Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21/06/2022, 08:56

General

  • Target

    vbc (2).exe

  • Size

    99KB

  • MD5

    fc2ab61fce7f203add8bd65a77df7de5

  • SHA1

    423261d0362864ecc99f05a726a940b33b69f5df

  • SHA256

    9454ba36d9a763b8543f599961cafb7a33397340ccb59b17921748771d49cd43

  • SHA512

    5c91637dd9083b7a1c98ccf0ad852582710ffe2d733e285e733439a1a0cae3535a1b2473f7d8e6a83ebc0545a106d806c896ae84d62bbe76077dfaeac8686e79

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

uu0p

Decoy

easeupp.com

ffffcc.xyz

commercialsymposium.com

bahamascargologistics.com

avajwelr.xyz

flipwatch.xyz

serprobumar.com

zlasher.store

zxlsn6.com

xiaojiaowanwan.com

hrkpacking.com

visitprnow.com

stkjzz.com

printfusion.net

blackoakssavannah.com

yuiseika.com

watnefarms.com

oneclickmsp.com

niu-tou.com

wholytraffic.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 6 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 29 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1352
    • C:\Users\Admin\AppData\Local\Temp\vbc (2).exe
      "C:\Users\Admin\AppData\Local\Temp\vbc (2).exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1980
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout 20
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Windows\SysWOW64\timeout.exe
          timeout 20
          4⤵
          • Delays execution with timeout.exe
          PID:1760
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1776
    • C:\Windows\SysWOW64\cmstp.exe
      "C:\Windows\SysWOW64\cmstp.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:608
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        3⤵
          PID:1480

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/608-83-0x00000000000D0000-0x00000000000FB000-memory.dmp

            Filesize

            172KB

          • memory/608-81-0x0000000001DB0000-0x0000000001E40000-memory.dmp

            Filesize

            576KB

          • memory/608-79-0x0000000002080000-0x0000000002383000-memory.dmp

            Filesize

            3.0MB

          • memory/608-78-0x00000000000D0000-0x00000000000FB000-memory.dmp

            Filesize

            172KB

          • memory/608-77-0x0000000000990000-0x00000000009A8000-memory.dmp

            Filesize

            96KB

          • memory/1352-70-0x0000000004CC0000-0x0000000004D97000-memory.dmp

            Filesize

            860KB

          • memory/1352-84-0x0000000006A10000-0x0000000006AD7000-memory.dmp

            Filesize

            796KB

          • memory/1352-82-0x0000000006A10000-0x0000000006AD7000-memory.dmp

            Filesize

            796KB

          • memory/1352-73-0x0000000006810000-0x00000000068DE000-memory.dmp

            Filesize

            824KB

          • memory/1776-68-0x00000000008F0000-0x0000000000BF3000-memory.dmp

            Filesize

            3.0MB

          • memory/1776-64-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/1776-61-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/1776-72-0x0000000000230000-0x0000000000241000-memory.dmp

            Filesize

            68KB

          • memory/1776-67-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/1776-75-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/1776-69-0x0000000000180000-0x0000000000191000-memory.dmp

            Filesize

            68KB

          • memory/1776-62-0x0000000000400000-0x000000000042B000-memory.dmp

            Filesize

            172KB

          • memory/1980-54-0x0000000000330000-0x0000000000350000-memory.dmp

            Filesize

            128KB

          • memory/1980-58-0x0000000004D10000-0x0000000004D5C000-memory.dmp

            Filesize

            304KB

          • memory/1980-57-0x0000000004230000-0x000000000427A000-memory.dmp

            Filesize

            296KB

          • memory/1980-56-0x0000000005AD0000-0x0000000005BAA000-memory.dmp

            Filesize

            872KB

          • memory/1980-55-0x0000000076C01000-0x0000000076C03000-memory.dmp

            Filesize

            8KB