Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
21/11/2024, 19:53
General
- Target 881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe
- Size 802KB
- Sample241121-yl6dvswkey
- SHA256 881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a
Malware Config
Extracted
-
xloader
-
2.5
-
q3c8
-
illstarttommorow.com
-
ll-safe-keepingtoyof5.xyz
-
mygreenequity.com
-
albionadesign.com
-
byzalikha.com
-
robinson.tools
-
mrd68.com
-
mw13racing.com
-
pirankaliyar.com
-
nropes.com
-
indigosrc.com
-
drsyverson.com
-
aprendes.academy
-
mundohightech.com
-
sarms-research.com
-
ilmarijuanadispensary.com
-
qabeta3473437.com
-
businessmastercenturion.com
-
axissol.net
-
market-oplata-23v.xyz
Signatures
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 5 IoCs
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader family
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Xloader payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Windows security modification 2 TTPs 6 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 3 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 21 IoCs
- Suspicious use of WriteProcessMemory 31 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe"C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe"2⤵
- UAC bypass
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\0r6lS7c\svchost.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\881b82a44e8578b6034c504725c33b6a22d1980affa052c4bf492c168915dc8a.exe" -Force3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\rdrleakdiag.exe"C:\Windows\SysWOW64\rdrleakdiag.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\rdrleakdiag.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_gn4bxm41.idx.ps1
memory/348-13-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/348-14-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/348-100-0x000000006F880000-0x000000006F8CC000-memory.dmp
memory/348-10-0x0000000002C90000-0x0000000002CC6000-memory.dmp
memory/348-165-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/348-156-0x0000000007CA0000-0x0000000007CA8000-memory.dmp
memory/348-155-0x0000000007CB0000-0x0000000007CCA000-memory.dmp
memory/1100-143-0x000000006F880000-0x000000006F8CC000-memory.dmp
memory/1188-123-0x000000006F880000-0x000000006F8CC000-memory.dmp
memory/1716-158-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/1716-17-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/1716-21-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/1716-110-0x000000006F880000-0x000000006F8CC000-memory.dmp
memory/1716-171-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/2468-28-0x0000000000400000-0x000000000042A000-memory.dmp
memory/2508-85-0x0000000000950000-0x0000000000D83000-memory.dmp
memory/2508-164-0x0000000000910000-0x0000000000939000-memory.dmp
memory/2508-96-0x0000000000950000-0x0000000000D83000-memory.dmp
memory/3200-124-0x000000006F880000-0x000000006F8CC000-memory.dmp
memory/3380-16-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/3380-166-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/3380-53-0x0000000006EF0000-0x0000000006F3C000-memory.dmp
memory/3380-52-0x0000000006960000-0x000000000697E000-memory.dmp
memory/3380-84-0x000000006F880000-0x000000006F8CC000-memory.dmp
memory/3380-83-0x0000000007960000-0x0000000007992000-memory.dmp
memory/3380-97-0x0000000007BA0000-0x0000000007C43000-memory.dmp
memory/3380-95-0x0000000006F40000-0x0000000006F5E000-memory.dmp
memory/3380-98-0x00000000082D0000-0x000000000894A000-memory.dmp
memory/3380-99-0x0000000007C80000-0x0000000007C9A000-memory.dmp
memory/3380-22-0x00000000063B0000-0x0000000006704000-memory.dmp
memory/3380-18-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/3380-120-0x0000000007CF0000-0x0000000007CFA000-memory.dmp
memory/3380-121-0x0000000007F00000-0x0000000007F96000-memory.dmp
memory/3380-19-0x00000000061C0000-0x00000000061E2000-memory.dmp
memory/3380-20-0x0000000006260000-0x00000000062C6000-memory.dmp
memory/3380-122-0x0000000007E80000-0x0000000007E91000-memory.dmp
memory/3380-11-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/3380-153-0x0000000007EB0000-0x0000000007EBE000-memory.dmp
memory/3380-154-0x0000000007EC0000-0x0000000007ED4000-memory.dmp
memory/3380-157-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/3380-12-0x0000000005AA0000-0x00000000060C8000-memory.dmp
memory/3556-180-0x0000000008B00000-0x0000000008C19000-memory.dmp
memory/4432-15-0x0000000007AD0000-0x0000000007ADA000-memory.dmp
memory/4432-0-0x000000007452E000-0x000000007452F000-memory.dmp
memory/4432-8-0x0000000007590000-0x00000000075F6000-memory.dmp
memory/4432-82-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/4432-7-0x0000000005BA0000-0x0000000005BE6000-memory.dmp
memory/4432-6-0x0000000005C10000-0x0000000005CCA000-memory.dmp
memory/4432-5-0x0000000074520000-0x0000000074CD0000-memory.dmp
memory/4432-4-0x00000000059C0000-0x0000000005A52000-memory.dmp
memory/4432-3-0x0000000005F70000-0x0000000006514000-memory.dmp
memory/4432-2-0x0000000005920000-0x00000000059BC000-memory.dmp
memory/4432-1-0x0000000000E40000-0x0000000000F0E000-memory.dmp