Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
10/03/2022, 11:00
General
- Target Purchase Order121.exe
- Size 1.2MB
- Sample220310-m33thshgbr
- SHA256 8fb9ddc78aef013fcbc8ff38135972fdacf66a871cc4b42f719efefe2255219f
Malware Config
Extracted
-
xloader
-
2.5
-
juyt
-
wtsam.com
-
arvidaontour.online
-
native-shirt.com
-
i5yx.tech
-
jascroggins.com
-
mcdonnellanalytics.store
-
moreosin.com
-
highanddrygardenworks.com
-
starzara.com
-
pluggdicono.quest
-
chattelsandmore.net
-
djcaponeofficial.com
-
vertexwebdesign.us
-
diagnosiscovid.online
-
deamorwineandoil.com
-
bujok.xyz
-
lesulemetrin.quest
-
mengesleckst.quest
-
sientespa.com
-
mlxezzvvxtuujipokez.biz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
- Xloader Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 30 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order121.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order121.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Vhrunqct.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\VhrunqcO.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet session5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session6⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/720-160-0x00000000076A0000-0x0000000007D1A000-memory.dmp
memory/720-154-0x00000000028E5000-0x00000000028E7000-memory.dmp
memory/720-168-0x0000000007390000-0x0000000007398000-memory.dmp
memory/720-167-0x00000000073A0000-0x00000000073BA000-memory.dmp
memory/720-140-0x00000000028A0000-0x00000000028D6000-memory.dmp
memory/720-141-0x0000000072F80000-0x0000000073730000-memory.dmp
memory/720-143-0x0000000004F40000-0x0000000005568000-memory.dmp
memory/720-166-0x00000000072A0000-0x00000000072AE000-memory.dmp
memory/720-144-0x00000000028E0000-0x00000000028E1000-memory.dmp
memory/720-145-0x00000000028E2000-0x00000000028E3000-memory.dmp
memory/720-147-0x00000000055E0000-0x0000000005602000-memory.dmp
memory/720-148-0x0000000005680000-0x00000000056E6000-memory.dmp
memory/720-149-0x0000000005760000-0x00000000057C6000-memory.dmp
memory/720-165-0x00000000072E0000-0x0000000007376000-memory.dmp
memory/720-164-0x00000000070E0000-0x00000000070EA000-memory.dmp
memory/720-162-0x000000007F9E0000-0x000000007F9E1000-memory.dmp
memory/720-153-0x0000000005DA0000-0x0000000005DBE000-memory.dmp
memory/720-161-0x0000000007060000-0x000000000707A000-memory.dmp
memory/720-159-0x0000000006EB0000-0x0000000006ECE000-memory.dmp
memory/720-158-0x000000006F930000-0x000000006F97C000-memory.dmp
memory/720-157-0x0000000006ED0000-0x0000000006F02000-memory.dmp
memory/2436-152-0x00000000084A0000-0x000000000856F000-memory.dmp
memory/2436-170-0x00000000087A0000-0x00000000088BF000-memory.dmp
memory/2492-138-0x00000000006A0000-0x00000000006A1000-memory.dmp
memory/2492-151-0x0000000002470000-0x0000000002481000-memory.dmp
memory/2492-150-0x000000007249D000-0x000000007249E000-memory.dmp
memory/2492-142-0x00000000025E0000-0x000000000292A000-memory.dmp
memory/2492-139-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/3480-163-0x0000000002380000-0x00000000026CA000-memory.dmp
memory/3480-156-0x0000000000460000-0x0000000000489000-memory.dmp
memory/3480-169-0x00000000021B0000-0x0000000002240000-memory.dmp
memory/3480-155-0x0000000000990000-0x0000000000996000-memory.dmp
memory/4084-134-0x0000000003BF6000-0x0000000003BF7000-memory.dmp
memory/4084-131-0x00000000022E0000-0x00000000022E1000-memory.dmp
memory/4084-132-0x0000000000400000-0x0000000000531000-memory.dmp