Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21/06/2022, 11:07

General

  • Target

    AWB_811470484778.exe

  • Size

    450KB

  • MD5

    2dce5b90b3f523aff613693f6d93769c

  • SHA1

    d9947b0881ac67b10687b48ed44a49c6198df310

  • SHA256

    7e05b0a9ffe1cfbc4cb926477d044ad7b6046352f8734b95037e4f5ef21bca99

  • SHA512

    260b2415fe8afcc389d39df5fb50dd73969ac1c45ce3ffd38aefb8260bc36c31c0105275c69806a3fa58239b2aeaf193efd5c9e25ed092593ec6ab8d2a1eda28

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

h4st

Decoy

hawkonline.club

unitedkingdomvoip.site

tbrme.com

ysxol.xyz

oviagrooming.com

pokerdominogame.com

perabett463.com

orderjoessteaks.com

sjczyw.com

christensonbrothers.com

stanegroupe.com

residencialseniorspa.com

eyetechlabs.com

lens-experts.com

69988.club

skateboardlovers.com

ourhighlandacres.net

dskensho343.xyz

dance985.com

iran-style.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Users\Admin\AppData\Local\Temp\AWB_811470484778.exe
      "C:\Users\Admin\AppData\Local\Temp\AWB_811470484778.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Users\Admin\AppData\Local\Temp\AWB_811470484778.exe
        "C:\Users\Admin\AppData\Local\Temp\AWB_811470484778.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:3944
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\SysWOW64\explorer.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\AWB_811470484778.exe"
        3⤵
          PID:4836

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/536-131-0x00000000051A0000-0x0000000005744000-memory.dmp

            Filesize

            5.6MB

          • memory/536-132-0x0000000004AB0000-0x0000000004B42000-memory.dmp

            Filesize

            584KB

          • memory/536-133-0x0000000004A80000-0x0000000004A8A000-memory.dmp

            Filesize

            40KB

          • memory/536-134-0x0000000008460000-0x00000000084FC000-memory.dmp

            Filesize

            624KB

          • memory/536-130-0x0000000000080000-0x00000000000F8000-memory.dmp

            Filesize

            480KB

          • memory/672-140-0x0000000007670000-0x0000000007796000-memory.dmp

            Filesize

            1.1MB

          • memory/672-150-0x0000000003360000-0x00000000033F6000-memory.dmp

            Filesize

            600KB

          • memory/672-148-0x0000000003360000-0x00000000033F6000-memory.dmp

            Filesize

            600KB

          • memory/3944-136-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/3944-139-0x0000000001170000-0x0000000001181000-memory.dmp

            Filesize

            68KB

          • memory/3944-138-0x0000000001270000-0x00000000015BA000-memory.dmp

            Filesize

            3.3MB

          • memory/3944-142-0x0000000000400000-0x0000000000429000-memory.dmp

            Filesize

            164KB

          • memory/4600-146-0x0000000003020000-0x000000000336A000-memory.dmp

            Filesize

            3.3MB

          • memory/4600-145-0x0000000000AC0000-0x0000000000AE9000-memory.dmp

            Filesize

            164KB

          • memory/4600-147-0x0000000002CD0000-0x0000000002D60000-memory.dmp

            Filesize

            576KB

          • memory/4600-144-0x0000000000FA0000-0x00000000013D3000-memory.dmp

            Filesize

            4.2MB

          • memory/4600-149-0x0000000000AC0000-0x0000000000AE9000-memory.dmp

            Filesize

            164KB