Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-11-2024 21:22

General

  • Target

    d2d96154024ca3137cd2e84d367053ea8e0de0459a781356577a3ba775c1fb8e.js

  • Size

    354KB

  • MD5

    4e5cc8fddecae16e747e6b1a48b31cd5

  • SHA1

    9195d4069bc82b38261bb9ec58333921e7164eac

  • SHA256

    d2d96154024ca3137cd2e84d367053ea8e0de0459a781356577a3ba775c1fb8e

  • SHA512

    fa27ad2184bc22d0d7784e1ecffd049266c43b196635373e73280d71e244061687113143361e8466f29f489259afd0b18e8c50ffb37007cc199fea0e28475ad1

  • SSDEEP

    6144:MFy6iTj2GQabp6O5GiyPXg6FRC5epPNmyJn6kiMJ+ME5fSKO37S:MFy6NagigXg6FR7NmyJGMfExSPG

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pzi0

Decoy

laylmodest.com

woruke.club

metaverseslots.net

syscogent.net

aluxxenterprise.com

lm-solar.com

lightempirestore.com

witcheboutique.com

hometech-bosch.xyz

expert-netcad.com

poteconomist.com

mycousinsfriend.biz

shineveranda.com

collegedictionary.cloud

zqlidexx.com

businessesopportunity.com

2utalahs4.com

participatetn.info

dare2ownit.com

varser.com

Signatures

  • Vjw0rm

    Vjw0rm is a remote access trojan written in JavaScript.

  • Vjw0rm family
  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader family
  • Xloader payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 60 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3456
    • C:\Windows\system32\wscript.exe
      wscript.exe C:\Users\Admin\AppData\Local\Temp\d2d96154024ca3137cd2e84d367053ea8e0de0459a781356577a3ba775c1fb8e.js
      2⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2832
      • C:\Windows\System32\wscript.exe
        "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\CJiKMkZXYA.js"
        3⤵
        • Drops startup file
        • Adds Run key to start application
        PID:1688
      • C:\Users\Admin\AppData\Local\Temp\wealth.exe
        "C:\Users\Admin\AppData\Local\Temp\wealth.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:4520
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\SysWOW64\cmd.exe"
      2⤵
      • Blocklisted process makes network request
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\wealth.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2856

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\wealth.exe

    Filesize

    163KB

    MD5

    83481bf872730cd133669c5ea5b1be2b

    SHA1

    fbd2369965b20f6bee09063aa454de13a18c71d3

    SHA256

    5d174dd08492f307e4b367e262f3e96b9beefb99f5abb11043ddf7142a18e9e8

    SHA512

    9080dc9bcdfba87ff3ecb3ba04af7a03dea2228f093fbb91149ff8825694601908ba85b2ce27a1de47ce1f6e263b03d96d80d43b7a4033051fbbac64fde7dc51

  • C:\Users\Admin\AppData\Roaming\CJiKMkZXYA.js

    Filesize

    23KB

    MD5

    1962a74165904451424267c78882130c

    SHA1

    761254145b67dd9b85a7c689dcd4aa61e2c16420

    SHA256

    b054f1670ebc434d9c756d7ecf2c0a9cafedbacd2b1ca89aef12a49733007095

    SHA512

    d3abf4e9b6279508f326aa979942d183f02c45c95bcf1a3820f67b6b8bc29c73d44fb19dba8438da46f8c778012d027067655620387b4c88cce7917c525760b4

  • memory/1796-15-0x0000000000AB0000-0x0000000000B0A000-memory.dmp

    Filesize

    360KB

  • memory/1796-17-0x0000000000AB0000-0x0000000000B0A000-memory.dmp

    Filesize

    360KB

  • memory/1796-19-0x00000000005D0000-0x00000000005F9000-memory.dmp

    Filesize

    164KB

  • memory/3456-14-0x000000000A220000-0x000000000A3A5000-memory.dmp

    Filesize

    1.5MB

  • memory/3456-18-0x000000000A220000-0x000000000A3A5000-memory.dmp

    Filesize

    1.5MB

  • memory/3456-23-0x0000000008880000-0x00000000089FC000-memory.dmp

    Filesize

    1.5MB

  • memory/4520-11-0x0000000001720000-0x0000000001A6A000-memory.dmp

    Filesize

    3.3MB

  • memory/4520-12-0x000000000019D000-0x000000000019E000-memory.dmp

    Filesize

    4KB

  • memory/4520-13-0x0000000000180000-0x00000000001A9000-memory.dmp

    Filesize

    164KB