Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
21/06/2022, 10:21
General
- Target networksec.exe
- Size 467KB
- Sample220621-mdm2rsfbf6
- SHA256 25773608894ed7dced5dd50dc02483ffdd6d9ee3d79333aa8292c5d2a2586e21
Malware Config
Extracted
-
xloader
-
2.6
-
a2es
-
glutenfreebahrain.com
-
sportrid.com
-
js-films.com
-
cie-revolver.com
-
outsourcinginstitutebd.com
-
roboticsdatascience.com
-
tebrunk.com
-
needgreatwork.com
-
df1b8j2iwbl33n.life
-
voluum-training.com
-
cherna-roza.com
-
xiyouap.com
-
bluefiftyfoundation.com
-
angolettomc.com
-
yhcp225.com
-
keondredejawn.com
-
ifeelsilky.com
-
coraorganizing.com
-
smartmindstutorials.com
-
tanphucuong.info
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
- Xloader Payload 4 IoCs
- Adds policy Run key to start application 2 TTPs 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Program Files directory 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\networksec.exe"C:\Users\Admin\AppData\Local\Temp\networksec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\networksec.exe"C:\Users\Admin\AppData\Local\Temp\networksec.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Adds policy Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\networksec.exe"3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
DB1
DB1
memory/672-141-0x0000000008E70000-0x000000000900C000-memory.dmp
memory/672-150-0x0000000003360000-0x000000000345A000-memory.dmp
memory/672-148-0x0000000003360000-0x000000000345A000-memory.dmp
memory/1096-136-0x0000000000400000-0x000000000042B000-memory.dmp
memory/1096-139-0x0000000001710000-0x0000000001A5A000-memory.dmp
memory/1096-140-0x00000000016B0000-0x00000000016C1000-memory.dmp
memory/1096-138-0x0000000000400000-0x000000000042B000-memory.dmp
memory/4052-133-0x0000000005050000-0x000000000505A000-memory.dmp
memory/4052-130-0x0000000000490000-0x000000000050C000-memory.dmp
memory/4052-131-0x0000000005390000-0x0000000005934000-memory.dmp
memory/4052-132-0x0000000004EA0000-0x0000000004F32000-memory.dmp
memory/4052-134-0x0000000008760000-0x00000000087FC000-memory.dmp
memory/4680-149-0x0000000000F00000-0x0000000000F2B000-memory.dmp
memory/4680-147-0x0000000002F60000-0x0000000002FF0000-memory.dmp
memory/4680-145-0x0000000000F00000-0x0000000000F2B000-memory.dmp
memory/4680-146-0x0000000003140000-0x000000000348A000-memory.dmp
memory/4680-144-0x0000000000FB0000-0x0000000000FC9000-memory.dmp