Analysis

  • max time kernel
    147s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27/12/2023, 19:07

General

  • Target

    Payment_Advice.exe

  • Size

    600KB

  • MD5

    e071eda90d0e53ace9919357d98281e4

  • SHA1

    f75510c59e43a645702a66702882eeb7ad21bf62

  • SHA256

    afc581586580ee675ab9b0cfef4e508b9decebe330dc6a7334534d34fb7d6a2e

  • SHA512

    a979a37a203b576279d681909e3735a8557f192e34f4b5f5f86d8331f556cf221005e777bc51fd46fa5e23d4f626a9da3552c9d15874a2b54a2ac5635e846d9b

  • SSDEEP

    12288:qTfM4y02iNv4s+BxlyA1dKBn+jHaz5d7AhyC6yuLRV7W:63y01usSxrKnX5NAhysuLTq

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

uecu

Decoy

ishtarhotel.com

woodstrends.icu

jalenowens.com

manno.expert

ssg1asia.com

telepathylaw.com

quickoprintnv.com

abrosnm3.com

lumberjackcatering.com

beachujamaica.com

thomasjeffersonbyrd.com

starryfinds.com

shelavish2.com

royalglamempirellc.com

deixandomeuemprego.com

alexgoestech.xyz

opticamn.com

fermanchevybrandon.com

milbodegas.info

adunarsrl.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader payload 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Users\Admin\AppData\Local\Temp\Payment_Advice.exe
      "C:\Users\Admin\AppData\Local\Temp\Payment_Advice.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2892
    • C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\SysWOW64\chkdsk.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
          PID:2588

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1136-20-0x0000000006400000-0x0000000006586000-memory.dmp

      Filesize

      1.5MB

    • memory/1136-29-0x0000000006400000-0x0000000006586000-memory.dmp

      Filesize

      1.5MB

    • memory/2704-27-0x0000000002170000-0x00000000021FF000-memory.dmp

      Filesize

      572KB

    • memory/2704-25-0x0000000000080000-0x00000000000A8000-memory.dmp

      Filesize

      160KB

    • memory/2704-24-0x00000000023B0000-0x00000000026B3000-memory.dmp

      Filesize

      3.0MB

    • memory/2704-21-0x0000000000160000-0x0000000000167000-memory.dmp

      Filesize

      28KB

    • memory/2704-23-0x0000000000080000-0x00000000000A8000-memory.dmp

      Filesize

      160KB

    • memory/2704-22-0x0000000000160000-0x0000000000167000-memory.dmp

      Filesize

      28KB

    • memory/2892-16-0x0000000000BF0000-0x0000000000EF3000-memory.dmp

      Filesize

      3.0MB

    • memory/2892-19-0x0000000000100000-0x0000000000110000-memory.dmp

      Filesize

      64KB

    • memory/2892-18-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2892-14-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2892-8-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/2892-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2892-10-0x0000000000400000-0x0000000000428000-memory.dmp

      Filesize

      160KB

    • memory/3004-0-0x0000000000310000-0x00000000003AC000-memory.dmp

      Filesize

      624KB

    • memory/3004-15-0x0000000074670000-0x0000000074D5E000-memory.dmp

      Filesize

      6.9MB

    • memory/3004-7-0x00000000006A0000-0x00000000006CE000-memory.dmp

      Filesize

      184KB

    • memory/3004-6-0x0000000005E40000-0x0000000005EC0000-memory.dmp

      Filesize

      512KB

    • memory/3004-5-0x0000000004FA0000-0x0000000004FE0000-memory.dmp

      Filesize

      256KB

    • memory/3004-4-0x0000000074670000-0x0000000074D5E000-memory.dmp

      Filesize

      6.9MB

    • memory/3004-3-0x00000000003E0000-0x00000000003E8000-memory.dmp

      Filesize

      32KB

    • memory/3004-2-0x0000000004FA0000-0x0000000004FE0000-memory.dmp

      Filesize

      256KB

    • memory/3004-1-0x0000000074670000-0x0000000074D5E000-memory.dmp

      Filesize

      6.9MB