Analysis
- max time kernel
109s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
16/03/2021, 19:36
General
- Target 8f108e8ea58d3b6591ea7e5fe24839eb.exe
- Size 994KB
- Sample210316-e4c6l5mn56
- SHA256 4bc0559cbf4ec33e38c556bc91fca79005454ec4b72e1101638fc4e2bfcbbb70
Malware Config
Extracted
-
xloader
-
http://www.alphaonemediagroup.com/m0rc/
-
the-smart-light.com
-
dashite.com
-
cwdunlaptruckinginc.com
-
hardcoreporn.club
-
mediacombb.info
-
zuot-1.com
-
mediabelajardigital.com
-
rbc-supportclient05.com
-
puertovallartahouse.com
-
valentinaasia.com
-
tunes4tinder.com
-
fermenteddough.com
-
tipsindah.com
-
jpsaledevelopment.asia
-
amrdiabcafe.com
-
spsd-test-predators07.xyz
-
biandanmall.com
-
uselessmajors.com
-
valiantrunners.com
-
osoandmaxz.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f108e8ea58d3b6591ea7e5fe24839eb.exe"C:\Users\Admin\AppData\Local\Temp\8f108e8ea58d3b6591ea7e5fe24839eb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8f108e8ea58d3b6591ea7e5fe24839eb.exe"C:\Users\Admin\AppData\Local\Temp\8f108e8ea58d3b6591ea7e5fe24839eb.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/800-2-0x00000000730E0000-0x00000000737CE000-memory.dmp
memory/800-3-0x0000000000120000-0x0000000000121000-memory.dmp
memory/800-5-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/800-6-0x00000000051D0000-0x00000000051D1000-memory.dmp
memory/800-7-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
memory/800-8-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/800-9-0x0000000004B60000-0x0000000004B61000-memory.dmp
memory/800-10-0x0000000004E90000-0x0000000004E91000-memory.dmp
memory/800-11-0x0000000004B90000-0x0000000004B9B000-memory.dmp
memory/800-12-0x0000000004F70000-0x0000000004FD6000-memory.dmp
memory/3660-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3660-16-0x0000000001B90000-0x0000000001EB0000-memory.dmp