Analysis
- max time kernel
11s - max time network
64s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/04/2021, 19:45
General
- Target SecuriteInfo.com.Trojan.Siggen13.3998.13337.3184.exe
- Size 378KB
- Sample210408-4nb26jssqe
- SHA256 5bcba2a09d8758ca07490dfcd3859a64b3a0092ed7873a707e73346eefd4235e
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.3
C2
-
http://www.gailrichardson.com/qjnt/
Decoy
-
funeralinsurancetoppro.info
-
californiaredstate.com
-
xn--jpr220deud640b.com
-
playx.finance
-
siamfellow.com
-
tekirdagvethelp.com
-
forrealmodels.com
-
desenergie.info
-
whynotplus.com
-
graniteinaminute.com
-
satgurucolorlabs.com
-
potviper.com
-
racevx.xyz
-
thebluefishhotel.net
-
elletesla.com
-
4608capaydrive.com
-
buckhead-meat.com
-
garage-repair-near-me.com
-
ubique.works
-
markokuzmanovicpreduzetnik.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.3998.13337.3184.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.3998.13337.3184.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.3998.13337.3184.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen13.3998.13337.3184.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1196-116-0x0000000003F10000-0x0000000003F3A000-memory.dmp
memory/2112-114-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2112-118-0x0000000000A60000-0x0000000000D80000-memory.dmp