Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
01/04/2022, 09:00
General
- Target HBL - TPLINNYC20220211 - ZET MFG -.exe
- Size 939KB
- Sample220401-kyc17adfbr
- SHA256 b90122d45b3e426cdf4343cc47fd486e67d4d2fe861f6a686f4d29919a327ed3
Malware Config
Extracted
-
xloader
-
2.5
-
k9so
-
unconsulted.com
-
videomuncher.com
-
ktntwin.xyz
-
mgm-photography.com
-
ruzgardent.com
-
etfc.email
-
coincamo89.com
-
thenicolerussell.com
-
phuquocnightlife.com
-
rosanamunozfisioterapia.com
-
a2siaruj2.xyz
-
pedorc.com
-
auto-hybrid.info
-
9dzz.com
-
casinopiscinealey.com
-
visualcleanx.com
-
melisavera.com
-
onlineb5d2.com
-
drsharonslanguagecourses.mobi
-
cryptoregulation.xyz
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Modifies system certificate store 2 TTPs 2 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HBL - TPLINNYC20220211 - ZET MFG -.exe"C:\Users\Admin\AppData\Local\Temp\HBL - TPLINNYC20220211 - ZET MFG -.exe"2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\Xhlrudkt.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Public\Libraries\XhlrudkO.bat4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet session5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session6⤵
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Cdex.bat
XhlrudkO.bat
Xhlrudkt.bat
memory/1068-150-0x0000000006880000-0x000000000689E000-memory.dmp
memory/1068-146-0x0000000005A10000-0x0000000005A32000-memory.dmp
memory/1068-164-0x0000000007E80000-0x0000000007E9A000-memory.dmp
memory/1068-157-0x0000000007A80000-0x0000000007A9A000-memory.dmp
memory/1068-154-0x0000000006DC0000-0x0000000006DDE000-memory.dmp
memory/1068-163-0x0000000007D80000-0x0000000007D8E000-memory.dmp
memory/1068-141-0x0000000005390000-0x00000000053C6000-memory.dmp
memory/1068-142-0x0000000005A50000-0x0000000006078000-memory.dmp
memory/1068-162-0x0000000007DB0000-0x0000000007E46000-memory.dmp
memory/1068-158-0x0000000007BC0000-0x0000000007BCA000-memory.dmp
memory/1068-165-0x0000000007E70000-0x0000000007E78000-memory.dmp
memory/1068-147-0x0000000006170000-0x00000000061D6000-memory.dmp
memory/1068-148-0x0000000006250000-0x00000000062B6000-memory.dmp
memory/1068-153-0x000000006F3B0000-0x000000006F3FC000-memory.dmp
memory/1068-156-0x0000000008200000-0x000000000887A000-memory.dmp
memory/1068-151-0x0000000005415000-0x0000000005417000-memory.dmp
memory/1068-152-0x0000000006E20000-0x0000000006E52000-memory.dmp
memory/2436-149-0x00000000084A0000-0x00000000085F3000-memory.dmp
memory/2436-167-0x00000000087A0000-0x00000000088E3000-memory.dmp
memory/3320-140-0x0000000010410000-0x0000000010439000-memory.dmp
memory/3320-145-0x00000000030D0000-0x00000000030E1000-memory.dmp
memory/3320-144-0x0000000003260000-0x00000000035AA000-memory.dmp
memory/3604-159-0x0000000000280000-0x0000000000286000-memory.dmp
memory/3604-160-0x00000000005D0000-0x00000000005F9000-memory.dmp
memory/3604-161-0x0000000002780000-0x0000000002ACA000-memory.dmp
memory/3604-166-0x00000000024D0000-0x0000000002560000-memory.dmp