Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-11-2024 20:12
General
-
Target
Shipping Documents.exe
-
Size
691KB
-
MD5
57b685ccd486b411372b78b6e9705463
-
SHA1
7e4a97376af2c523b17c6bb5002dd9663cb74ba5
-
SHA256
4427d66aaf3710031c5545a66e249213b3196045c260bacc730f4298f32b9e39
-
SHA512
b9e1fd770f4a87f7f7a4d7d7cc9574ab0934f7d0baac9c985a018b9b3a9b28316733eed1e56c8fad6eff78cc6e5c0aa303d05ad1fee9fa7ca8405fbff085fa7e
-
SSDEEP
12288:aYn11R/5PQ6naUEQOYptwzC3EOO7QcUYfgzqnZuvkjg:nPFV7pgeEOO7Qufg+nZnj
Malware Config
Extracted
xloader
2.6
ouvk
poker-star-top-casino.net
acinstallationamc.services
flashtte.com
le0hp8.xyz
christinasharpe.com
ligeria-production.net
bijiuche.com
cabolinansthingsandmore.com
rabbids-party-of-legends.com
governmentsscheme.com
weboughtavideostore.com
qrongsaid.com
audiodobyps5.com
laononggushi.com
piauipet.store
krav61.xyz
cownedes.com
okhuk.com
gsy56.com
fotografia360.agency
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader family
-
Xloader payload 3 IoCs
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 46 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AlYqySJhAwyNsl.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AlYqySJhAwyNsl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3C58.tmp"3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"3⤵
- Suspicious use of SetThreadContext
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Shipping Documents.exe"3⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD578970fd16ebb4e4af363ccd10e7a0c49
SHA1ac8814d3fa81ece50358ad015a536bd413f67d73
SHA256f4ed7c065e01ae82aa82e085a9318a0d9e2fceb719ae79d1013bf61ef20ee929
SHA51267a78f709d5a9b548f99bdc07bcfae9fd494eceba33783a9e0b3b6607ada2fe38cb9664222be7ff050e2dbe441ee57b1e6b0d7bd98c0336fcababf143860e5e9
-
Filesize
172KB
-
Filesize
48KB
-
Filesize
692KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
3.3MB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
32KB
-
Filesize
216KB
-
Filesize
104KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
7.7MB
-
Filesize
136KB
-
Filesize
80KB
-
Filesize
56KB
-
Filesize
68KB
-
Filesize
600KB
-
Filesize
104KB
-
Filesize
6.5MB
-
Filesize
7.7MB
-
Filesize
652KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
200KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
172KB
-
Filesize
172KB
-
Filesize
68KB
-
Filesize
3.3MB
-
Filesize
104KB
-
Filesize
624KB
-
Filesize
40KB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
496KB
-
Filesize
48KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
5.6MB
-
Filesize
720KB