Analysis

  • max time kernel
    151s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220310-en
  • submitted
    28-03-2022 11:19

General

  • Target

    RQM6HLsZQYLa9qt.exe

  • Size

    1.3MB

  • MD5

    2d42eded04b592b539951f61742a736a

  • SHA1

    d0c31bc164b18121ceb884859a9a5a5547ee437e

  • SHA256

    02ad8318feb2f8ce745e2cefa321f18d19b7ad72085664371033fada68bd6b91

  • SHA512

    634e5223d883e42be784a02c4882109140ef7a42a781d4142978bf7a3da40ae4c535a5dffca1e26160542338c437fe44ce8f84f8ab32b7df328ad7837517f4ff

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

wdc8

Decoy

mygotomaid.com

joyoushealthandwellnessspa.com

wefundprojects.com

magicbasketbourse.net

vitos3.xyz

oligopoly.city

beauty-bihada.asia

visitnewrichmond.com

crgeniusworld.biz

bantasis.com

transsexual.pro

casagraph.com

eastjamrecords.com

howtotrainyourmustache.com

heiappropriate.xyz

bataperu.com

ces341.com

prajahitha.com

manuelagattegger.com

wolfpackmotorcycletours.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Users\Admin\AppData\Local\Temp\RQM6HLsZQYLa9qt.exe
      "C:\Users\Admin\AppData\Local\Temp\RQM6HLsZQYLa9qt.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2596
      • C:\Users\Admin\AppData\Local\Temp\RQM6HLsZQYLa9qt.exe
        "C:\Users\Admin\AppData\Local\Temp\RQM6HLsZQYLa9qt.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:5012
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4220
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\RQM6HLsZQYLa9qt.exe"
        3⤵
          PID:4520

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2596-135-0x0000000005380000-0x0000000005924000-memory.dmp
      Filesize

      5.6MB

    • memory/2596-136-0x0000000004E70000-0x0000000004F02000-memory.dmp
      Filesize

      584KB

    • memory/2596-137-0x0000000004DF0000-0x0000000004DFA000-memory.dmp
      Filesize

      40KB

    • memory/2596-138-0x0000000008670000-0x000000000870C000-memory.dmp
      Filesize

      624KB

    • memory/2596-134-0x00000000002E0000-0x000000000043A000-memory.dmp
      Filesize

      1.4MB

    • memory/3048-144-0x0000000007B90000-0x0000000007CCC000-memory.dmp
      Filesize

      1.2MB

    • memory/3048-151-0x0000000007CF0000-0x0000000007DCB000-memory.dmp
      Filesize

      876KB

    • memory/4220-147-0x0000000000D30000-0x0000000000D42000-memory.dmp
      Filesize

      72KB

    • memory/4220-145-0x0000000000000000-mapping.dmp
    • memory/4220-148-0x0000000001060000-0x0000000001089000-memory.dmp
      Filesize

      164KB

    • memory/4220-149-0x0000000002FD0000-0x000000000331A000-memory.dmp
      Filesize

      3.3MB

    • memory/4220-150-0x0000000003320000-0x00000000033B0000-memory.dmp
      Filesize

      576KB

    • memory/4520-146-0x0000000000000000-mapping.dmp
    • memory/5012-142-0x0000000001B10000-0x0000000001E5A000-memory.dmp
      Filesize

      3.3MB

    • memory/5012-143-0x0000000001650000-0x0000000001661000-memory.dmp
      Filesize

      68KB

    • memory/5012-140-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/5012-139-0x0000000000000000-mapping.dmp