Analysis
- max time kernel
153s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
19/04/2022, 11:50
General
- Target SOA.exe
- Size 44KB
- Sample220419-nzkzzaadb7
- SHA256 188e88b01bc05b9e23ce3133471d99ecaec9515404faa787f745fc70bafe4656
Malware Config
Extracted
-
xloader
-
2.5
-
fk84
-
indianasheriffs.info
-
yuanyeong.com
-
growmato-project.com
-
juvak.xyz
-
selmarsolutions.com
-
guaranteedrepair.com
-
yescotwis.quest
-
journee-interimaire.com
-
pass-sfc.net
-
thinkingintomiracles.com
-
klaserclinic.com
-
sunspire.store
-
uvowtae.xyz
-
malcoruesch.com
-
flower.contractors
-
b98u3e.com
-
fulaxiong.com
-
jasarenovasitukang.com
-
tllddb.com
-
breackae.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 103⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 104⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\SOA.exeC:\Users\Admin\AppData\Local\Temp\SOA.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SOA.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2848-131-0x0000000005100000-0x00000000056A4000-memory.dmp
memory/2848-132-0x0000000004B50000-0x0000000004BE2000-memory.dmp
memory/2848-133-0x0000000004AD0000-0x0000000004ADA000-memory.dmp
memory/2848-130-0x0000000000110000-0x0000000000122000-memory.dmp
memory/2996-141-0x0000000007BC0000-0x0000000007CDC000-memory.dmp
memory/2996-148-0x0000000002BE0000-0x0000000002CAD000-memory.dmp
memory/4172-144-0x0000000000680000-0x000000000069F000-memory.dmp
memory/4172-146-0x0000000002B20000-0x0000000002E6A000-memory.dmp
memory/4172-145-0x0000000000AD0000-0x0000000000AF9000-memory.dmp
memory/4172-147-0x0000000002850000-0x00000000028E0000-memory.dmp
memory/4400-140-0x0000000000EE0000-0x0000000000EF1000-memory.dmp
memory/4400-138-0x0000000000FA0000-0x00000000012EA000-memory.dmp
memory/4400-137-0x0000000000400000-0x0000000000429000-memory.dmp