Analysis
- max time kernel
113s - max time network
16s - platform
windows7_x64 - resource
win7v20201028 - submitted
31/03/2021, 18:27
General
- Target 2893a3f5a3b146426bb18f6c3ad4bcba.exe
- Size 425KB
- Sample210331-mx99v29twx
- SHA256 a514741f5e99ded17c767b1159e98f86ae0b918fcff56f53d365e4744104f457
Malware Config
Extracted
-
xloader
-
http://www.okitmall.com/iu4d/
-
abbottdigitalhealthpass.com
-
peridot.website
-
emmajanetracy.com
-
arewedoingenough.com
-
mvprunning.com
-
xn--939au40bijas7ab2a93s.com
-
thehouseofchiron.com
-
sqzffn.com
-
moretuantired.com
-
rosewoodcibubur.com
-
warungjitu.com
-
armylord.net
-
rideequihome.com
-
girasol.zone
-
getboostphlo.com
-
bilradioplaza.com
-
japannxt.com
-
figulco.com
-
insershop.com
-
loktantratvnews.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2893a3f5a3b146426bb18f6c3ad4bcba.exe"C:\Users\Admin\AppData\Local\Temp\2893a3f5a3b146426bb18f6c3ad4bcba.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2893a3f5a3b146426bb18f6c3ad4bcba.exe"C:\Users\Admin\AppData\Local\Temp\2893a3f5a3b146426bb18f6c3ad4bcba.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/644-8-0x0000000000400000-0x0000000000428000-memory.dmp
memory/644-11-0x0000000000990000-0x0000000000C93000-memory.dmp
memory/792-2-0x0000000074DD0000-0x00000000754BE000-memory.dmp
memory/792-3-0x0000000001250000-0x0000000001251000-memory.dmp
memory/792-5-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
memory/792-6-0x00000000003A0000-0x00000000003A9000-memory.dmp
memory/792-7-0x00000000047A0000-0x00000000047F6000-memory.dmp