Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220331-en
  • submitted
    11-04-2022 06:54

General

  • Target

    order.exe

  • Size

    242KB

  • MD5

    1fca4a7a2a1bc5631ae3bed8065a9167

  • SHA1

    631a8a37179b57365515e1b4741305d75928342e

  • SHA256

    27331403cd4e737d09c723eaa8ad57607f4a243a1fcde752443af581b9141092

  • SHA512

    ac4bc3e02782b8ac894caa2eb536eb193e460b011bdf4926649ac4416bbf96642a7aeaa0f60a5e739ea5d7553e411e8674f4399b5a6f0443070fe963ec8739a0

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

cbgo

Decoy

santesha.com

britneysbeautybar.com

sh-cy17.com

jeffcarveragency.com

3117111.com

sobrehosting.net

ddm123.xyz

toxcompliance.com

auditorydesigns.com

vliftfacial.com

ielhii.com

naameliss.com

ritualchariot.com

solchange.com

quatre-vingts.design

lawnmowermashine.com

braceletsstore.net

admappy.com

tollivercoltd.com

vaidix.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\order.exe
      "C:\Users\Admin\AppData\Local\Temp\order.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
        C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe C:\Users\Admin\AppData\Local\Temp\mjxuvurepn
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1112
        • C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
          C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe C:\Users\Admin\AppData\Local\Temp\mjxuvurepn
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1740
    • C:\Windows\SysWOW64\msdt.exe
      "C:\Windows\SysWOW64\msdt.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1148
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe"
        3⤵
          PID:848

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
      Filesize

      6KB

      MD5

      28692b8f1f61c582b540a086820097e9

      SHA1

      a57f8bf69b2c89947d91b3eb968e4925b447b273

      SHA256

      7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

      SHA512

      29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

    • C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
      Filesize

      6KB

      MD5

      28692b8f1f61c582b540a086820097e9

      SHA1

      a57f8bf69b2c89947d91b3eb968e4925b447b273

      SHA256

      7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

      SHA512

      29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

    • C:\Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
      Filesize

      6KB

      MD5

      28692b8f1f61c582b540a086820097e9

      SHA1

      a57f8bf69b2c89947d91b3eb968e4925b447b273

      SHA256

      7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

      SHA512

      29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

    • C:\Users\Admin\AppData\Local\Temp\mjxuvurepn
      Filesize

      4KB

      MD5

      9bac10f869bf8307d17de84fbb4d2393

      SHA1

      90af62da1c66391e0267b984a9cc92268e9cafec

      SHA256

      7cbb56af0e0ffb9b752368cbc204fe48a197d2c5df76fb30b09e5b9110d50d13

      SHA512

      2f047b48e736f3fc4ea66952866c1854bb765ef4c8e34321b0c230c70cb40fd948d5b094101586dec051a7c47ec0e3dfbd9a593d1a857e24815eab51f7ecee17

    • C:\Users\Admin\AppData\Local\Temp\t5jmbsy9kwg1m2u7ebq
      Filesize

      212KB

      MD5

      562c6825bc59812dfe147ff9d86ef126

      SHA1

      b6e7f2ebe369cef46c22c5990a2d5c78b2d17a07

      SHA256

      88b6b55757f0195147295c30faff512bf31a80ec2a83fff86c43d4cfd97a2da8

      SHA512

      9bab1f20f75310be1d2b28ccb492095e481cb7627dd002857beb7c87071ab11d47b159ee45e85049b3e9328bdd1a9e34f56a7dfa22e3fcaadbffe5c473f74483

    • \Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
      Filesize

      6KB

      MD5

      28692b8f1f61c582b540a086820097e9

      SHA1

      a57f8bf69b2c89947d91b3eb968e4925b447b273

      SHA256

      7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

      SHA512

      29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

    • \Users\Admin\AppData\Local\Temp\ceozrdkqb.exe
      Filesize

      6KB

      MD5

      28692b8f1f61c582b540a086820097e9

      SHA1

      a57f8bf69b2c89947d91b3eb968e4925b447b273

      SHA256

      7ad679080ff3a2b4411314e52be107da2c4da7f44ce33b73dd96c8077849d252

      SHA512

      29a3be92be4699243f4561c9e7bfdbb465ea1c36617680e5275ac00fb8e1f37507b0de0057ee96f4220327ff510bb36170511cde4ae744d411564b6305025f80

    • memory/848-73-0x0000000000000000-mapping.dmp
    • memory/1112-56-0x0000000000000000-mapping.dmp
    • memory/1148-71-0x0000000000000000-mapping.dmp
    • memory/1148-74-0x0000000000E30000-0x0000000000F24000-memory.dmp
      Filesize

      976KB

    • memory/1148-76-0x0000000002330000-0x0000000002633000-memory.dmp
      Filesize

      3.0MB

    • memory/1148-75-0x0000000000080000-0x00000000000A9000-memory.dmp
      Filesize

      164KB

    • memory/1148-77-0x0000000000AA0000-0x0000000000B30000-memory.dmp
      Filesize

      576KB

    • memory/1256-70-0x0000000004D90000-0x0000000004F05000-memory.dmp
      Filesize

      1.5MB

    • memory/1256-78-0x00000000040B0000-0x00000000041A5000-memory.dmp
      Filesize

      980KB

    • memory/1544-54-0x0000000075C11000-0x0000000075C13000-memory.dmp
      Filesize

      8KB

    • memory/1740-64-0x000000000041D450-mapping.dmp
    • memory/1740-67-0x0000000000810000-0x0000000000B13000-memory.dmp
      Filesize

      3.0MB

    • memory/1740-68-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1740-69-0x0000000000240000-0x0000000000251000-memory.dmp
      Filesize

      68KB

    • memory/1740-63-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB