Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    02-03-2022 16:04

General

  • Target

    tmp.exe

  • Size

    332KB

  • MD5

    8bc5cae30e499dea0d78f85c309be304

  • SHA1

    95b3af264ecfec7155002f8ee9bbc46c4946e84f

  • SHA256

    ea928c88deed19528dead0fc786936f6ac102f94905ce1bff6df678b7c560726

  • SHA512

    d6149bcc0747f00b53a429dbd1605433830d8f2f67d638eb5e4feb41cb43f5029f42ddeb23c369a5000d5b37896ee51cf6f79cbdc23f0848ce0a10d62901de99

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

igwa

Decoy

listingswithalex.com

funtabse.com

aydenwalling.com

prochal.net

superfoodsnederland.com

moldluck.com

dianekgordon.store

regionalhomescommercial.com

mysecuritymadesimple.com

malwaremastery.com

kodaikeiko.com

jrzg996.com

agricurve.net

songlingjiu.com

virginianundahfishingclub.com

friendschance.com

pastelpresents.com

answertitles.com

survival-hunter.com

nxfddl.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1636
      • C:\Users\Admin\AppData\Local\Temp\iizlfx.exe
        C:\Users\Admin\AppData\Local\Temp\iizlfx.exe C:\Users\Admin\AppData\Local\Temp\ibfqtjhg
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1416
        • C:\Users\Admin\AppData\Local\Temp\iizlfx.exe
          C:\Users\Admin\AppData\Local\Temp\iizlfx.exe C:\Users\Admin\AppData\Local\Temp\ibfqtjhg
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:940
    • C:\Windows\SysWOW64\systray.exe
      "C:\Windows\SysWOW64\systray.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:568
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\iizlfx.exe"
        3⤵
          PID:564

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\fc81nqibepxmw1
      MD5

      296fcc90486bd93b1a6e0593241d1c7f

      SHA1

      34c54d85fe773bf6068752501e16a5c9227d5bee

      SHA256

      2a7dd4eaee410720ffc22a511932a3b1a2b13319f77e0085548d63010e73e18e

      SHA512

      c29c5a7141c84a88db4e890c207a8c5f36987539b68037c82f3256ea6ef6cd679ee643344c0f028cb42c93b4e70ddb965e557dc419be4a06c91752e3157c4464

    • C:\Users\Admin\AppData\Local\Temp\ibfqtjhg
      MD5

      ad17464f77b0864dea1025b4ca517e28

      SHA1

      8c0d2d3aea1c36f8dff24ea2467317ad9773ff68

      SHA256

      a5a41b0b6c1032840a1bc802b29461ef67486a3f36b9d964df10e884ecba825f

      SHA512

      e57a70fc66e2eddba4cf097d97e91fd1de2358be96f89c50a36c155916bcbba2b45f4e02d25819a84780bef2735a9fc4d1682d3b1793f7487668ef293d78c331

    • C:\Users\Admin\AppData\Local\Temp\iizlfx.exe
      MD5

      018adcd630666bff50914157771f6e43

      SHA1

      40e4d330149f8b86766eac860ce3cc06e01f51ac

      SHA256

      039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f

      SHA512

      c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f

    • C:\Users\Admin\AppData\Local\Temp\iizlfx.exe
      MD5

      018adcd630666bff50914157771f6e43

      SHA1

      40e4d330149f8b86766eac860ce3cc06e01f51ac

      SHA256

      039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f

      SHA512

      c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f

    • C:\Users\Admin\AppData\Local\Temp\iizlfx.exe
      MD5

      018adcd630666bff50914157771f6e43

      SHA1

      40e4d330149f8b86766eac860ce3cc06e01f51ac

      SHA256

      039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f

      SHA512

      c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f

    • \Users\Admin\AppData\Local\Temp\iizlfx.exe
      MD5

      018adcd630666bff50914157771f6e43

      SHA1

      40e4d330149f8b86766eac860ce3cc06e01f51ac

      SHA256

      039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f

      SHA512

      c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f

    • \Users\Admin\AppData\Local\Temp\iizlfx.exe
      MD5

      018adcd630666bff50914157771f6e43

      SHA1

      40e4d330149f8b86766eac860ce3cc06e01f51ac

      SHA256

      039e812b1d3a74c11b8f75424072a59733ef54ffbc1afb33c616966205336f2f

      SHA512

      c2360421eff8f7d5a906690276581e7936f09de0b227b4fed9bda3fc2f261ebb9b5ac5516980bc8ffd60c3d8d3e752a09b246893ebbdd2f46bffddf79971d77f

    • memory/568-75-0x0000000000AD0000-0x0000000000AD5000-memory.dmp
      Filesize

      20KB

    • memory/568-78-0x0000000000990000-0x0000000000A20000-memory.dmp
      Filesize

      576KB

    • memory/568-77-0x0000000002070000-0x0000000002373000-memory.dmp
      Filesize

      3.0MB

    • memory/568-76-0x0000000000080000-0x00000000000A9000-memory.dmp
      Filesize

      164KB

    • memory/940-67-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/940-69-0x0000000000200000-0x0000000000211000-memory.dmp
      Filesize

      68KB

    • memory/940-73-0x0000000000250000-0x0000000000261000-memory.dmp
      Filesize

      68KB

    • memory/940-72-0x000000000041D000-0x000000000041E000-memory.dmp
      Filesize

      4KB

    • memory/940-68-0x000000000041D000-0x000000000041E000-memory.dmp
      Filesize

      4KB

    • memory/940-66-0x0000000000930000-0x0000000000C33000-memory.dmp
      Filesize

      3.0MB

    • memory/940-63-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1384-70-0x0000000006CE0000-0x0000000006E71000-memory.dmp
      Filesize

      1.6MB

    • memory/1384-74-0x0000000006E80000-0x0000000006FEB000-memory.dmp
      Filesize

      1.4MB

    • memory/1384-79-0x0000000005090000-0x0000000005159000-memory.dmp
      Filesize

      804KB

    • memory/1636-55-0x0000000075801000-0x0000000075803000-memory.dmp
      Filesize

      8KB