Analysis
- max time kernel
149s - max time network
152s - platform
windows10_x64 - resource
win10v20201028 - submitted
22/03/2021, 11:24
General
- Target 9311-32400.pdf.exe
- Size 663KB
- Sample210322-ef6mxhgwcs
- SHA256 8f5dfe8e291d0fd6aa44d6b06358b1f571f9c1a6172ca2f82a2db10327d0dee8
Malware Config
Extracted
-
xloader
-
http://www.gym-gain.bid/i9p8/
-
urbanfoxwellness.com
-
localmarket.delivery
-
nishimoguima.com
-
ai5m.net
-
thethreetees.com
-
mentactics.com
-
socksnclips.com
-
maymarmarine.com
-
northdakotapaintparties.com
-
sellyourtimesharesafe.com
-
lubangpc.com
-
nembilauktion.com
-
careersatsap.xyz
-
paradiseminks.com
-
comotowing.com
-
joananacho.com
-
beijingcameracrew.com
-
aspiringeyephoto.com
-
glprintmedia.com
-
veloxfleet.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9311-32400.pdf.exe"C:\Users\Admin\AppData\Local\Temp\9311-32400.pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9311-32400.pdf.exe"C:\Users\Admin\AppData\Local\Temp\9311-32400.pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\9311-32400.pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3128-26-0x0000000005F30000-0x0000000006098000-memory.dmp
memory/3128-19-0x0000000000AF0000-0x0000000000BDF000-memory.dmp
memory/3176-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3176-18-0x0000000001850000-0x0000000001860000-memory.dmp
memory/3176-17-0x00000000018E0000-0x0000000001C00000-memory.dmp
memory/4304-21-0x0000000001240000-0x0000000001256000-memory.dmp
memory/4304-25-0x00000000047F0000-0x000000000487F000-memory.dmp
memory/4304-23-0x00000000049A0000-0x0000000004CC0000-memory.dmp
memory/4304-22-0x0000000000710000-0x0000000000739000-memory.dmp
memory/4684-9-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/4684-7-0x0000000004CB0000-0x0000000004CB1000-memory.dmp
memory/4684-6-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/4684-2-0x0000000073900000-0x0000000073FEE000-memory.dmp
memory/4684-8-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/4684-11-0x0000000004C00000-0x0000000004C0B000-memory.dmp
memory/4684-10-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/4684-5-0x0000000004C10000-0x0000000004C11000-memory.dmp
memory/4684-12-0x0000000005B50000-0x0000000005BDD000-memory.dmp
memory/4684-3-0x0000000000310000-0x0000000000311000-memory.dmp