Analysis
- max time kernel
105s - max time network
112s - platform
windows10_x64 - resource
win10v20201028 - submitted
31/03/2021, 12:56
General
- Target 80c6396c022d1af34979e7b42ee7797f.exe
- Size 745KB
- Sample210331-ghc1nms9m6
- SHA256 7a4de78c5eed937a8aa4e3149fac38d38fd0275ddc45b2a481f266c421230e5d
Malware Config
Extracted
-
xloader
-
http://www.paintersdistrictcouncil.com/vu9b/
-
longdoggy.net
-
gylvs.com
-
evonnemccray.com
-
nicemoneymaker.com
-
baby-schutzen.com
-
xgahovzm.icu
-
psdcompany.com
-
makeupjunkiewholesale.com
-
vz357.com
-
carshownet.com
-
forneyus.com
-
nfoptic.com
-
lampacosmetiques.com
-
newmandu.com
-
localupdate.net
-
theartofmajur1.com
-
bancosecurity.website
-
cabinhealthy.com
-
tiprent.com
-
lloydwellsandassociates.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\80c6396c022d1af34979e7b42ee7797f.exe"C:\Users\Admin\AppData\Local\Temp\80c6396c022d1af34979e7b42ee7797f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\80c6396c022d1af34979e7b42ee7797f.exe"C:\Users\Admin\AppData\Local\Temp\80c6396c022d1af34979e7b42ee7797f.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3096-16-0x00000000014F0000-0x0000000001810000-memory.dmp
memory/3096-13-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4716-9-0x00000000055A0000-0x00000000055A1000-memory.dmp
memory/4716-7-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/4716-8-0x0000000005320000-0x0000000005321000-memory.dmp
memory/4716-2-0x0000000073530000-0x0000000073C1E000-memory.dmp
memory/4716-10-0x0000000005340000-0x0000000005349000-memory.dmp
memory/4716-11-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/4716-12-0x0000000005ED0000-0x0000000005F26000-memory.dmp
memory/4716-6-0x00000000058D0000-0x00000000058D1000-memory.dmp
memory/4716-5-0x0000000005260000-0x0000000005261000-memory.dmp
memory/4716-3-0x0000000000880000-0x0000000000881000-memory.dmp