Analysis

  • max time kernel
    166s
  • max time network
    222s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    16/06/2022, 09:50

General

  • Target

    WHMSHC22060125_SUR.exe

  • Size

    657KB

  • MD5

    28d724fd6e55313ec7479eabf62ef11c

  • SHA1

    5e63a0c3664276044f86a13519560313efcd16b3

  • SHA256

    b326a836015d646984f10a251e4b6678a9822a1f365369512b80f0928b35299d

  • SHA512

    e82554e6e9aa797dca588e83e396cf494aef67f1ac1ee24c818a66df79da2bb38aa3f3ef3091a9541a7d3d6847e905b8911e7a36ce11ab5749df11288e5cce1a

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

a2es

Decoy

glutenfreebahrain.com

sportrid.com

js-films.com

cie-revolver.com

outsourcinginstitutebd.com

roboticsdatascience.com

tebrunk.com

needgreatwork.com

df1b8j2iwbl33n.life

voluum-training.com

cherna-roza.com

xiyouap.com

bluefiftyfoundation.com

angolettomc.com

yhcp225.com

keondredejawn.com

ifeelsilky.com

coraorganizing.com

smartmindstutorials.com

tanphucuong.info

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 4 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
      "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1000
      • C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe
        "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2388
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Gathers network information
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\WHMSHC22060125_SUR.exe"
        3⤵
          PID:4124

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/1000-131-0x00000000079B0000-0x0000000007F54000-memory.dmp

            Filesize

            5.6MB

          • memory/1000-132-0x00000000074A0000-0x0000000007532000-memory.dmp

            Filesize

            584KB

          • memory/1000-133-0x0000000007400000-0x000000000740A000-memory.dmp

            Filesize

            40KB

          • memory/1000-134-0x000000000AD40000-0x000000000ADDC000-memory.dmp

            Filesize

            624KB

          • memory/1000-135-0x000000000B170000-0x000000000B1D6000-memory.dmp

            Filesize

            408KB

          • memory/1000-130-0x00000000004F0000-0x000000000059A000-memory.dmp

            Filesize

            680KB

          • memory/2388-143-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/2388-137-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/2388-140-0x00000000015B0000-0x00000000015C1000-memory.dmp

            Filesize

            68KB

          • memory/2388-139-0x00000000016F0000-0x0000000001A3A000-memory.dmp

            Filesize

            3.3MB

          • memory/3152-141-0x00000000086A0000-0x0000000008832000-memory.dmp

            Filesize

            1.6MB

          • memory/3152-148-0x00000000086A0000-0x0000000008832000-memory.dmp

            Filesize

            1.6MB

          • memory/3152-150-0x0000000008940000-0x0000000008A47000-memory.dmp

            Filesize

            1.0MB

          • memory/3152-152-0x0000000008940000-0x0000000008A47000-memory.dmp

            Filesize

            1.0MB

          • memory/3864-144-0x0000000000620000-0x000000000062B000-memory.dmp

            Filesize

            44KB

          • memory/3864-147-0x0000000001930000-0x0000000001C7A000-memory.dmp

            Filesize

            3.3MB

          • memory/3864-145-0x0000000001240000-0x000000000126B000-memory.dmp

            Filesize

            172KB

          • memory/3864-149-0x0000000001830000-0x00000000018C0000-memory.dmp

            Filesize

            576KB

          • memory/3864-151-0x0000000001240000-0x000000000126B000-memory.dmp

            Filesize

            172KB