Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21-05-2022 00:40

General

  • Target

    shipment documents for SST2112-250..exe

  • Size

    607KB

  • MD5

    014283a3f74600a5e3184d54d4b9134a

  • SHA1

    f9e163b967fd02e060aaf4020abe6f9e96150526

  • SHA256

    16478611c7b79652c9256355bc0498b0695d26d5a297011a672a5bac9ca40b76

  • SHA512

    01060df227a236cf449c61dcda359ff4b437b89c5491727173afa095bc579a9381106084bbaa463e29e227126bb608563b03c3fe29763e2e1af7135703af5e20

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

a8hq

Decoy

veteransductcleaning.com

beajtjunkies.com

houseofascofi.com

scottsdalemediator.com

atelyadesign.com

profitcase.pro

imtokenio.club

qinglingpai.com

bigsmile-meal.net

daytonlivestream.com

aspiradores10.online

ytybs120.com

hdatelier.com

bearpierce.com

yeson28ca.com

booklearner.com

m8j9.club

mmophamthinhlegend.space

hq4a7o6zb.com

sophiadaki.online

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

  • Xloader Payload 2 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Users\Admin\AppData\Local\Temp\shipment documents for SST2112-250..exe
      "C:\Users\Admin\AppData\Local\Temp\shipment documents for SST2112-250..exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1468
      • C:\Users\Admin\AppData\Local\Temp\shipment documents for SST2112-250..exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2944
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe"
      2⤵
      • Blocklisted process makes network request
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4192
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\shipment documents for SST2112-250..exe"
        3⤵
          PID:1012
        • C:\Windows\SysWOW64\cmd.exe
          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
          3⤵
            PID:2956
          • C:\Windows\SysWOW64\cmd.exe
            /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
            3⤵
              PID:3300
            • C:\Program Files\Mozilla Firefox\Firefox.exe
              "C:\Program Files\Mozilla Firefox\Firefox.exe"
              3⤵
                PID:1428

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Persistence

          Registry Run Keys / Startup Folder

          1
          T1060

          Defense Evasion

          Modify Registry

          2
          T1112

          Credential Access

          Credentials in Files

          1
          T1081

          Collection

          Data from Local System

          1
          T1005

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\DB1
            Filesize

            40KB

            MD5

            b608d407fc15adea97c26936bc6f03f6

            SHA1

            953e7420801c76393902c0d6bb56148947e41571

            SHA256

            b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

            SHA512

            cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

          • C:\Users\Admin\AppData\Local\Temp\DB1
            Filesize

            48KB

            MD5

            349e6eb110e34a08924d92f6b334801d

            SHA1

            bdfb289daff51890cc71697b6322aa4b35ec9169

            SHA256

            c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

            SHA512

            2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

          • memory/1012-142-0x0000000000000000-mapping.dmp
          • memory/1468-134-0x0000000004D20000-0x0000000004D2A000-memory.dmp
            Filesize

            40KB

          • memory/1468-130-0x0000000000300000-0x000000000039E000-memory.dmp
            Filesize

            632KB

          • memory/1468-133-0x0000000004E40000-0x0000000004EDC000-memory.dmp
            Filesize

            624KB

          • memory/1468-132-0x0000000004DA0000-0x0000000004E32000-memory.dmp
            Filesize

            584KB

          • memory/1468-131-0x0000000005350000-0x00000000058F4000-memory.dmp
            Filesize

            5.6MB

          • memory/2944-135-0x0000000000000000-mapping.dmp
          • memory/2944-136-0x0000000000400000-0x000000000042B000-memory.dmp
            Filesize

            172KB

          • memory/2944-138-0x0000000001730000-0x0000000001A7A000-memory.dmp
            Filesize

            3.3MB

          • memory/2944-139-0x0000000001240000-0x0000000001251000-memory.dmp
            Filesize

            68KB

          • memory/2956-148-0x0000000000000000-mapping.dmp
          • memory/3064-147-0x00000000082B0000-0x000000000842E000-memory.dmp
            Filesize

            1.5MB

          • memory/3064-140-0x0000000003400000-0x00000000034ED000-memory.dmp
            Filesize

            948KB

          • memory/3300-150-0x0000000000000000-mapping.dmp
          • memory/4192-141-0x0000000000000000-mapping.dmp
          • memory/4192-146-0x0000000001090000-0x0000000001120000-memory.dmp
            Filesize

            576KB

          • memory/4192-145-0x0000000001190000-0x00000000014DA000-memory.dmp
            Filesize

            3.3MB

          • memory/4192-144-0x0000000000910000-0x000000000093B000-memory.dmp
            Filesize

            172KB

          • memory/4192-143-0x00000000001D0000-0x000000000022A000-memory.dmp
            Filesize

            360KB