Analysis
- max time kernel
153s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
21/02/2022, 11:54
General
- Target RFQ 0203-2022 SSNIT.exe
- Size 727KB
- Sample220221-n2wt9abbap
- SHA256 2e3fd0cf4b98695538a9c744e1961b63ec166fe3c02719560fedaddcd0fde689
Malware Config
Extracted
-
xloader
-
2.5
-
s6ap
-
treika.com
-
xsacn.com
-
yokutoku.info
-
cao-catos.ca
-
summarizing-tool.net
-
owes.website
-
doortodelivery.com
-
minimixblocks.com
-
irinaorhideya.com
-
mayerohio.info
-
godofearth.love
-
byrdraffst.quest
-
cavalodomado.com
-
combatcollective.com
-
relianceroofsnashville.com
-
play-google-pokermatch.site
-
farhadhossain.us
-
remaxgreatplace.com
-
usati-consultec.com
-
improvizy.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ 0203-2022 SSNIT.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 0203-2022 SSNIT.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TcFeyfEEwbX.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TcFeyfEEwbX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEBD4.tmp"3⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ 0203-2022 SSNIT.exe"C:\Users\Admin\AppData\Local\Temp\RFQ 0203-2022 SSNIT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ 0203-2022 SSNIT.exe"3⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1832-161-0x0000000007AC0000-0x0000000007ADA000-memory.dmp
memory/1832-163-0x0000000007B30000-0x0000000007B3A000-memory.dmp
memory/1832-170-0x0000000007DE0000-0x0000000007DE8000-memory.dmp
memory/1832-169-0x0000000007E00000-0x0000000007E1A000-memory.dmp
memory/1832-168-0x0000000007CF0000-0x0000000007CFE000-memory.dmp
memory/1832-164-0x0000000007D40000-0x0000000007DD6000-memory.dmp
memory/1832-162-0x000000007F920000-0x000000007F921000-memory.dmp
memory/1832-160-0x0000000008100000-0x000000000877A000-memory.dmp
memory/1832-159-0x0000000006D70000-0x0000000006D8E000-memory.dmp
memory/1832-140-0x0000000002E80000-0x0000000002EB6000-memory.dmp
memory/1832-158-0x0000000071020000-0x000000007106C000-memory.dmp
memory/1832-142-0x000000007476E000-0x000000007476F000-memory.dmp
memory/1832-143-0x0000000005662000-0x0000000005663000-memory.dmp
memory/1832-144-0x0000000005660000-0x0000000005661000-memory.dmp
memory/1832-157-0x0000000007770000-0x00000000077A2000-memory.dmp
memory/1832-146-0x0000000005CA0000-0x00000000062C8000-memory.dmp
memory/1832-147-0x0000000005810000-0x0000000005832000-memory.dmp
memory/1832-148-0x00000000059B0000-0x0000000005A16000-memory.dmp
memory/1832-149-0x0000000005B90000-0x0000000005BF6000-memory.dmp
memory/1832-156-0x0000000005665000-0x0000000005667000-memory.dmp
memory/1832-152-0x00000000067C0000-0x00000000067DE000-memory.dmp
memory/2236-137-0x0000024B7B580000-0x0000024B7B590000-memory.dmp
memory/2236-136-0x0000024B7B520000-0x0000024B7B530000-memory.dmp
memory/2236-138-0x0000024B7DC60000-0x0000024B7DC64000-memory.dmp
memory/2732-171-0x0000000002660000-0x00000000026F0000-memory.dmp
memory/2732-167-0x0000000002770000-0x0000000002ABA000-memory.dmp
memory/2732-165-0x0000000000260000-0x0000000000274000-memory.dmp
memory/2732-166-0x0000000000820000-0x0000000000849000-memory.dmp
memory/3024-172-0x0000000008980000-0x0000000008A85000-memory.dmp
memory/3024-155-0x0000000008D30000-0x0000000008EC9000-memory.dmp
memory/4800-135-0x0000000004DA0000-0x0000000004DAA000-memory.dmp
memory/4800-130-0x000000007476E000-0x000000007476F000-memory.dmp
memory/4800-139-0x0000000006F10000-0x0000000006FAC000-memory.dmp
memory/4800-131-0x00000000002E0000-0x000000000039C000-memory.dmp
memory/4800-134-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/4800-133-0x0000000004C10000-0x0000000004CA2000-memory.dmp
memory/4800-132-0x00000000051C0000-0x0000000005764000-memory.dmp
memory/5052-153-0x000000000041D000-0x000000000041E000-memory.dmp
memory/5052-154-0x00000000017F0000-0x0000000001801000-memory.dmp
memory/5052-145-0x0000000000400000-0x0000000000429000-memory.dmp
memory/5052-150-0x00000000012E0000-0x000000000162A000-memory.dmp