Analysis

  • max time kernel
    148s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2023, 06:48

General

  • Target

    Order.exe

  • Size

    1019KB

  • MD5

    8035a8a6435078dafbc920a1ff224d57

  • SHA1

    6596b759833a7580758634e75a878c387b21ff98

  • SHA256

    8ff564a57fcca6daaa6319451c7ccb61537b02b513b8b262a5f76348b70d0287

  • SHA512

    352f74524a9095f42999b307054c5a12fa372359e5d46b406f6718b4106506696ef07d8fd6fcba5443c89ae96bdb02a2c0df689f470088e5d3d79fb1bf8673a5

  • SSDEEP

    24576:C8PGQ+EcKrvDBUgSniJNZSp9lcZUYuAl4KaGiRusf:62KgSiJNoTGuY6LGiRu

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uqf5

Decoy

suiddock.com

sweetgyalshop.com

puterigarden.com

orangestoreusa.com

prostirkarpat.com

ajierfoods.com

mindlablearning.com

factiive.net

beautifulbrokenhearts.com

direcionalreservapraca.com

tvhoki.com

themoderncoachinstitute.com

classactionwalgreens.com

haloog.com

sachinkaushik.com

daleearnhardtjrchevyvip.com

disconight.net

ocyslibes.icu

encounterfy.com

infamoudpapertrail.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 19 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Order.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\Order.exe
      "C:\Users\Admin\AppData\Local\Temp\Order.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:2648
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:2500
      • C:\Windows\SysWOW64\NETSTAT.EXE
        "C:\Windows\SysWOW64\NETSTAT.EXE"
        2⤵
        • Suspicious use of SetThreadContext
        • Gathers network information
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2124
        • C:\Windows\SysWOW64\cmd.exe
          /c del "C:\Users\Admin\AppData\Local\Temp\Order.exe"
          3⤵
          • Deletes itself
          PID:112

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1196-16-0x0000000002AE0000-0x0000000002BE0000-memory.dmp

      Filesize

      1024KB

    • memory/1196-28-0x0000000004CC0000-0x0000000004DC7000-memory.dmp

      Filesize

      1.0MB

    • memory/1196-19-0x0000000004CC0000-0x0000000004DC7000-memory.dmp

      Filesize

      1.0MB

    • memory/2124-26-0x0000000000B50000-0x0000000000BDF000-memory.dmp

      Filesize

      572KB

    • memory/2124-24-0x0000000000080000-0x00000000000A9000-memory.dmp

      Filesize

      164KB

    • memory/2124-23-0x00000000022F0000-0x00000000025F3000-memory.dmp

      Filesize

      3.0MB

    • memory/2124-22-0x0000000000080000-0x00000000000A9000-memory.dmp

      Filesize

      164KB

    • memory/2124-21-0x0000000000EE0000-0x0000000000EE9000-memory.dmp

      Filesize

      36KB

    • memory/2124-20-0x0000000000EE0000-0x0000000000EE9000-memory.dmp

      Filesize

      36KB

    • memory/2540-6-0x00000000058B0000-0x0000000005956000-memory.dmp

      Filesize

      664KB

    • memory/2540-0-0x0000000000E40000-0x0000000000F46000-memory.dmp

      Filesize

      1.0MB

    • memory/2540-1-0x0000000074170000-0x000000007485E000-memory.dmp

      Filesize

      6.9MB

    • memory/2540-2-0x0000000004F00000-0x0000000004F40000-memory.dmp

      Filesize

      256KB

    • memory/2540-13-0x0000000074170000-0x000000007485E000-memory.dmp

      Filesize

      6.9MB

    • memory/2540-3-0x00000000001D0000-0x00000000001F2000-memory.dmp

      Filesize

      136KB

    • memory/2540-4-0x0000000074170000-0x000000007485E000-memory.dmp

      Filesize

      6.9MB

    • memory/2540-5-0x0000000004F00000-0x0000000004F40000-memory.dmp

      Filesize

      256KB

    • memory/2540-7-0x00000000051A0000-0x0000000005200000-memory.dmp

      Filesize

      384KB

    • memory/2648-8-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2648-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2648-17-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2648-18-0x0000000000110000-0x0000000000120000-memory.dmp

      Filesize

      64KB

    • memory/2648-9-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB

    • memory/2648-14-0x00000000008C0000-0x0000000000BC3000-memory.dmp

      Filesize

      3.0MB

    • memory/2648-12-0x0000000000400000-0x0000000000429000-memory.dmp

      Filesize

      164KB