Overview

overview

10

Static

static

1

881b82a44e...8a.exe

windows7-x64

10

881b82a44e...8a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    21-11-2024 19:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe

  • Size

    802KB

  • MD5

    66fe9fc4a048631ec4ac9bc4ad55f501

  • SHA1

    302188f68b430e20f0f28d8ec9697a216e341d79

  • SHA256

    881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a

  • SHA512

    71b6fa38cc25d2ceb360b6b6ac6d725cd2137d8e4cd660bd1829997d2223ea9123d247006b3afee96e650b9014871b1d9579d69faa590c6501016a3152243530

  • SSDEEP

    24576:dLa/diQs7a/ichDPvzoKndNQ2dliGBUam:dLlW/Nz/TNqNam

Score
10/10
xloaderq3c8discoveryevasionexecutionloaderpersistencerattrojan

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

q3c8

Decoy

illstarttommorow.com

ll-safe-keepingtoyof5.xyz

mygreenequity.com

albionadesign.com

byzalikha.com

robinson.tools

mrd68.com

mw13racing.com

pirankaliyar.com

nropes.com

indigosrc.com

drsyverson.com

aprendes.academy

mundohightech.com

sarms-research.com

ilmarijuanadispensary.com

qabeta3473437.com

businessmastercenturion.com

axissol.net

market-oplata-23v.xyz

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 5 IoCs
    evasiontrojan
  • Xloader

    Xloader is a rebranded version of Formbook malware.

    loaderxloader
  • Xloader family
    xloader
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    evasion
  • Xloader payload 3 IoCs
    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Windows security modification 2 TTPs 6 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 46 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of WriteProcessMemory 43 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe
      "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe"
      2⤵
      • UAC bypass
      • Windows security bypass
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Windows security modification
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Maps connected drives based on registry
      • Suspicious use of SetThreadContext
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2568
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe" -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2016
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe" -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2480
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2440
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2876
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1276
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2708
      • C:\Windows\SysWOW64\newdev.exe
        "C:\Windows\SysWOW64\newdev.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2884
    • C:\Windows\SysWOW64\cmmon32.exe
      "C:\Windows\SysWOW64\cmmon32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1264
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\SysWOW64\newdev.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

3
T1562

Disable or Modify Tools

3
T1562.001

Modify Registry

5
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
    Filesize

    7KB

    MD5

    6b600c9e1cda0d770bf7189a4c6f23db

    SHA1

    f0118806bd369b4ba75d8316800eac1cb23f6b19

    SHA256

    3da2a8a3557746a8163bf36df93dc1c78276cda4f40babb1e571240081d611d7

    SHA512

    686b1e962b35d24dc1f7e0bfab0a8a541f8e9a4f9e600bfc85838eae59cfd002165d31a5389a5eda57232090e79584df5cf923b1ea029e506232036240377c74

    Download Submit

  • memory/1200-42-0x0000000000010000-0x0000000000020000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1264-45-0x00000000000D0000-0x00000000000F9000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1264-44-0x0000000000030000-0x000000000003D000-memory.dmp

    Filesize

    52KB

    Download

  • memory/2568-1-0x0000000000B40000-0x0000000000C0E000-memory.dmp

    Filesize

    824KB

    Download

  • memory/2568-2-0x00000000749F0000-0x00000000750DE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2568-3-0x0000000004260000-0x000000000431A000-memory.dmp

    Filesize

    744KB

    Download

  • memory/2568-4-0x0000000002010000-0x0000000002056000-memory.dmp

    Filesize

    280KB

    Download

  • memory/2568-0-0x00000000749FE000-0x00000000749FF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2568-43-0x00000000749F0000-0x00000000750DE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2884-33-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/2884-35-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/2884-39-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2884-40-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/2884-37-0x0000000000400000-0x000000000042A000-memory.dmp

    Filesize

    168KB

    Download