Analysis
- max time kernel
151s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
04/03/2021, 14:16
General
- Target NEW PURCHASE030421.exe
- Size 763KB
- Sample210304-fmcbjk443s
- SHA256 58415bcbd41e70c3f6d45f7b4fa75cf79c1f86f790decfec1dfe52be21f4c994
Malware Config
Extracted
-
xloader
-
http://www.besthardinquiryremoval.services/noi6/
-
daliglobalservice.com
-
thenationschristianchurch.com
-
aliqy.com
-
grace-saunders.com
-
endlessretirement.com
-
stanleycupticket.com
-
dltgame.club
-
healthqnahindi.com
-
salniyrk.icu
-
laurasbaked.com
-
vintagechinese.com
-
agrocomposites.com
-
aimedsports.com
-
vegeatsdirect.com
-
goh-pbl.com
-
fairview.global
-
affiliateprogramscenter.com
-
blogizarshop.com
-
loorzon.com
-
curtex.info
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE030421.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE030421.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE030421.exe"C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE030421.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\NEW PURCHASE030421.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/936-25-0x0000000002D30000-0x0000000002DBF000-memory.dmp
memory/936-24-0x0000000002ED0000-0x00000000031F0000-memory.dmp
memory/936-23-0x0000000002790000-0x00000000027B9000-memory.dmp
memory/936-22-0x00000000000E0000-0x0000000000139000-memory.dmp
memory/1400-8-0x00000000051F0000-0x00000000051F1000-memory.dmp
memory/1400-10-0x0000000005210000-0x0000000005217000-memory.dmp
memory/1400-11-0x00000000054F0000-0x00000000054F1000-memory.dmp
memory/1400-12-0x0000000005E50000-0x0000000005E9E000-memory.dmp
memory/1400-9-0x0000000005500000-0x0000000005501000-memory.dmp
memory/1400-3-0x0000000000920000-0x0000000000921000-memory.dmp
memory/1400-5-0x0000000005260000-0x0000000005261000-memory.dmp
memory/1400-6-0x0000000005800000-0x0000000005801000-memory.dmp
memory/1400-7-0x0000000005300000-0x0000000005301000-memory.dmp
memory/1400-2-0x0000000073FB0000-0x000000007469E000-memory.dmp
memory/2916-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2916-18-0x00000000011F0000-0x0000000001200000-memory.dmp
memory/2916-17-0x0000000001B10000-0x0000000001E30000-memory.dmp
memory/3032-19-0x0000000004A90000-0x0000000004BFB000-memory.dmp
memory/3032-26-0x0000000004C00000-0x0000000004D89000-memory.dmp