Analysis

  • max time kernel
    159s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    01-03-2022 20:37

General

  • Target

    comprovante de pagamento.exe

  • Size

    339KB

  • MD5

    cfddc31fa56b6e1a80f29386769bd19e

  • SHA1

    78b41e3c049f5dca11aa3c9679f757461cabea7d

  • SHA256

    a65fa640ac023cb2207b4707ca53b54ac80fab579b1ab598637850a003b4f2e4

  • SHA512

    7b4273d4d8cfd5cbe9234dd459c50f56b34978535c9e7480afce28396623da3586dcf7e6011496881774c6ebc4382a61293b230216bfb252385c3b6e290b55cd

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

cbgo

Decoy

santesha.com

britneysbeautybar.com

sh-cy17.com

jeffcarveragency.com

3117111.com

sobrehosting.net

ddm123.xyz

toxcompliance.com

auditorydesigns.com

vliftfacial.com

ielhii.com

naameliss.com

ritualchariot.com

solchange.com

quatre-vingts.design

lawnmowermashine.com

braceletsstore.net

admappy.com

tollivercoltd.com

vaidix.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Users\Admin\AppData\Local\Temp\comprovante de pagamento.exe
      "C:\Users\Admin\AppData\Local\Temp\comprovante de pagamento.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:332
      • C:\Users\Admin\AppData\Local\Temp\kefkdcbcrz.exe
        C:\Users\Admin\AppData\Local\Temp\kefkdcbcrz.exe C:\Users\Admin\AppData\Local\Temp\xsytq
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:372
        • C:\Users\Admin\AppData\Local\Temp\kefkdcbcrz.exe
          C:\Users\Admin\AppData\Local\Temp\kefkdcbcrz.exe C:\Users\Admin\AppData\Local\Temp\xsytq
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:3708
    • C:\Windows\SysWOW64\cmstp.exe
      "C:\Windows\SysWOW64\cmstp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:836
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\kefkdcbcrz.exe"
        3⤵
          PID:1132

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\bs5210ina7o23q4wlv
      MD5

      635788a319cc804f7eee6cc85484994d

      SHA1

      ec66c3089a7ef4905248ea91d5fd5406e081deb0

      SHA256

      cbfa82c018690de266af6d720c9916dd8236d5f12d65c31fb7bf5c95b4e0a43c

      SHA512

      f8fb2daeedb1a92b0e206009155f29cde504de7cba69935d47ee63c96fe2734c93becf199adcca6da53357824024ed9636696b08bf9669a4024b2fb5bd8f17ba

    • C:\Users\Admin\AppData\Local\Temp\kefkdcbcrz.exe
      MD5

      22c779f0c5c8e47aea06b03bdd12ef77

      SHA1

      14b36e7d3841575db9fceb8a635082cf3447ce25

      SHA256

      1a7a06bea18bf2f36247341bc182cc1aecb1a9be28accb4d559e3e667957d0d3

      SHA512

      10b2be6b4ca0b87ad0f2f31aace7aaac7340b7ab83dd9770f5f3e7fe3e1b9b62194e5721aeea3971d502b374d664fdbe9555540205be80aa7c197cbf146a3c74

    • C:\Users\Admin\AppData\Local\Temp\kefkdcbcrz.exe
      MD5

      22c779f0c5c8e47aea06b03bdd12ef77

      SHA1

      14b36e7d3841575db9fceb8a635082cf3447ce25

      SHA256

      1a7a06bea18bf2f36247341bc182cc1aecb1a9be28accb4d559e3e667957d0d3

      SHA512

      10b2be6b4ca0b87ad0f2f31aace7aaac7340b7ab83dd9770f5f3e7fe3e1b9b62194e5721aeea3971d502b374d664fdbe9555540205be80aa7c197cbf146a3c74

    • C:\Users\Admin\AppData\Local\Temp\kefkdcbcrz.exe
      MD5

      22c779f0c5c8e47aea06b03bdd12ef77

      SHA1

      14b36e7d3841575db9fceb8a635082cf3447ce25

      SHA256

      1a7a06bea18bf2f36247341bc182cc1aecb1a9be28accb4d559e3e667957d0d3

      SHA512

      10b2be6b4ca0b87ad0f2f31aace7aaac7340b7ab83dd9770f5f3e7fe3e1b9b62194e5721aeea3971d502b374d664fdbe9555540205be80aa7c197cbf146a3c74

    • C:\Users\Admin\AppData\Local\Temp\xsytq
      MD5

      b56fe160e90745d86c9ee74fd026e134

      SHA1

      2231d8dc79fa27334de455ed5fe3d081490bbc77

      SHA256

      cf9939352d9884929da9a22c416be384d658efdb818b1da7b257875e7c894a98

      SHA512

      497604bf3a074f5affa3c52afd69f69db0b44fe1e6d5752a036c4c95ad7e869954f6d69201d54af087bf4583e71e40414260a70ca7db75832d8ae7b75312529e

    • memory/836-144-0x0000000005030000-0x00000000050C0000-memory.dmp
      Filesize

      576KB

    • memory/836-143-0x0000000005300000-0x000000000564A000-memory.dmp
      Filesize

      3.3MB

    • memory/836-142-0x00000000032D0000-0x00000000032F9000-memory.dmp
      Filesize

      164KB

    • memory/836-141-0x0000000000E30000-0x0000000000E46000-memory.dmp
      Filesize

      88KB

    • memory/2492-140-0x0000000008CE0000-0x0000000008E26000-memory.dmp
      Filesize

      1.3MB

    • memory/2492-145-0x0000000008F60000-0x0000000009071000-memory.dmp
      Filesize

      1.1MB

    • memory/3708-139-0x00000000014A0000-0x00000000014B1000-memory.dmp
      Filesize

      68KB

    • memory/3708-137-0x00000000015D0000-0x000000000191A000-memory.dmp
      Filesize

      3.3MB

    • memory/3708-138-0x000000000041D000-0x000000000041E000-memory.dmp
      Filesize

      4KB

    • memory/3708-134-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB