Analysis
- max time kernel
37s - max time network
111s - platform
windows10_x64 - resource
win10v20201028 - submitted
29/03/2021, 13:52
General
- Target 32a337e8ac0912ec32e54553a0db095f.exe
- Size 270KB
- Sample210329-tmn4799l4e
- SHA256 f86b0f3ec06d574080bd86e2980c7d04c29d4093d025fe592a567b5767031d2b
Score
10/10
Malware Config
Extracted
Family
-
xloader
C2
-
http://www.scott-re.online/nnmd/
Decoy
-
bongwater.life
-
regalparkllc.com
-
gyanankuram.com
-
quehaydecenarhoy.com
-
israeldigitalblog.net
-
gatewaygaurdians.com
-
krphp.com
-
domentemenegi47.com
-
fjsibao.com
-
yetbor.com
-
goldenvalueable.com
-
finalexam-thegame.com
-
buyeverythingforbaby.com
-
phillydroneservices.com
-
xn--kck4cd0r.net
-
suns-brothers.com
-
xn--80aaxkmix.xn--p1acf
-
pjsgsc.com
-
7985699.com
-
blackmantech.fitness
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\32a337e8ac0912ec32e54553a0db095f.exe"C:\Users\Admin\AppData\Local\Temp\32a337e8ac0912ec32e54553a0db095f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\32a337e8ac0912ec32e54553a0db095f.exe"C:\Users\Admin\AppData\Local\Temp\32a337e8ac0912ec32e54553a0db095f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/64-5-0x0000000000400000-0x0000000000428000-memory.dmp
memory/64-8-0x0000000000B00000-0x0000000000E20000-memory.dmp
memory/1048-2-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/1048-3-0x00000000008F0000-0x000000000091A000-memory.dmp
memory/1048-4-0x00000000027D0000-0x00000000027D1000-memory.dmp