Analysis
- max time kernel
149s - max time network
142s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/03/2021, 15:45
General
- Target Purchase Order.exe
- Size 1.3MB
- Sample210309-b3asxbbd6s
- SHA256 b2fa4bbff4b67fef522c3b6cbc3a98b0c2f463045f19af5f96ee7a3c48ea9f93
Malware Config
Extracted
-
xloader
-
http://www.loud-swell.net/cna7/
-
healblackgirls.com
-
69dzb.com
-
oegil.com
-
kukuscupar.com
-
zillow.rentals
-
officialamandacoppotelli.com
-
jessmcbridenp.com
-
bet365n6.com
-
ovochannel.com
-
tunaoverland.com
-
ln-auth.rest
-
tamaden8080.com
-
loramur.com
-
magicluxe.net
-
obterie.com
-
ideaupload.com
-
whsuomi.com
-
dota2fall.xyz
-
artwebplace.com
-
baiorinnnobennkyou.club
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2056-21-0x0000000001450000-0x0000000001460000-memory.dmp
memory/2056-23-0x0000000001490000-0x00000000014A0000-memory.dmp
memory/2056-20-0x00000000018C0000-0x0000000001BE0000-memory.dmp
memory/2056-16-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2312-32-0x0000000006230000-0x0000000006313000-memory.dmp
memory/2312-24-0x0000000006030000-0x0000000006146000-memory.dmp
memory/2312-22-0x0000000002790000-0x0000000002847000-memory.dmp
memory/3384-29-0x00000000023A0000-0x00000000023C8000-memory.dmp
memory/3384-31-0x0000000004420000-0x00000000044AF000-memory.dmp
memory/3384-30-0x00000000045D0000-0x00000000048F0000-memory.dmp
memory/3384-28-0x0000000000180000-0x00000000001A7000-memory.dmp
memory/3496-13-0x00000000062B1000-0x00000000062B2000-memory.dmp
memory/3496-12-0x00000000075F0000-0x000000000761F000-memory.dmp
memory/3496-10-0x0000000006D90000-0x0000000006D91000-memory.dmp
memory/3496-9-0x00000000062B0000-0x00000000062B1000-memory.dmp
memory/3496-8-0x00000000062C0000-0x00000000062C1000-memory.dmp
memory/3496-2-0x00000000733A0000-0x0000000073A8E000-memory.dmp
memory/3496-7-0x0000000005920000-0x0000000005921000-memory.dmp
memory/3496-15-0x0000000007640000-0x0000000007641000-memory.dmp
memory/3496-14-0x0000000007630000-0x000000000763B000-memory.dmp
memory/3496-3-0x0000000000DA0000-0x0000000000DA1000-memory.dmp
memory/3496-5-0x0000000005CD0000-0x0000000005CD1000-memory.dmp
memory/3496-6-0x0000000005880000-0x0000000005881000-memory.dmp