Analysis
- max time kernel
105s - max time network
68s - platform
windows10_x64 - resource
win10v20210410 - submitted
19/04/2021, 17:23
General
- Target 2b0ddd050806aebc7d52fb39a313b08e.exe
- Size 698KB
- Sample210419-b27ewxdvse
- SHA256 c0565af2331df2f4c2b1dd0d96200c21dadb9add0a3e1debaba3b241c38bb3da
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.allindiatrust.com/sbjq/
-
topbrandslook.xyz
-
kupilabs.com
-
cedrick.net
-
91mh.info
-
ajoph.net
-
finishtheverse.com
-
pondokquranaljariyah.com
-
happyhoopoe.com
-
lowcostfooddelivery.com
-
estudiosvacunacovid19-co.com
-
iestradanhhome.com
-
xn--caasymas-e3a.com
-
shopqls.com
-
wpnator.com
-
parentedagency.com
-
nundmshop.com
-
lodosmimarlik.com
-
ccidyy.xyz
-
bem-vestida.com
-
smartincomeafrica.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b0ddd050806aebc7d52fb39a313b08e.exe"C:\Users\Admin\AppData\Local\Temp\2b0ddd050806aebc7d52fb39a313b08e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2b0ddd050806aebc7d52fb39a313b08e.exe"C:\Users\Admin\AppData\Local\Temp\2b0ddd050806aebc7d52fb39a313b08e.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1176-128-0x0000000001440000-0x0000000001760000-memory.dmp
memory/1176-125-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4040-121-0x0000000005600000-0x0000000005609000-memory.dmp
memory/4040-119-0x00000000051F0000-0x00000000051F1000-memory.dmp
memory/4040-120-0x00000000054E0000-0x00000000054E1000-memory.dmp
memory/4040-114-0x0000000000930000-0x0000000000931000-memory.dmp
memory/4040-122-0x00000000052E0000-0x00000000057DE000-memory.dmp
memory/4040-123-0x00000000010C0000-0x000000000113D000-memory.dmp
memory/4040-124-0x0000000007630000-0x000000000766C000-memory.dmp
memory/4040-118-0x0000000005380000-0x0000000005381000-memory.dmp
memory/4040-117-0x00000000057E0000-0x00000000057E1000-memory.dmp
memory/4040-116-0x0000000005220000-0x0000000005221000-memory.dmp