Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21/06/2022, 10:21

General

  • Target

    vbc (10).exe

  • Size

    963KB

  • MD5

    83dd3acd8f3e455bfd2c4711453399c3

  • SHA1

    8895c917c9a3157939036647ba402f02d98f29e4

  • SHA256

    ccc5f7c2dcf83d72150071b31ff3036834f0d26544e2c2c274bce95d234b14ea

  • SHA512

    72fee0861dad6d8f44f450e00950bb1c486961b7f114d822f1e5e0335c7214800b1c8242a35f409220eac72f8b2dfd56a238c5e10be13d52507e521daa5cb2d2

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

gd9m

Decoy

screens.ma

coachingdiary.com

cannabisconsultant.xyz

sirenonthemoon.com

gabrielatrejo.com

blumenladentampa.com

sturisticosadmcancun.com

qdygo.net

nubearies.com

thedestinationcrafter.com

fastblacktv.com

sanakatha.com

birdviewsecurityandshipping.com

waterfilterhub.xyz

92658.top

xigen.xyz

barikadcrew.com

herzogbjj.com

veminis.com

thnawya.net

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 4 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1384
    • C:\Users\Admin\AppData\Local\Temp\vbc (10).exe
      "C:\Users\Admin\AppData\Local\Temp\vbc (10).exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\AppData\Local\Temp\vbc (10).exe
        "C:\Users\Admin\AppData\Local\Temp\vbc (10).exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:572
    • C:\Windows\SysWOW64\cscript.exe
      "C:\Windows\SysWOW64\cscript.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1716
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\vbc (10).exe"
        3⤵
        • Deletes itself
        PID:112
      • C:\Program Files\Mozilla Firefox\Firefox.exe
        "C:\Program Files\Mozilla Firefox\Firefox.exe"
        3⤵
          PID:1760

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/572-59-0x00000000001B0000-0x00000000001DB000-memory.dmp

            Filesize

            172KB

          • memory/572-66-0x00000000008A0000-0x0000000000BA3000-memory.dmp

            Filesize

            3.0MB

          • memory/572-60-0x00000000001B0000-0x00000000001DB000-memory.dmp

            Filesize

            172KB

          • memory/572-64-0x00000000001B0000-0x00000000001DB000-memory.dmp

            Filesize

            172KB

          • memory/572-67-0x0000000000320000-0x0000000000331000-memory.dmp

            Filesize

            68KB

          • memory/1384-78-0x00000000046D0000-0x00000000047A5000-memory.dmp

            Filesize

            852KB

          • memory/1384-75-0x00000000046D0000-0x00000000047A5000-memory.dmp

            Filesize

            852KB

          • memory/1384-68-0x0000000004150000-0x0000000004233000-memory.dmp

            Filesize

            908KB

          • memory/1672-56-0x00000000006D0000-0x0000000000700000-memory.dmp

            Filesize

            192KB

          • memory/1672-54-0x00000000000B0000-0x00000000001A6000-memory.dmp

            Filesize

            984KB

          • memory/1672-55-0x00000000753B1000-0x00000000753B3000-memory.dmp

            Filesize

            8KB

          • memory/1672-58-0x0000000000680000-0x0000000000686000-memory.dmp

            Filesize

            24KB

          • memory/1672-57-0x00000000005A0000-0x00000000005BA000-memory.dmp

            Filesize

            104KB

          • memory/1716-70-0x0000000000DB0000-0x0000000000DD2000-memory.dmp

            Filesize

            136KB

          • memory/1716-73-0x0000000000070000-0x000000000009B000-memory.dmp

            Filesize

            172KB

          • memory/1716-71-0x00000000021E0000-0x00000000024E3000-memory.dmp

            Filesize

            3.0MB

          • memory/1716-74-0x0000000000AD0000-0x0000000000B60000-memory.dmp

            Filesize

            576KB

          • memory/1716-76-0x0000000000070000-0x000000000009B000-memory.dmp

            Filesize

            172KB