Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    12-05-2022 07:33

General

  • Target

    b116243ed4215cbcb325a827d11cdc68.exe

  • Size

    245KB

  • MD5

    b116243ed4215cbcb325a827d11cdc68

  • SHA1

    c9ef499d8ec2966dda389ce769012b4ad6661cbc

  • SHA256

    ecd736b3ee17564a101bfdf8ff757edf53948a983ef1c1dd088cd9f214034990

  • SHA512

    39543aa90882920e8ba46777eb092abb678471c7cc7876d1ad98b2d4b1c6f4f50669d18c764c3b655866a682acabe2b73e1958be5a4ebfc0973574d210393ef3

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

bs8f

Decoy

atmospheraglobal.com

dontshootima.com

bestofferusde.club

yourdigitalboss.com

breskizci.com

myarrovacoastwebsite.com

reasclerk.com

efrovida.com

wsmz.net

upneett.com

loefflerforgov.com

noida.info

trndystore.com

arhaldar.online

vivibanca.tech

mykrema.com

vseserialy.online

ridgewayinsua.com

heauxland.com

bestcollegecourses.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\b116243ed4215cbcb325a827d11cdc68.exe
      "C:\Users\Admin\AppData\Local\Temp\b116243ed4215cbcb325a827d11cdc68.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1320
      • C:\Users\Admin\AppData\Local\Temp\fdwfm.exe
        C:\Users\Admin\AppData\Local\Temp\fdwfm.exe C:\Users\Admin\AppData\Local\Temp\dimjwfh
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:624
        • C:\Users\Admin\AppData\Local\Temp\fdwfm.exe
          C:\Users\Admin\AppData\Local\Temp\fdwfm.exe C:\Users\Admin\AppData\Local\Temp\dimjwfh
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1236
    • C:\Windows\SysWOW64\NAPSTAT.EXE
      "C:\Windows\SysWOW64\NAPSTAT.EXE"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\fdwfm.exe"
        3⤵
          PID:1072

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\07psh9jxx8mb5t
      Filesize

      163KB

      MD5

      2c8a5acbcf62c17a33d922b3b195e5f2

      SHA1

      4d8f1fd37d8a88fce9a413e50953616a2a79a4a7

      SHA256

      a4a062a6f2ba7f29ef472549256f378c72ce26b94466acd3a313eb6d61fbc664

      SHA512

      e96420d378adf2b601b067a8d6426a4544b0c42dcca850ba3e342167899f3245bd2b5d4655015e39b26e3465566c10d1576253f5c104904362ea27700fadc24c

    • C:\Users\Admin\AppData\Local\Temp\dimjwfh
      Filesize

      4KB

      MD5

      cb63c004083d462107d544017b29f953

      SHA1

      20896ed8b2ef0f60cd37cea225f0174ac4a4fe6b

      SHA256

      da7cb9a05a5d27d1d6a2817bee8478627bbaaea1dcc393cd58f32b461462d4c7

      SHA512

      aa0475bd3bda49f7d032a53b5dc98d8029718f9bc15b209c8cf8f5515cd59e3e20209908d8d9df139c38420f23bd69808bb1b452adb1e0576d9834ba0a465445

    • C:\Users\Admin\AppData\Local\Temp\fdwfm.exe
      Filesize

      74KB

      MD5

      20a453ac2dfd314bf1f374bb0171681e

      SHA1

      cf673d84f74b343061b923a8cd90936344cb5bc4

      SHA256

      26a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0

      SHA512

      ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642

    • C:\Users\Admin\AppData\Local\Temp\fdwfm.exe
      Filesize

      74KB

      MD5

      20a453ac2dfd314bf1f374bb0171681e

      SHA1

      cf673d84f74b343061b923a8cd90936344cb5bc4

      SHA256

      26a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0

      SHA512

      ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642

    • C:\Users\Admin\AppData\Local\Temp\fdwfm.exe
      Filesize

      74KB

      MD5

      20a453ac2dfd314bf1f374bb0171681e

      SHA1

      cf673d84f74b343061b923a8cd90936344cb5bc4

      SHA256

      26a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0

      SHA512

      ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642

    • \Users\Admin\AppData\Local\Temp\fdwfm.exe
      Filesize

      74KB

      MD5

      20a453ac2dfd314bf1f374bb0171681e

      SHA1

      cf673d84f74b343061b923a8cd90936344cb5bc4

      SHA256

      26a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0

      SHA512

      ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642

    • \Users\Admin\AppData\Local\Temp\fdwfm.exe
      Filesize

      74KB

      MD5

      20a453ac2dfd314bf1f374bb0171681e

      SHA1

      cf673d84f74b343061b923a8cd90936344cb5bc4

      SHA256

      26a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0

      SHA512

      ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642

    • \Users\Admin\AppData\Local\Temp\fdwfm.exe
      Filesize

      74KB

      MD5

      20a453ac2dfd314bf1f374bb0171681e

      SHA1

      cf673d84f74b343061b923a8cd90936344cb5bc4

      SHA256

      26a72e117f00a00dfe14730575d9e791eb783f5df77d3cdc7e736ef8493f93e0

      SHA512

      ba8606472ab4d03ef92689ddf993df62d0e1dc743e65821e915ef6237e9ff9e81cd7670f1da3f88748e1b66a8a80e72d9796adcb834fc159314db9af4882a642

    • memory/624-57-0x0000000000000000-mapping.dmp
    • memory/1072-72-0x0000000000000000-mapping.dmp
    • memory/1112-71-0x0000000000000000-mapping.dmp
    • memory/1112-76-0x00000000003D0000-0x0000000000460000-memory.dmp
      Filesize

      576KB

    • memory/1112-75-0x0000000002030000-0x0000000002333000-memory.dmp
      Filesize

      3.0MB

    • memory/1112-74-0x00000000000C0000-0x00000000000E9000-memory.dmp
      Filesize

      164KB

    • memory/1112-73-0x0000000000BE0000-0x0000000000C26000-memory.dmp
      Filesize

      280KB

    • memory/1236-63-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1236-69-0x00000000003B0000-0x00000000003C1000-memory.dmp
      Filesize

      68KB

    • memory/1236-68-0x0000000000970000-0x0000000000C73000-memory.dmp
      Filesize

      3.0MB

    • memory/1236-67-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1236-64-0x000000000041D440-mapping.dmp
    • memory/1280-70-0x0000000005110000-0x00000000051E1000-memory.dmp
      Filesize

      836KB

    • memory/1280-77-0x0000000002C50000-0x0000000002CF6000-memory.dmp
      Filesize

      664KB

    • memory/1320-54-0x0000000075CD1000-0x0000000075CD3000-memory.dmp
      Filesize

      8KB