Analysis
- max time kernel
156s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
11/03/2022, 17:18
General
- Target DHL shipment doc.exe
- Size 809KB
- Sample220311-vvclcsdecp
- SHA256 012ac67f5277ccbad1b30abc6e5288046db94d7cfdca31a3cb7197582ce5a480
Malware Config
Extracted
-
xloader
-
2.5
-
qdq1
-
advertising-machine.online
-
photo.fail
-
loyaltyfaq.com
-
7lywzx3mh.com
-
liberate2024.com
-
xn--xhqp74a1vhb74b.group
-
konekt-top.space
-
portraitsbypaul.com
-
cattlecoinranch.com
-
3963.space
-
egigpay.com
-
thesouthlandband.com
-
vickywestmore.com
-
rewindau.com
-
21countryplace.com
-
cuffingseasonfilm.com
-
variableclement.com
-
ericksonwebmail.com
-
lmczedu.com
-
brw-solutlons.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL shipment doc.exe"C:\Users\Admin\AppData\Local\Temp\DHL shipment doc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL shipment doc.exe"C:\Users\Admin\AppData\Local\Temp\DHL shipment doc.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DHL shipment doc.exe"C:\Users\Admin\AppData\Local\Temp\DHL shipment doc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL shipment doc.exe"3⤵
-
-
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv yD6ndoXEHEiaOqBFxI5mhA.01⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2260-134-0x0000000000F40000-0x0000000001010000-memory.dmp
memory/2260-135-0x0000000074430000-0x0000000074BE0000-memory.dmp
memory/2260-136-0x00000000060E0000-0x0000000006684000-memory.dmp
memory/2260-137-0x0000000005A00000-0x0000000005A92000-memory.dmp
memory/2260-138-0x00000000059E0000-0x00000000059EA000-memory.dmp
memory/2260-139-0x0000000005B30000-0x00000000060D4000-memory.dmp
memory/2260-140-0x0000000008120000-0x00000000081BC000-memory.dmp
memory/2776-147-0x0000000008C00000-0x0000000008D0B000-memory.dmp
memory/2776-152-0x0000000008D10000-0x0000000008E11000-memory.dmp
memory/3196-148-0x0000000000AF0000-0x0000000000B47000-memory.dmp
memory/3196-149-0x00000000033A0000-0x00000000036EA000-memory.dmp
memory/3196-150-0x0000000001200000-0x0000000001229000-memory.dmp
memory/3196-151-0x00000000030B0000-0x0000000003140000-memory.dmp
memory/4148-143-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4148-144-0x0000000001430000-0x000000000177A000-memory.dmp
memory/4148-145-0x000000000041D000-0x000000000041E000-memory.dmp
memory/4148-146-0x0000000001100000-0x0000000001111000-memory.dmp
memory/4148-141-0x0000000000400000-0x0000000000429000-memory.dmp