Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    16/06/2022, 09:50

General

  • Target

    WHMSHC22060125_SUR.exe

  • Size

    657KB

  • MD5

    28d724fd6e55313ec7479eabf62ef11c

  • SHA1

    5e63a0c3664276044f86a13519560313efcd16b3

  • SHA256

    b326a836015d646984f10a251e4b6678a9822a1f365369512b80f0928b35299d

  • SHA512

    e82554e6e9aa797dca588e83e396cf494aef67f1ac1ee24c818a66df79da2bb38aa3f3ef3091a9541a7d3d6847e905b8911e7a36ce11ab5749df11288e5cce1a

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

a2es

Decoy

glutenfreebahrain.com

sportrid.com

js-films.com

cie-revolver.com

outsourcinginstitutebd.com

roboticsdatascience.com

tebrunk.com

needgreatwork.com

df1b8j2iwbl33n.life

voluum-training.com

cherna-roza.com

xiyouap.com

bluefiftyfoundation.com

angolettomc.com

yhcp225.com

keondredejawn.com

ifeelsilky.com

coraorganizing.com

smartmindstutorials.com

tanphucuong.info

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 6 IoCs
  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1288
    • C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
      "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:780
      • C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
        "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1528
        • C:\Windows\SysWOW64\svchost.exe
          "C:\Windows\SysWOW64\svchost.exe"
          4⤵
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Drops file in Program Files directory
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:476
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"
            5⤵
            • Deletes itself
            PID:516
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            5⤵
              PID:1156

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/476-77-0x00000000008F0000-0x0000000000BF3000-memory.dmp

            Filesize

            3.0MB

          • memory/476-81-0x0000000000080000-0x00000000000AB000-memory.dmp

            Filesize

            172KB

          • memory/476-79-0x00000000005C0000-0x0000000000650000-memory.dmp

            Filesize

            576KB

          • memory/476-78-0x0000000000080000-0x00000000000AB000-memory.dmp

            Filesize

            172KB

          • memory/476-76-0x00000000008E0000-0x00000000008E8000-memory.dmp

            Filesize

            32KB

          • memory/780-55-0x0000000074E91000-0x0000000074E93000-memory.dmp

            Filesize

            8KB

          • memory/780-56-0x00000000004D0000-0x00000000004E2000-memory.dmp

            Filesize

            72KB

          • memory/780-57-0x00000000074A0000-0x000000000752E000-memory.dmp

            Filesize

            568KB

          • memory/780-58-0x00000000006F0000-0x00000000006F6000-memory.dmp

            Filesize

            24KB

          • memory/780-59-0x0000000000700000-0x0000000000732000-memory.dmp

            Filesize

            200KB

          • memory/780-54-0x0000000000FE0000-0x000000000108A000-memory.dmp

            Filesize

            680KB

          • memory/1288-69-0x0000000004830000-0x00000000048F3000-memory.dmp

            Filesize

            780KB

          • memory/1288-72-0x00000000068F0000-0x0000000006A20000-memory.dmp

            Filesize

            1.2MB

          • memory/1288-80-0x0000000006D00000-0x0000000006E71000-memory.dmp

            Filesize

            1.4MB

          • memory/1288-83-0x0000000006D00000-0x0000000006E71000-memory.dmp

            Filesize

            1.4MB

          • memory/1528-71-0x0000000000320000-0x0000000000331000-memory.dmp

            Filesize

            68KB

          • memory/1528-68-0x0000000000290000-0x00000000002A1000-memory.dmp

            Filesize

            68KB

          • memory/1528-74-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/1528-67-0x00000000008E0000-0x0000000000BE3000-memory.dmp

            Filesize

            3.0MB

          • memory/1528-66-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/1528-63-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/1528-61-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/1528-60-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB