Analysis

  • max time kernel
    17s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 22:57

General

  • Target

    Sales Order.exe

  • Size

    1014KB

  • MD5

    fd84eb337a51966294ba08722170bf46

  • SHA1

    1f529d60e2dc50deaac59af322708039da33c3be

  • SHA256

    8da806444010084307c77bf3a69f66ca36c15920bd7b9f60fdcf35fccd460701

  • SHA512

    a522ba8c6daddbf69f711ef859c7e8fb79e2ab00372e6626af9119d82ef8cf22b0e2ebcc1897cd88810be5ee01b11e0950dbf0853ceb630de3e916ac3bacd847

  • SSDEEP

    12288:rFhlsU1cTDO+emag5IFyPK7yMmeP1vwdyAook1GZEUFA1Vk82C867LiuNyxv2AdU:rFhlXcOyeL3JStX+PbLk2QHQ

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

p6f2

Decoy

redsnews.com

vr859.com

postmasterstudios.com

hampsteadorganizer.com

hangshop.net

maheshwaramlawcollege.com

5156087.com

gtaaddict.com

faj.xyz

drivechicagoillinois.com

neerutech.com

b2brahmas.com

freshlookks.com

propertyparallel.tech

tlwbyads.com

sellektorkids.com

dexs.fyi

kileybrock.com

nervstudio.com

tosg-ltd.com

Signatures

  • Detect ZGRat V1 1 IoCs
  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Xloader payload 5 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Sales Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Sales Order.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3176
    • C:\Users\Admin\AppData\Local\Temp\Sales Order.exe
      "C:\Users\Admin\AppData\Local\Temp\Sales Order.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2628
      • C:\Windows\SysWOW64\NETSTAT.EXE
        "C:\Windows\SysWOW64\NETSTAT.EXE"
        3⤵
        • Gathers network information
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1956
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3364
    • C:\Windows\SysWOW64\cmd.exe
      /c del "C:\Users\Admin\AppData\Local\Temp\Sales Order.exe"
      1⤵
        PID:1792

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1956-22-0x0000000000060000-0x000000000006B000-memory.dmp

        Filesize

        44KB

      • memory/1956-27-0x0000000001AA0000-0x0000000001B2F000-memory.dmp

        Filesize

        572KB

      • memory/1956-26-0x0000000001080000-0x00000000010A8000-memory.dmp

        Filesize

        160KB

      • memory/1956-23-0x0000000000060000-0x000000000006B000-memory.dmp

        Filesize

        44KB

      • memory/1956-25-0x0000000001750000-0x0000000001A9A000-memory.dmp

        Filesize

        3.3MB

      • memory/1956-24-0x0000000001080000-0x00000000010A8000-memory.dmp

        Filesize

        160KB

      • memory/2628-15-0x0000000000400000-0x0000000000428000-memory.dmp

        Filesize

        160KB

      • memory/2628-16-0x0000000001120000-0x0000000001130000-memory.dmp

        Filesize

        64KB

      • memory/2628-20-0x00000000015C0000-0x00000000015D0000-memory.dmp

        Filesize

        64KB

      • memory/2628-10-0x0000000000400000-0x0000000000428000-memory.dmp

        Filesize

        160KB

      • memory/2628-13-0x00000000015D0000-0x000000000191A000-memory.dmp

        Filesize

        3.3MB

      • memory/2628-19-0x0000000000400000-0x0000000000428000-memory.dmp

        Filesize

        160KB

      • memory/3176-5-0x0000000005A60000-0x0000000005AFC000-memory.dmp

        Filesize

        624KB

      • memory/3176-6-0x0000000005BB0000-0x0000000005BC0000-memory.dmp

        Filesize

        64KB

      • memory/3176-1-0x0000000074790000-0x0000000074F40000-memory.dmp

        Filesize

        7.7MB

      • memory/3176-0-0x0000000000E20000-0x0000000000F24000-memory.dmp

        Filesize

        1.0MB

      • memory/3176-12-0x0000000074790000-0x0000000074F40000-memory.dmp

        Filesize

        7.7MB

      • memory/3176-9-0x0000000005B00000-0x0000000005B16000-memory.dmp

        Filesize

        88KB

      • memory/3176-3-0x0000000005940000-0x00000000059D2000-memory.dmp

        Filesize

        584KB

      • memory/3176-2-0x0000000005EF0000-0x0000000006494000-memory.dmp

        Filesize

        5.6MB

      • memory/3176-7-0x00000000058E0000-0x00000000058FE000-memory.dmp

        Filesize

        120KB

      • memory/3176-4-0x00000000059E0000-0x0000000005A56000-memory.dmp

        Filesize

        472KB

      • memory/3176-8-0x0000000005BC0000-0x0000000005C40000-memory.dmp

        Filesize

        512KB

      • memory/3364-17-0x0000000002E10000-0x0000000002F32000-memory.dmp

        Filesize

        1.1MB

      • memory/3364-21-0x0000000008930000-0x0000000008AB0000-memory.dmp

        Filesize

        1.5MB

      • memory/3364-29-0x0000000008930000-0x0000000008AB0000-memory.dmp

        Filesize

        1.5MB

      • memory/3364-31-0x00000000028F0000-0x00000000029AD000-memory.dmp

        Filesize

        756KB

      • memory/3364-32-0x00000000028F0000-0x00000000029AD000-memory.dmp

        Filesize

        756KB

      • memory/3364-35-0x00000000028F0000-0x00000000029AD000-memory.dmp

        Filesize

        756KB