Overview

overview

7

Static

static

3

XSpammer_Setup.exe

windows7-x64

7

XSpammer_Setup.exe

windows10-2004-x64

7

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...ll.dll

windows7-x64

3

$PLUGINSDI...ll.dll

windows10-2004-x64

3

LICENSES.c...m.html

windows7-x64

1

LICENSES.c...m.html

windows10-2004-x64

1

XSpammer.exe

windows7-x64

1

XSpammer.exe

windows10-2004-x64

7

d3dcompiler_47.dll

windows10-2004-x64

1

resources/...age.js

windows7-x64

1

resources/...age.js

windows10-2004-x64

1

resources/...gif.js

windows7-x64

1

resources/...gif.js

windows10-2004-x64

1

resources/...dec.js

windows7-x64

1

resources/...dec.js

windows10-2004-x64

1

resources/...ame.js

windows7-x64

1

resources/...ame.js

windows10-2004-x64

1

resources/...til.js

windows7-x64

1

resources/...til.js

windows10-2004-x64

1

resources/...dex.js

windows7-x64

1

resources/...dex.js

windows10-2004-x64

1

resources/...DME.js

windows7-x64

1

resources/...DME.js

windows10-2004-x64

1

resources/elevate.exe

windows7-x64

1

resources/elevate.exe

windows10-2004-x64

1

swiftshade...GL.dll

windows7-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    XSpammer_Setup.exe
  • Size 72.4MB
  • Sample240221-1cf4qafe61
  • SHA256 ea8e830aee3ca762fa8d37597994acf261430d0ec3f393b1861e6e9d7ac3c552
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discovery

Malware Config

Targets

    • Target
      XSpammer_Setup.exe
    • Size 72.4MB
    • SHA256 ea8e830aee3ca762fa8d37597994acf261430d0ec3f393b1861e6e9d7ac3c552
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/UAC.dll
    • Size 14KB
    • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral10behavioral9
    • Target
      LICENSES.chromium.html
    • Size 4.9MB
    • SHA256 a6692be8af33d0673504a5d2bd519f4738aa872595eccc0434f5921185c0d56d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      XSpammer.exe
    • Size 125.0MB
    • SHA256 333c92f0ef14c88610341187b4f5ab54f9afe91c767d383e1578d6bc5706b32e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral13behavioral14
    • Target
      d3dcompiler_47.dll
    • Size 4.3MB
    • SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15
    • Target
      resources/app.asar.unpacked/node_modules/gifwrap/src/bitmapimage.js
    • Size 12KB
    • SHA256 147e413866556db9f79ebb0a8fd7cca6c57c59aed9da1f35fc5d731553a5d863
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral16behavioral17
    • Target
      resources/app.asar.unpacked/node_modules/gifwrap/src/gif.js
    • Size 2KB
    • SHA256 e0ca546dc16f6f80a2d2cc90a1ef8857f51d868fbea750a78132fe0c8f236d12
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral18behavioral19
    • Target
      resources/app.asar.unpacked/node_modules/gifwrap/src/gifcodec.js
    • Size 15KB
    • SHA256 a9dc8297420be29fe054c158e4564f7e75bc4385e03b0202758eac4bb6895ca3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral20behavioral21
    • Target
      resources/app.asar.unpacked/node_modules/gifwrap/src/gifframe.js
    • Size 5KB
    • SHA256 f6a575d76bea126239da8701cb32cb4337c9adc3c76790b04601b62f2cb69e1b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral22behavioral23
    • Target
      resources/app.asar.unpacked/node_modules/gifwrap/src/gifutil.js
    • Size 16KB
    • SHA256 ce2b08cf6733268c6f580f9a4e982cee584c3b3cf4685e5eb9f12c1388eef266
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral24behavioral25
    • Target
      resources/app.asar.unpacked/node_modules/gifwrap/src/index.js
    • Size 334B
    • SHA256 a48ce65f5194bf69cbea661e5861504f89c4c898f371f219a180c81d1cbacc95
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral26behavioral27
    • Target
      resources/app.asar.unpacked/node_modules/gifwrap/templates/README.hbs
    • Size 10KB
    • SHA256 95a51cb7b91c97cf5b3cdaf9bf4db83cb0a6ac65b9d3316e13eb8063bae3449b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral28behavioral29
    • Target
      resources/elevate.exe
    • Size 105KB
    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral30behavioral31
    • Target
      swiftshader/libEGL.dll
    • Size 458KB
    • SHA256 761496fd75d291a532fea9f553f9fc36bf9ae2fa6c3488f022bb16b7c0cb6f5b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Tasks