Analysis
- max time kernel
150s - max time network
148s - platform
windows7_x64 - resource
win7-20220414-en - submitted
30/06/2022, 10:31
General
- Target payment detail.exe
- Size 543KB
- Sample220630-mkf7sscce7
- SHA256 4f4e5e5550b40c160b4dfa9f399b558d2d96ffdf49cc0c81a86a6b3942f1fd94
Malware Config
Extracted
-
xloader
-
2.8
-
nmd2
-
FNWENUOMqqSv0Q==
-
ls6DEbQ1KBCeSsvUyRg=
-
mwgrjwpFplaykGoT
-
Uzzj8yXi13iLMnNGZcnViQliwA==
-
T7vzj0l0lqquyA==
-
csHzBjwvF7rmjcmWxjThd61NuuVl4gQ=
-
YaXyTwg3p1vrf/n9kYJQjrc=
-
cHAfFEI1JKDF4mTsGjDbeg==
-
TdDv+o9VSFep3wgTtY0swqQ=
-
Jw66vdyXdRZG9jJZycLD
-
icGvsuKZgXNid1M=
-
6m6H0GvguY+vZZpcioudbQ==
-
kNUBYMuymhgm2b0q3bEAiQliwA==
-
M3SiAXRbVe0XAsxDOIp6cg==
-
+eWLk+HjRRe3LuyavQ==
-
753R3QYD8XOWtWI0ouGpYw==
-
dRg+bQZ6TSbC8Sbs2mXXxLM=
-
kDlUsE+U7Y/RfUQ=
-
oENlcFZVqqSv0Q==
-
HCC+nbachxEs1f29GjDbeg==
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 5 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment detail.exe"C:\Users\Admin\AppData\Local\Temp\payment detail.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\payment detail.exe"{path}"3⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\payment detail.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/996-66-0x0000000000A00000-0x0000000000D03000-memory.dmp
memory/996-67-0x0000000000180000-0x0000000000191000-memory.dmp
memory/996-65-0x0000000000400000-0x000000000042C000-memory.dmp
memory/996-62-0x0000000000400000-0x000000000042C000-memory.dmp
memory/996-59-0x0000000000400000-0x000000000042C000-memory.dmp
memory/996-60-0x0000000000400000-0x000000000042C000-memory.dmp
memory/1208-68-0x0000000005EF0000-0x000000000601A000-memory.dmp
memory/1208-77-0x0000000004110000-0x00000000041E5000-memory.dmp
memory/1208-75-0x0000000004110000-0x00000000041E5000-memory.dmp
memory/1224-56-0x0000000000480000-0x000000000048A000-memory.dmp
memory/1224-57-0x00000000058F0000-0x0000000005970000-memory.dmp
memory/1224-55-0x00000000759E1000-0x00000000759E3000-memory.dmp
memory/1224-54-0x0000000010A20000-0x0000000010AAE000-memory.dmp
memory/1224-58-0x0000000001F00000-0x0000000001F32000-memory.dmp
memory/1756-73-0x0000000001EE0000-0x00000000021E3000-memory.dmp
memory/1756-74-0x00000000021F0000-0x0000000002280000-memory.dmp
memory/1756-70-0x00000000000C0000-0x00000000000E2000-memory.dmp
memory/1756-76-0x0000000000070000-0x000000000009C000-memory.dmp
memory/1756-71-0x0000000000070000-0x000000000009C000-memory.dmp