Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220331-en
  • submitted
    04-04-2022 13:49

General

  • Target

    BLLLLAADDEE.exe

  • Size

    35KB

  • MD5

    0a8d67dc73dadb3aafaa35ba4c522a99

  • SHA1

    80ef67fc098bd298cf4d286adaf1e59dbace8211

  • SHA256

    ccc3111d1efd08344fdaa03990ed7029b09e1a5f014424760b6ae2eae5539829

  • SHA512

    f768f28c5981a53f36b670dc356bed13c9311c81064f1b36b062731ca4f76a336a81b7f3d447b549198ab8b50bf401a7cc0876575261e3e66cee26f9c88d1b15

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ssac

Decoy

beautybybrin.com

oregemo.com

prospectoriq.com

blazermid.com

cloudnineloans.com

myyntisofta.com

filoupoils.com

web-solutiontnpasumo3.xyz

becbares.com

lines-hikkoshi.com

ohayouwww.com

writingdadsobituarywithdad.com

bridalbaes.com

jamshir.com

rangertots.com

dankbrobeans.com

titan111.com

uplearns.info

maxicashprokil.xyz

evc24.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Users\Admin\AppData\Local\Temp\BLLLLAADDEE.exe
      "C:\Users\Admin\AppData\Local\Temp\BLLLLAADDEE.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3412
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2396
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4168
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        3⤵
          PID:3484

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2016-131-0x00000000088D0000-0x00000000089F1000-memory.dmp
      Filesize

      1.1MB

    • memory/2016-141-0x0000000008BA0000-0x0000000008CC1000-memory.dmp
      Filesize

      1.1MB

    • memory/2016-134-0x0000000008A00000-0x0000000008B03000-memory.dmp
      Filesize

      1.0MB

    • memory/2396-133-0x0000000001410000-0x0000000001421000-memory.dmp
      Filesize

      68KB

    • memory/2396-130-0x0000000000FA0000-0x0000000000FB1000-memory.dmp
      Filesize

      68KB

    • memory/2396-127-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/2396-132-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/2396-126-0x0000000000000000-mapping.dmp
    • memory/2396-129-0x0000000001470000-0x00000000017BA000-memory.dmp
      Filesize

      3.3MB

    • memory/3412-125-0x0000000005940000-0x00000000059DC000-memory.dmp
      Filesize

      624KB

    • memory/3412-124-0x0000000000290000-0x000000000029C000-memory.dmp
      Filesize

      48KB

    • memory/3484-136-0x0000000000000000-mapping.dmp
    • memory/4168-135-0x0000000000000000-mapping.dmp
    • memory/4168-137-0x0000000000450000-0x0000000000477000-memory.dmp
      Filesize

      156KB

    • memory/4168-139-0x0000000002EC0000-0x000000000320A000-memory.dmp
      Filesize

      3.3MB

    • memory/4168-140-0x0000000002BF0000-0x0000000002C80000-memory.dmp
      Filesize

      576KB

    • memory/4168-138-0x0000000000D50000-0x0000000000D79000-memory.dmp
      Filesize

      164KB