Analysis
- max time kernel
158s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
31/03/2022, 08:49
General
- Target เอกสารใบเสร็จรับเงิน DHL1397070,pdf.exe
- Size 662KB
- Sample220331-kq1ghsdcem
- SHA256 676f651c6b2e0bc3be79ddfc7c5ce1da527ccb97421928f1b806962c24a5fe50
Malware Config
Extracted
-
xloader
-
2.5
-
apg5
-
huihengde.com
-
oneoaro.xyz
-
dcdowlfoen.com
-
campjyounoyome.com
-
blockart.digital
-
vsajobs.net
-
isx-devops.net
-
buyinerie.com
-
1001clothing.com
-
thejoyofdrinking.com
-
richgoldfever.com
-
tandooriexpressrestaurant.store
-
mgav99.xyz
-
modnybutik.com
-
f-b-r.com
-
learn-i.com
-
ybjoxuvb.quest
-
g4cp.com
-
lmdfmall.com
-
chiclilys.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\เอกสารใบเสร็จรับเงิน DHL1397070,pdf.exe"C:\Users\Admin\AppData\Local\Temp\เอกสารใบเสร็จรับเงิน DHL1397070,pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/848-130-0x00000000004E0000-0x000000000058C000-memory.dmp
memory/848-131-0x00000000054A0000-0x0000000005A44000-memory.dmp
memory/848-132-0x0000000004F90000-0x0000000005022000-memory.dmp
memory/1176-137-0x0000000001170000-0x0000000001181000-memory.dmp
memory/1176-134-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1176-136-0x00000000016C0000-0x0000000001A0A000-memory.dmp
memory/1992-140-0x0000000000D00000-0x0000000000D0B000-memory.dmp
memory/1992-141-0x0000000000950000-0x0000000000979000-memory.dmp
memory/1992-142-0x0000000001300000-0x000000000164A000-memory.dmp
memory/1992-144-0x0000000001130000-0x00000000011C0000-memory.dmp
memory/2712-138-0x0000000002AB0000-0x0000000002C2A000-memory.dmp
memory/2712-145-0x0000000002DC0000-0x0000000002E93000-memory.dmp