Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    30-05-2022 13:14

General

  • Target

    New Products Inquiry 300522.xlsx

  • Size

    136KB

  • MD5

    676846d78e0b595abea9a8bc027a2998

  • SHA1

    52e3403b5bcb44fe78fc22746f9835efbc02b415

  • SHA256

    dcfc0d21809cf35594dcaa248fa00907c47efe04df346049d4972c380854aa56

  • SHA512

    83e46688840b98ea65c514d38fb13dbebc9a7ab5d342d6f297f983aa63474e0923c7828d2f1a53614335eda73846fddfec0e69a08d9d22cd3136ea6491e0784d

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

be4o

Decoy

laboratoriobioixcha.com

tictocperushop.online

wild-oceans.com

belaruscountry.com

kicktmall.com

fitcoinweb.tech

mores.one

gogear.one

gxrcksy.com

samrcq.com

impossible-icecream.com

bravesxx.com

bookchainart.com

sleepsolutionsofmboro.com

ocbrazilbusinessclub.com

advisor76.xyz

xitaotech.com

mgsdtytifgf3414.xyz

johnson-brown.net

cr3drt.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Xloader Payload 6 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\New Products Inquiry 300522.xlsx"
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:872
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
          PID:1520
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:1696
      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        PID:1280
        • C:\Users\Public\vbc.exe
          "C:\Users\Public\vbc.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1804
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:1744

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Execution

      Scripting

      1
      T1064

      Exploitation for Client Execution

      1
      T1203

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      Scripting

      1
      T1064

      Modify Registry

      2
      T1112

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Public\vbc.exe
        Filesize

        798KB

        MD5

        fa6cb9677ff2254615166747668a72ed

        SHA1

        e784bfd8f5f4514569205bb535ed8bc36ab47f28

        SHA256

        4fe26ebfc5412205231040de3bf8f865da141f2c9c5c2c809e4bf6ceced43e55

        SHA512

        e6e05225ecbf3e0157bc5b55980c17a7e9f61d36aadb172ae753b140c69b10f3e58d3a020e4225a25596b7aae586409e7c59e4ab2046e134ce5ccfc281484617

      • C:\Users\Public\vbc.exe
        Filesize

        798KB

        MD5

        fa6cb9677ff2254615166747668a72ed

        SHA1

        e784bfd8f5f4514569205bb535ed8bc36ab47f28

        SHA256

        4fe26ebfc5412205231040de3bf8f865da141f2c9c5c2c809e4bf6ceced43e55

        SHA512

        e6e05225ecbf3e0157bc5b55980c17a7e9f61d36aadb172ae753b140c69b10f3e58d3a020e4225a25596b7aae586409e7c59e4ab2046e134ce5ccfc281484617

      • \Users\Public\vbc.exe
        Filesize

        798KB

        MD5

        fa6cb9677ff2254615166747668a72ed

        SHA1

        e784bfd8f5f4514569205bb535ed8bc36ab47f28

        SHA256

        4fe26ebfc5412205231040de3bf8f865da141f2c9c5c2c809e4bf6ceced43e55

        SHA512

        e6e05225ecbf3e0157bc5b55980c17a7e9f61d36aadb172ae753b140c69b10f3e58d3a020e4225a25596b7aae586409e7c59e4ab2046e134ce5ccfc281484617

      • \Users\Public\vbc.exe
        Filesize

        798KB

        MD5

        fa6cb9677ff2254615166747668a72ed

        SHA1

        e784bfd8f5f4514569205bb535ed8bc36ab47f28

        SHA256

        4fe26ebfc5412205231040de3bf8f865da141f2c9c5c2c809e4bf6ceced43e55

        SHA512

        e6e05225ecbf3e0157bc5b55980c17a7e9f61d36aadb172ae753b140c69b10f3e58d3a020e4225a25596b7aae586409e7c59e4ab2046e134ce5ccfc281484617

      • memory/872-58-0x00000000764C1000-0x00000000764C3000-memory.dmp
        Filesize

        8KB

      • memory/872-89-0x000000007237D000-0x0000000072388000-memory.dmp
        Filesize

        44KB

      • memory/872-57-0x000000007237D000-0x0000000072388000-memory.dmp
        Filesize

        44KB

      • memory/872-56-0x000000005FFF0000-0x0000000060000000-memory.dmp
        Filesize

        64KB

      • memory/872-55-0x0000000071391000-0x0000000071393000-memory.dmp
        Filesize

        8KB

      • memory/872-54-0x000000002FD71000-0x000000002FD74000-memory.dmp
        Filesize

        12KB

      • memory/1220-94-0x0000000004DD0000-0x0000000004E92000-memory.dmp
        Filesize

        776KB

      • memory/1220-93-0x0000000004DD0000-0x0000000004E92000-memory.dmp
        Filesize

        776KB

      • memory/1220-80-0x0000000004C80000-0x0000000004DC6000-memory.dmp
        Filesize

        1.3MB

      • memory/1248-92-0x0000000000080000-0x00000000000AB000-memory.dmp
        Filesize

        172KB

      • memory/1248-88-0x00000000020E0000-0x00000000023E3000-memory.dmp
        Filesize

        3.0MB

      • memory/1248-86-0x0000000000330000-0x000000000034C000-memory.dmp
        Filesize

        112KB

      • memory/1248-87-0x0000000000080000-0x00000000000AB000-memory.dmp
        Filesize

        172KB

      • memory/1248-90-0x00000000004E0000-0x0000000000570000-memory.dmp
        Filesize

        576KB

      • memory/1248-81-0x0000000000000000-mapping.dmp
      • memory/1520-85-0x0000000000000000-mapping.dmp
      • memory/1744-72-0x000000000041F270-mapping.dmp
      • memory/1744-68-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

      • memory/1744-79-0x00000000002C0000-0x00000000002D1000-memory.dmp
        Filesize

        68KB

      • memory/1744-67-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

      • memory/1744-71-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

      • memory/1744-82-0x0000000000400000-0x000000000042B000-memory.dmp
        Filesize

        172KB

      • memory/1744-84-0x0000000002470000-0x0000000002773000-memory.dmp
        Filesize

        3.0MB

      • memory/1804-75-0x000007FEF3810000-0x000007FEF39F8000-memory.dmp
        Filesize

        1.9MB

      • memory/1804-73-0x000007FEF3A00000-0x000007FEF463F000-memory.dmp
        Filesize

        12.2MB

      • memory/1804-77-0x000007FEF4640000-0x000007FEF5BC8000-memory.dmp
        Filesize

        21.5MB

      • memory/1804-76-0x000007FEF2DC0000-0x000007FEF3810000-memory.dmp
        Filesize

        10.3MB

      • memory/1804-78-0x000007FEEE0D0000-0x000007FEEF01D000-memory.dmp
        Filesize

        15.3MB

      • memory/1804-69-0x000007FEF4640000-0x000007FEF5BC8000-memory.dmp
        Filesize

        21.5MB

      • memory/1804-91-0x000007FEEE0D0000-0x000007FEEF01D000-memory.dmp
        Filesize

        15.3MB

      • memory/1804-66-0x0000000000450000-0x0000000000486000-memory.dmp
        Filesize

        216KB

      • memory/1804-65-0x00000000008B0000-0x000000000097C000-memory.dmp
        Filesize

        816KB

      • memory/1804-62-0x0000000000000000-mapping.dmp