Analysis

  • max time kernel
    154s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    16/06/2022, 09:40

General

  • Target

    RFQ_ITEMS.xlsx

  • Size

    714KB

  • MD5

    392ad9f585c56d59ed7c38f0f1fd0248

  • SHA1

    6612bc1b3efcd1768ab97295c939484d1de5a2e2

  • SHA256

    b23af2441730b31e7c5c5e358eb4f2a52929d14546d4cdc3bb203060d069769a

  • SHA512

    37404e0a915029a528099903b10ff7196712e4b7b16b972f06cb441b72fd728be739f8d39984d0f45d9e0d89d01f31d448d6475ffbfcfc4d58403613ce71cd2f

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

ah8e

Decoy

kunmingzhaopin.com

eddymerckx.club

katiecleaningclinic.com

t36yu5tyy.com

tecnaus.com

latinaenelmetaverso.com

whicheyewear.com

hugear34.com

claybuyshomes.com

negociossanjose.online

usshopday.com

exaccept.life

lull.rest

johnkichote.com

tammysbulldogs.com

shark-protocol.com

bitdealcoin.com

onlineresultsmanager.com

ratedarrgh.com

knowperfectly.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Xloader Payload 4 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 9 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 34 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
      "C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\RFQ_ITEMS.xlsx
      2⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:732
    • C:\Windows\SysWOW64\autochk.exe
      "C:\Windows\SysWOW64\autochk.exe"
      2⤵
        PID:340
      • C:\Windows\SysWOW64\msiexec.exe
        "C:\Windows\SysWOW64\msiexec.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Public\name.exe"
          3⤵
            PID:1508
      • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
        "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
        1⤵
        • Blocklisted process makes network request
        • Launches Equation Editor
        • Suspicious use of WriteProcessMemory
        PID:2032
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Public\name.exe
          2⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:884
          • C:\Users\Public\name.exe
            C:\Users\Public\name.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1336
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qJIUnePPGvAB.exe"
              4⤵
              • Drops file in System32 directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1080
            • C:\Windows\SysWOW64\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qJIUnePPGvAB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp67C9.tmp"
              4⤵
              • Creates scheduled task(s)
              PID:1536
            • C:\Users\Public\name.exe
              "C:\Users\Public\name.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              PID:1648

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp67C9.tmp

              Filesize

              1KB

              MD5

              6d58c2ae39d4f0b4ac993ae6669123f1

              SHA1

              56de095bdc857e7a5e18653ef8bd04c05a4a0986

              SHA256

              028edba0a6f5136efa91f3b2268203a25544ea92ab182c693024a29d5a803b91

              SHA512

              f1d3b690c6e718f71ec816b26ed8464eb5954320f2aca53779b059593b9b59a37f9406374438b144397eca7811035c1e82f307c12cd2db0405cd1ad9c263ad9b

            • C:\Users\Public\name.exe

              Filesize

              633KB

              MD5

              7889400a2f8d7e9aa23d8efd8c1b122a

              SHA1

              fd718571b73fe665839e622fc7bf6ea1c1e2d94a

              SHA256

              15f9a1d5e931226148aabe0d2cefd56af687e0bd19e3bba2e2694fede201673a

              SHA512

              cfb1f5999f37a62655fefb40cf0a0982ff69f94b0afd5be4af35973252c66183625b44638bc038fc3b59261a7c3ec2d535a785f1af5125cdb4fb4849a37597a4

            • C:\Users\Public\name.exe

              Filesize

              633KB

              MD5

              7889400a2f8d7e9aa23d8efd8c1b122a

              SHA1

              fd718571b73fe665839e622fc7bf6ea1c1e2d94a

              SHA256

              15f9a1d5e931226148aabe0d2cefd56af687e0bd19e3bba2e2694fede201673a

              SHA512

              cfb1f5999f37a62655fefb40cf0a0982ff69f94b0afd5be4af35973252c66183625b44638bc038fc3b59261a7c3ec2d535a785f1af5125cdb4fb4849a37597a4

