Overview

overview

10

Static

static

Shipping-Docs.exe

windows7_x64

10

Shipping-Docs.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    07-07-2022 05:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Shipping-Docs.exe

  • Size

    501KB

  • MD5

    c865088690870930ec48ae54209e37a3

  • SHA1

    b6bfc53eb8577cfafe3ef5670faf56e6b2f10a3c

  • SHA256

    14a0af77c8fab65395925348cb39c058dd0e619e33055f6a3f895c295aaa6783

  • SHA512

    d233fb9735eca4d18dc4a2642d2fcbeb386a5d5ffd480aa6e09a7b29567417b1ecf588dc004975c97b08dd3cd05dc7c48105b87804a8e37c8a1af649b95f653f

Score
10/10
xloadergfv7loaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.9

Campaign

gfv7

Decoy

hd4AZDZ3XeSkZ9w0NRn2+JU=

6iAxmGKdumxFEgwp

jM6QcxNUSeCKaUdvvh3g9mffhosQ

d4CC0LS0DjTJS8FdXqd3soM=

S1LPlXEIJY52Og==

doeO7AimsF0NEvFgnIV5

W2TlzH/byHtUU3B7tw==

Y2RAbyZjex2qj6GQv4Q=

ftoOsCpZdfmALQ==

4kqL8v/6rDj8Ohs/wAjkb0gD5Gfiww==

8mVs/AkvwLnIWp4=

yfqAazgHioT8b9yHSKpLDtgY

EyWD5F+Wu3L0xq/VJXgdlnFvBDdUz5WM

jn9ty+pdRNdtcDhJ5k8nwZofm4EJ

s9XVNv4/aRDBUx4w

+vHFE7Fw1rnIWp4=

wC395Yvi6G/3yoWRGW1USxzshi3Dyw==

jcbufIN91gHAUK1RYUMYIdyqpDlUz5WM

iIyoIvZNXwPNmBlBxGk6+A==

C/hTD8h/KWLiMW4Mt/joXyz23Q==

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata
  • Xloader Payload 4 IoCs
    rat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3256
    • C:\Users\Admin\AppData\Local\Temp\Shipping-Docs.exe
      "C:\Users\Admin\AppData\Local\Temp\Shipping-Docs.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Users\Admin\AppData\Local\Temp\Shipping-Docs.exe
        "{path}"
        3⤵
        • Checks computer location settings
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:556
    • C:\Windows\SysWOW64\control.exe
      "C:\Windows\SysWOW64\control.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4564
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\Shipping-Docs.exe"
        3⤵
          PID:3980

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/556-135-0x0000000000000000-mapping.dmp
      Download
    • memory/556-142-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/556-139-0x0000000001E70000-0x0000000001E81000-memory.dmp
      Filesize

      68KB

      Download
    • memory/556-138-0x0000000001970000-0x0000000001CBA000-memory.dmp
      Filesize

      3.3MB

      Download
    • memory/556-136-0x0000000000400000-0x000000000042C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/1200-133-0x0000000005570000-0x000000000560C000-memory.dmp
      Filesize

      624KB

      Download
    • memory/1200-134-0x0000000005440000-0x000000000544A000-memory.dmp
      Filesize

      40KB

      Download
    • memory/1200-132-0x00000000054D0000-0x0000000005562000-memory.dmp
      Filesize

      584KB

      Download
    • memory/1200-130-0x0000000000A10000-0x0000000000A94000-memory.dmp
      Filesize

      528KB

      Download
    • memory/1200-131-0x00000000059E0000-0x0000000005F84000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/3256-149-0x00000000077C0000-0x000000000785F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/3256-140-0x00000000031C0000-0x0000000003326000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/3256-150-0x00000000077C0000-0x000000000785F000-memory.dmp
      Filesize

      636KB

      Download
    • memory/3980-143-0x0000000000000000-mapping.dmp
      Download
    • memory/4564-141-0x0000000000000000-mapping.dmp
      Download
    • memory/4564-146-0x0000000000370000-0x000000000039C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/4564-148-0x0000000002300000-0x0000000002390000-memory.dmp
      Filesize

      576KB

      Download
    • memory/4564-147-0x0000000000370000-0x000000000039C000-memory.dmp
      Filesize

      176KB

      Download
    • memory/4564-145-0x0000000002560000-0x00000000028AA000-memory.dmp
      Filesize

      3.3MB

      Download
    • memory/4564-144-0x0000000000660000-0x0000000000687000-memory.dmp
      Filesize

      156KB

      Download