Analysis
- max time kernel
150s - max time network
142s - platform
windows10_x64 - resource
win10v20210408 - submitted
26/04/2021, 06:00
General
- Target scan_DHL39382493.exe
- Size 705KB
- Sample210426-2khcyt7b9n
- SHA256 92db43c3aeae87e9144d896589dc2955fdd60d5bdb8c0f82cce377be0efb8169
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.escape-with-music.com/u2gd/
-
dianxiangtechnology.com
-
samarbogast.com
-
primeonlines.com
-
cleanandshineshop.com
-
tenply.com
-
jinpaizs.com
-
yogatona.com
-
theindianbulletin.com
-
elracodeleyton.com
-
thevandolly.com
-
empresadoseculo2020.com
-
discjockeyhammer.com
-
britishgymnasticsclaim.com
-
1508-324laurier.com
-
reliance-servicess.com
-
ylfxy.com
-
heavenstabetsy.com
-
leahmf.com
-
smartglobalconnect.com
-
papuanewguineaforum.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\scan_DHL39382493.exe"C:\Users\Admin\AppData\Local\Temp\scan_DHL39382493.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\scan_DHL39382493.exe"C:\Users\Admin\AppData\Local\Temp\scan_DHL39382493.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\scan_DHL39382493.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/604-125-0x0000000001030000-0x000000000106B000-memory.dmp
memory/604-123-0x000000007EB70000-0x000000007EB71000-memory.dmp
memory/604-117-0x0000000005630000-0x0000000005631000-memory.dmp
memory/604-118-0x0000000005130000-0x0000000005131000-memory.dmp
memory/604-119-0x0000000005130000-0x000000000562E000-memory.dmp
memory/604-120-0x0000000002BD0000-0x0000000002BD1000-memory.dmp
memory/604-121-0x0000000005290000-0x0000000005291000-memory.dmp
memory/604-122-0x0000000005370000-0x000000000537D000-memory.dmp
memory/604-114-0x0000000000660000-0x0000000000661000-memory.dmp
memory/604-124-0x0000000005E70000-0x0000000005EF1000-memory.dmp
memory/604-116-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
memory/744-133-0x0000000000870000-0x000000000088F000-memory.dmp
memory/744-134-0x0000000000550000-0x0000000000579000-memory.dmp
memory/744-136-0x0000000004710000-0x0000000004A30000-memory.dmp
memory/744-137-0x0000000004590000-0x000000000461F000-memory.dmp
memory/1964-131-0x00000000056D0000-0x00000000057EF000-memory.dmp
memory/1964-138-0x0000000003140000-0x00000000031DB000-memory.dmp
memory/3384-126-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3384-129-0x0000000000F40000-0x0000000001260000-memory.dmp
memory/3384-130-0x0000000000990000-0x00000000009A0000-memory.dmp