Analysis
- max time kernel
135s - max time network
137s - platform
windows7_x64 - resource
win7v20210408 - submitted
19/04/2021, 17:23
General
- Target 2b0ddd050806aebc7d52fb39a313b08e.exe
- Size 698KB
- Sample210419-b27ewxdvse
- SHA256 c0565af2331df2f4c2b1dd0d96200c21dadb9add0a3e1debaba3b241c38bb3da
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.allindiatrust.com/sbjq/
-
topbrandslook.xyz
-
kupilabs.com
-
cedrick.net
-
91mh.info
-
ajoph.net
-
finishtheverse.com
-
pondokquranaljariyah.com
-
happyhoopoe.com
-
lowcostfooddelivery.com
-
estudiosvacunacovid19-co.com
-
iestradanhhome.com
-
xn--caasymas-e3a.com
-
shopqls.com
-
wpnator.com
-
parentedagency.com
-
nundmshop.com
-
lodosmimarlik.com
-
ccidyy.xyz
-
bem-vestida.com
-
smartincomeafrica.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b0ddd050806aebc7d52fb39a313b08e.exe"C:\Users\Admin\AppData\Local\Temp\2b0ddd050806aebc7d52fb39a313b08e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2b0ddd050806aebc7d52fb39a313b08e.exe"C:\Users\Admin\AppData\Local\Temp\2b0ddd050806aebc7d52fb39a313b08e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/736-65-0x0000000000400000-0x0000000000429000-memory.dmp
memory/736-68-0x0000000000840000-0x0000000000B43000-memory.dmp
memory/1820-59-0x0000000001030000-0x0000000001031000-memory.dmp
memory/1820-61-0x0000000005090000-0x0000000005091000-memory.dmp
memory/1820-62-0x0000000000270000-0x0000000000279000-memory.dmp
memory/1820-63-0x0000000004FD0000-0x000000000504D000-memory.dmp
memory/1820-64-0x00000000007A0000-0x00000000007DC000-memory.dmp