Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21/06/2022, 10:20

General

  • Target

    bis.exe

  • Size

    451KB

  • MD5

    9e1bb80ff1f6f5181ed26c62ef3de29d

  • SHA1

    5c37096275b5947dfd68ccacc92eec204fa73883

  • SHA256

    a92f8917b2e98217ede5359f7906dd0a60df26e087a1e1c33b81797a334fb448

  • SHA512

    f1493090882bbe106508b50a0dcc8ac9966b157837f3d3d428b5b1977bcda3ea00eb067b5f925add5a38e069cfb4e7ce63be49ba8db29b23eb171290226e7004

Malware Config

Extracted

Family

xloader

Version

2.9

Campaign

rb1k

Decoy

Hy3kKk3exSb8BwggZ6MfKxQ=

NCL+/Dy1jhSUG9mRm0U=

wWOomCbzt4pHcH22F16ZDMRcKw==

WTIg8VQo+NeSJsTaLk6M9XQi

GxTnP34PxKGMqI0aDg==

BCLmUMWYgpQ0hmDGRvcILQM=

ILk0ukAA71UFWNrW

aHq3rPmIgJpVF+C9GQ==

8jYg+GYnGycf+ufa9Fo=

gQpOLax1ZUbL5at4u1SkP/XMaS0=

s1abd4QIyia5Ta6zEUSM9XQi

JDL1dr1IE+a1q4zB

24b2gBbkpvG81Nh1rLjxJw==

U5KEePzSsY5a/WYuVdUXnycmbPcnk6RB

D+TYrgrRwtaL5YIUEQ==

T1gpjLMr70QZODL8/UOM9XQi

f3Efb+StKpP+MQ==

fUfDKVLlzfcCFgo=

23rI2NitbuCL

ypQDXuCwKpP+MQ==

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 5 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\bis.exe
      "C:\Users\Admin\AppData\Local\Temp\bis.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1948
      • C:\Users\Admin\AppData\Local\Temp\bis.exe
        "C:\Users\Admin\AppData\Local\Temp\bis.exe"
        3⤵
          PID:1160
        • C:\Users\Admin\AppData\Local\Temp\bis.exe
          "C:\Users\Admin\AppData\Local\Temp\bis.exe"
          3⤵
          • Checks computer location settings
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          PID:1328
      • C:\Windows\SysWOW64\help.exe
        "C:\Windows\SysWOW64\help.exe"
        2⤵
        • Adds policy Run key to start application
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:936
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\bis.exe"
          3⤵
          • Deletes itself
          PID:1960
        • C:\Program Files\Mozilla Firefox\Firefox.exe
          "C:\Program Files\Mozilla Firefox\Firefox.exe"
          3⤵
            PID:1976

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/936-76-0x0000000000080000-0x00000000000AC000-memory.dmp

              Filesize

              176KB

            • memory/936-74-0x0000000000470000-0x0000000000500000-memory.dmp

              Filesize

              576KB

            • memory/936-73-0x0000000000080000-0x00000000000AC000-memory.dmp

              Filesize

              176KB

            • memory/936-72-0x0000000000860000-0x0000000000B63000-memory.dmp

              Filesize

              3.0MB

            • memory/936-71-0x0000000000FD0000-0x0000000000FD6000-memory.dmp

              Filesize

              24KB

            • memory/1256-68-0x0000000006D00000-0x0000000006E81000-memory.dmp

              Filesize

              1.5MB

            • memory/1256-77-0x0000000004320000-0x000000000440A000-memory.dmp

              Filesize

              936KB

            • memory/1256-75-0x0000000004320000-0x000000000440A000-memory.dmp

              Filesize

              936KB

            • memory/1328-59-0x0000000000400000-0x000000000042C000-memory.dmp

              Filesize

              176KB

            • memory/1328-66-0x0000000000C80000-0x0000000000F83000-memory.dmp

              Filesize

              3.0MB

            • memory/1328-67-0x0000000000130000-0x0000000000141000-memory.dmp

              Filesize

              68KB

            • memory/1328-65-0x0000000000400000-0x000000000042C000-memory.dmp

              Filesize

              176KB

            • memory/1328-62-0x0000000000400000-0x000000000042C000-memory.dmp

              Filesize

              176KB

            • memory/1328-60-0x0000000000400000-0x000000000042C000-memory.dmp

              Filesize

              176KB

            • memory/1948-54-0x0000000000C00000-0x0000000000C78000-memory.dmp

              Filesize

              480KB

            • memory/1948-58-0x0000000000510000-0x0000000000542000-memory.dmp

              Filesize

              200KB

            • memory/1948-57-0x0000000004F50000-0x0000000004FBA000-memory.dmp

              Filesize

              424KB

            • memory/1948-56-0x00000000002C0000-0x00000000002CE000-memory.dmp

              Filesize

              56KB

            • memory/1948-55-0x00000000754A1000-0x00000000754A3000-memory.dmp

              Filesize

              8KB