Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    14-05-2022 14:49

General

  • Target

    tmp.exe

  • Size

    257KB

  • MD5

    de76ef6a11a63efc00b0303888bc0b7f

  • SHA1

    7ab24456a49f6b61bc54d20a4d9c0b84f3ae696b

  • SHA256

    fc6ebe8bc215a292bb3df340a84350ceb2be7187efc8e10381235cfa8d82f734

  • SHA512

    51a5cf0f640d922ec0d8bf5ba3fcc06b6278e3ac45f07190710c5055a23102a614443641d8b6617775d5a786ccb1e9d10404dfa0e146e6c8ec3481c616214d99

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

nc39

Decoy

bohicaapparel.com

chilliesofwoodstock.com

szcipa.com

nirmalaswagruhafoods.com

orbitas.online

bjvxx.com

atomvpn.site

thecanvacoach.com

thewhitelounge.com

trwebz.xyz

yiwanggkm.com

maggiceden-io.com

kimyanindelisi.online

xn--e02b19uo0j.com

kaola74.top

klcsales.net

renacerdevteam.com

talkmoor.com

seobusinesslistings.com

contractornurd.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1992
      • C:\Users\Admin\AppData\Local\Temp\yldnat.exe
        C:\Users\Admin\AppData\Local\Temp\yldnat.exe C:\Users\Admin\AppData\Local\Temp\boswagvgna
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1964
        • C:\Users\Admin\AppData\Local\Temp\yldnat.exe
          C:\Users\Admin\AppData\Local\Temp\yldnat.exe C:\Users\Admin\AppData\Local\Temp\boswagvgna
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:952
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1324
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\yldnat.exe"
        3⤵
          PID:1220

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\boswagvgna
      Filesize

      5KB

      MD5

      d4aa661b180df0d15bb6d0dc8342b8ba

      SHA1

      07310f7d0c29cd6a18ae1174578f61b08e2ba844

      SHA256

      e12b146fd62913d6650fcaf490cf973008929e47fd247cb3bd75b6e854cfdd89

      SHA512

      b423c31088ce987d77ccb2ecfb055674868dd34a995cca1c5afff3ca6f2bfea0c64037d68132c43735140651cd550507773012c23f142f04b3de984fd4dab39a

    • C:\Users\Admin\AppData\Local\Temp\l4nnhna3wvu7agf
      Filesize

      170KB

      MD5

      0b70240f412d375469a67f4e364e6edd

      SHA1

      877d66cbfff0712d91ed65c7545577729b34cb1a

      SHA256

      daae8081effed8bb74d40479d2264d791a8539f1ed8565438640ee6681d5dc64

      SHA512

      c6980e41d2ea0d85d5a586a32ec6142b301b7e03ac1871587be5ac00fca6cea1680d62262a8656f1b1a4b428567b6baee0c05a35c07c8b9ea09594cb067b64c5

    • C:\Users\Admin\AppData\Local\Temp\yldnat.exe
      Filesize

      78KB

      MD5

      bc3c746db1d3f8a821bbdf17ca023450

      SHA1

      12459c0ef96bde1490b00fc9c6f09d69fbec046f

      SHA256

      c503a6fbe974e2c177fafffc2f2d9f7c26473909a2ab054e305b0e231c54b785

      SHA512

      92a0ebed569ede2306b15d12389110016fc45073beca5bd3ff813beda7988a042d1827ddf8b985112c3d606af378dea952962cb601a85e0eafa7d696eaccecf3

    • C:\Users\Admin\AppData\Local\Temp\yldnat.exe
      Filesize

      78KB

      MD5

      bc3c746db1d3f8a821bbdf17ca023450

      SHA1

      12459c0ef96bde1490b00fc9c6f09d69fbec046f

      SHA256

      c503a6fbe974e2c177fafffc2f2d9f7c26473909a2ab054e305b0e231c54b785

      SHA512

      92a0ebed569ede2306b15d12389110016fc45073beca5bd3ff813beda7988a042d1827ddf8b985112c3d606af378dea952962cb601a85e0eafa7d696eaccecf3

    • C:\Users\Admin\AppData\Local\Temp\yldnat.exe
      Filesize

      78KB

      MD5

      bc3c746db1d3f8a821bbdf17ca023450

      SHA1

      12459c0ef96bde1490b00fc9c6f09d69fbec046f

      SHA256

      c503a6fbe974e2c177fafffc2f2d9f7c26473909a2ab054e305b0e231c54b785

      SHA512

      92a0ebed569ede2306b15d12389110016fc45073beca5bd3ff813beda7988a042d1827ddf8b985112c3d606af378dea952962cb601a85e0eafa7d696eaccecf3

    • \Users\Admin\AppData\Local\Temp\yldnat.exe
      Filesize

      78KB

      MD5

      bc3c746db1d3f8a821bbdf17ca023450

      SHA1

      12459c0ef96bde1490b00fc9c6f09d69fbec046f

      SHA256

      c503a6fbe974e2c177fafffc2f2d9f7c26473909a2ab054e305b0e231c54b785

      SHA512

      92a0ebed569ede2306b15d12389110016fc45073beca5bd3ff813beda7988a042d1827ddf8b985112c3d606af378dea952962cb601a85e0eafa7d696eaccecf3

    • \Users\Admin\AppData\Local\Temp\yldnat.exe
      Filesize

      78KB

      MD5

      bc3c746db1d3f8a821bbdf17ca023450

      SHA1

      12459c0ef96bde1490b00fc9c6f09d69fbec046f

      SHA256

      c503a6fbe974e2c177fafffc2f2d9f7c26473909a2ab054e305b0e231c54b785

      SHA512

      92a0ebed569ede2306b15d12389110016fc45073beca5bd3ff813beda7988a042d1827ddf8b985112c3d606af378dea952962cb601a85e0eafa7d696eaccecf3

    • memory/952-64-0x000000000041F260-mapping.dmp
    • memory/952-69-0x0000000000220000-0x0000000000231000-memory.dmp
      Filesize

      68KB

    • memory/952-63-0x0000000000400000-0x000000000042B000-memory.dmp
      Filesize

      172KB

    • memory/952-67-0x0000000000400000-0x000000000042B000-memory.dmp
      Filesize

      172KB

    • memory/952-68-0x0000000000880000-0x0000000000B83000-memory.dmp
      Filesize

      3.0MB

    • memory/1220-74-0x0000000000000000-mapping.dmp
    • memory/1268-70-0x0000000006970000-0x0000000006AD2000-memory.dmp
      Filesize

      1.4MB

    • memory/1268-77-0x0000000004E40000-0x0000000004F28000-memory.dmp
      Filesize

      928KB

    • memory/1324-71-0x0000000000000000-mapping.dmp
    • memory/1324-72-0x00000000005A0000-0x00000000005C2000-memory.dmp
      Filesize

      136KB

    • memory/1324-73-0x0000000000070000-0x000000000009B000-memory.dmp
      Filesize

      172KB

    • memory/1324-75-0x00000000020C0000-0x00000000023C3000-memory.dmp
      Filesize

      3.0MB

    • memory/1324-76-0x0000000001DF0000-0x0000000001E80000-memory.dmp
      Filesize

      576KB

    • memory/1964-56-0x0000000000000000-mapping.dmp
    • memory/1992-54-0x0000000075DB1000-0x0000000075DB3000-memory.dmp
      Filesize

      8KB