Analysis
- max time kernel
103s - max time network
11s - platform
windows7_x64 - resource
win7v20201028 - submitted
16/03/2021, 19:36
General
- Target 8f108e8ea58d3b6591ea7e5fe24839eb.exe
- Size 994KB
- Sample210316-e4c6l5mn56
- SHA256 4bc0559cbf4ec33e38c556bc91fca79005454ec4b72e1101638fc4e2bfcbbb70
Malware Config
Extracted
-
xloader
-
http://www.alphaonemediagroup.com/m0rc/
-
the-smart-light.com
-
dashite.com
-
cwdunlaptruckinginc.com
-
hardcoreporn.club
-
mediacombb.info
-
zuot-1.com
-
mediabelajardigital.com
-
rbc-supportclient05.com
-
puertovallartahouse.com
-
valentinaasia.com
-
tunes4tinder.com
-
fermenteddough.com
-
tipsindah.com
-
jpsaledevelopment.asia
-
amrdiabcafe.com
-
spsd-test-predators07.xyz
-
biandanmall.com
-
uselessmajors.com
-
valiantrunners.com
-
osoandmaxz.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f108e8ea58d3b6591ea7e5fe24839eb.exe"C:\Users\Admin\AppData\Local\Temp\8f108e8ea58d3b6591ea7e5fe24839eb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8f108e8ea58d3b6591ea7e5fe24839eb.exe"C:\Users\Admin\AppData\Local\Temp\8f108e8ea58d3b6591ea7e5fe24839eb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/428-8-0x0000000000400000-0x0000000000429000-memory.dmp
memory/428-11-0x0000000000B20000-0x0000000000E23000-memory.dmp
memory/644-2-0x0000000074090000-0x000000007477E000-memory.dmp
memory/644-3-0x0000000000A20000-0x0000000000A21000-memory.dmp
memory/644-5-0x0000000000490000-0x000000000049B000-memory.dmp
memory/644-6-0x0000000004A80000-0x0000000004A81000-memory.dmp
memory/644-7-0x0000000004840000-0x00000000048A6000-memory.dmp