544-139-0x000000007249D000-0x000000007249E000-memory.dmp
        Filesize

        4KB

      • memory/1544-136-0x0000000072480000-0x00000000724A9000-memory.dmp
        Filesize

        164KB

      • memory/1544-137-0x00000000045D0000-0x000000000491A000-memory.dmp
        Filesize

        3.3MB

      • memory/1544-135-0x0000000000670000-0x0000000000671000-memory.dmp
        Filesize

        4KB

      • memory/1544-140-0x0000000004450000-0x0000000004461000-memory.dmp
        Filesize

        68KB

      • memory/1544-142-0x0000000072480000-0x00000000724A9000-memory.dmp
        Filesize

        164KB

      • memory/1544-143-0x000000007249D000-0x000000007249E000-memory.dmp
        Filesize

        4KB

      • memory/1544-144-0x00000000045A0000-0x00000000045B1000-memory.dmp
        Filesize

        68KB

      • memory/2324-141-0x00000000027E0000-0x00000000028BB000-memory.dmp
        Filesize

        876KB

      • memory/2324-145-0x0000000007D80000-0x0000000007E90000-memory.dmp
        Filesize

        1.1MB