Analysis
- max time kernel
149s - max time network
12s - platform
windows7_x64 - resource
win7v20201028 - submitted
22/03/2021, 11:24
General
- Target 9311-32400.pdf.exe
- Size 663KB
- Sample210322-ef6mxhgwcs
- SHA256 8f5dfe8e291d0fd6aa44d6b06358b1f571f9c1a6172ca2f82a2db10327d0dee8
Malware Config
Extracted
-
xloader
-
http://www.gym-gain.bid/i9p8/
-
urbanfoxwellness.com
-
localmarket.delivery
-
nishimoguima.com
-
ai5m.net
-
thethreetees.com
-
mentactics.com
-
socksnclips.com
-
maymarmarine.com
-
northdakotapaintparties.com
-
sellyourtimesharesafe.com
-
lubangpc.com
-
nembilauktion.com
-
careersatsap.xyz
-
paradiseminks.com
-
comotowing.com
-
joananacho.com
-
beijingcameracrew.com
-
aspiringeyephoto.com
-
glprintmedia.com
-
veloxfleet.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9311-32400.pdf.exe"C:\Users\Admin\AppData\Local\Temp\9311-32400.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9311-32400.pdf.exe"C:\Users\Admin\AppData\Local\Temp\9311-32400.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\9311-32400.pdf.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/556-14-0x00000000001A0000-0x00000000001B0000-memory.dmp
memory/556-11-0x0000000000BB0000-0x0000000000EB3000-memory.dmp
memory/556-8-0x0000000000400000-0x0000000000429000-memory.dmp
memory/556-12-0x00000000000B0000-0x00000000000C0000-memory.dmp
memory/1196-13-0x0000000006630000-0x0000000006776000-memory.dmp
memory/1196-15-0x00000000047D0000-0x00000000048AE000-memory.dmp
memory/1340-7-0x0000000005480000-0x000000000550D000-memory.dmp
memory/1340-2-0x0000000074480000-0x0000000074B6E000-memory.dmp
memory/1340-6-0x0000000000490000-0x000000000049B000-memory.dmp
memory/1340-5-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
memory/1340-3-0x0000000000970000-0x0000000000971000-memory.dmp
memory/1836-18-0x0000000000490000-0x0000000000498000-memory.dmp
memory/1836-19-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1836-20-0x0000000000880000-0x0000000000B83000-memory.dmp
memory/1836-21-0x0000000000630000-0x00000000006BF000-memory.dmp