Analysis

  • max time kernel
    151s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220113
  • submitted
    21-02-2022 10:32

General

  • Target

    Carta de pago.exe

  • Size

    357KB

  • MD5

    03206cea63667d5f8e8861f554720473

  • SHA1

    43bcabbfaffce6dfb7c5ec763f11ea85d8876dad

  • SHA256

    c15f6faab41ea44719d795995c15024db0719fa5c9a731110587ec4e1e041fc2

  • SHA512

    7552aae69b210e543f27d707952738df7f349daf99450e53b0a39729ea7bea5e31d34b9dc6b876ef2964f759f488a83a052a913125fb6b6f50767f994277e933

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

kio8

Decoy

greeaircondition.com

thewilmingtonguide.com

cbluedotlivewdmall.com

globalcrime24.com

heightsplace.com

ghar.pro

asosbira.com

melolandia.com

velactun.com

erniesimms.com

nutbullet.com

drizzerstr.com

hnqym888.com

ghorowaseba.com

1317efoxchasedrive.info

stjudetroop623.com

facestaj.com

airpromaskaccessories.com

wolfetailors.com

56ohdc2016.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3024
    • C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe
      "C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3272
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:3568
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          3⤵
            PID:1568
          • C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe
            "C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:4624
        • C:\Windows\SysWOW64\chkdsk.exe
          "C:\Windows\SysWOW64\chkdsk.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2964
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\Carta de pago.exe"
            3⤵
              PID:4492
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
          1⤵
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:4832

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2964-139-0x0000000001560000-0x00000000015EF000-memory.dmp
          Filesize

          572KB

        • memory/2964-138-0x0000000001730000-0x0000000001A7A000-memory.dmp
          Filesize

          3.3MB

        • memory/2964-137-0x0000000000DA0000-0x0000000000DC9000-memory.dmp
          Filesize

          164KB

        • memory/2964-136-0x00000000008B0000-0x00000000008BA000-memory.dmp
          Filesize

          40KB

        • memory/3024-135-0x0000000008710000-0x0000000008892000-memory.dmp
          Filesize

          1.5MB

        • memory/3024-140-0x0000000003360000-0x0000000003443000-memory.dmp
          Filesize

          908KB

        • memory/3272-130-0x00000000007AD000-0x00000000007B0000-memory.dmp
          Filesize

          12KB

        • memory/4624-134-0x0000000000830000-0x0000000000840000-memory.dmp
          Filesize

          64KB

        • memory/4624-131-0x0000000001040000-0x000000000138A000-memory.dmp
          Filesize

          3.3MB

        • memory/4624-133-0x000000000041D000-0x000000000041E000-memory.dmp
          Filesize

          4KB

        • memory/4624-132-0x0000000000400000-0x0000000000429000-memory.dmp
          Filesize

          164KB

        • memory/4832-141-0x000001EE29020000-0x000001EE29030000-memory.dmp
          Filesize

          64KB

        • memory/4832-142-0x000001EE29080000-0x000001EE29090000-memory.dmp
          Filesize

          64KB

        • memory/4832-143-0x000001EE2B750000-0x000001EE2B754000-memory.dmp
          Filesize

          16KB