            • C:\Users\Public\name.exe

              Filesize

              633KB

              MD5

              7889400a2f8d7e9aa23d8efd8c1b122a

              SHA1

              fd718571b73fe665839e622fc7bf6ea1c1e2d94a

              SHA256

              15f9a1d5e931226148aabe0d2cefd56af687e0bd19e3bba2e2694fede201673a

              SHA512

              cfb1f5999f37a62655fefb40cf0a0982ff69f94b0afd5be4af35973252c66183625b44638bc038fc3b59261a7c3ec2d535a785f1af5125cdb4fb4849a37597a4

            • \Users\Public\name.exe

              Filesize

              633KB

              MD5

              7889400a2f8d7e9aa23d8efd8c1b122a

              SHA1

              fd718571b73fe665839e622fc7bf6ea1c1e2d94a

              SHA256

              15f9a1d5e931226148aabe0d2cefd56af687e0bd19e3bba2e2694fede201673a

              SHA512

              cfb1f5999f37a62655fefb40cf0a0982ff69f94b0afd5be4af35973252c66183625b44638bc038fc3b59261a7c3ec2d535a785f1af5125cdb4fb4849a37597a4

            • memory/732-58-0x0000000075781000-0x0000000075783000-memory.dmp

              Filesize

              8KB

            • memory/732-60-0x000000007249D000-0x00000000724A8000-memory.dmp

              Filesize

              44KB

            • memory/732-75-0x0000000066ED1000-0x0000000066ED3000-memory.dmp

              Filesize

              8KB

            • memory/732-54-0x000000002F271000-0x000000002F274000-memory.dmp

              Filesize

              12KB

            • memory/732-57-0x000000007249D000-0x00000000724A8000-memory.dmp

              Filesize

              44KB

            • memory/732-68-0x00000000682A1000-0x00000000682A3000-memory.dmp

              Filesize

              8KB

            • memory/732-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

              Filesize

              64KB

            • memory/732-55-0x00000000714B1000-0x00000000714B3000-memory.dmp

              Filesize

              8KB

            • memory/1080-89-0x0000000066920000-0x0000000066ECB000-memory.dmp

              Filesize

              5.7MB

            • memory/1080-76-0x0000000066920000-0x0000000066ECB000-memory.dmp

              Filesize

              5.7MB

            • memory/1260-88-0x0000000004B50000-0x0000000004CC2000-memory.dmp

              Filesize

              1.4MB

            • memory/1336-77-0x0000000000760000-0x0000000000792000-memory.dmp

              Filesize

              200KB

            • memory/1336-66-0x0000000000160000-0x0000000000204000-memory.dmp

              Filesize

              656KB

            • memory/1336-70-0x0000000004EB0000-0x0000000004F1A000-memory.dmp

              Filesize

              424KB

            • memory/1336-69-0x0000000000300000-0x000000000030C000-memory.dmp

              Filesize

              48KB

            • memory/1648-86-0x0000000000800000-0x0000000000B03000-memory.dmp

              Filesize

              3.0MB

            • memory/1648-85-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

            • memory/1648-81-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

            • memory/1648-87-0x00000000003B0000-0x00000000003C1000-memory.dmp

              Filesize

              68KB

            • memory/1648-79-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

            • memory/1648-78-0x0000000000400000-0x000000000042B000-memory.dmp

              Filesize

              172KB

            • memory/1764-92-0x00000000000B0000-0x00000000000C4000-memory.dmp

              Filesize

              80KB

            • memory/1764-93-0x0000000000130000-0x000000000015B000-memory.dmp

              Filesize

              172KB

            • memory/1764-95-0x0000000002210000-0x0000000002513000-memory.dmp

              Filesize

              3.0MB

            • memory/1764-96-0x0000000001F40000-0x0000000001FD0000-memory.dmp

              Filesize

              576KB