Analysis
- max time kernel
136s - max time network
110s - platform
windows10_x64 - resource
win10v20210408 - submitted
29/04/2021, 15:06
General
- Target 5cdf122ace2e580ddc241bec6b8b708b.exe
- Size 821KB
- Sample210429-2kz8tr54ae
- SHA256 bc88f7ce08e0f3cd87267fff8188fbdfa3fc9e733db9775d5f06eff82a39a3d6
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.cats16.com/8u3b/
-
pipienta.com
-
wisdomfest.net
-
jenniferreich.com
-
bigcanoehomesforless.com
-
kayandbernard.com
-
offerbuildingsecrets.com
-
benleefoto.com
-
contactlesssoftware.tech
-
statenislandplumbing.info
-
lifestylemedicineservices.com
-
blazerplanning.com
-
fnatic-skins.club
-
effectivemarketinginc.com
-
babyshopit.com
-
2000deal.com
-
k12paymentcemter.com
-
spwakd.com
-
lesreponses.com
-
abundando.com
-
hawkspremierfhc.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5cdf122ace2e580ddc241bec6b8b708b.exe"C:\Users\Admin\AppData\Local\Temp\5cdf122ace2e580ddc241bec6b8b708b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5cdf122ace2e580ddc241bec6b8b708b.exe"C:\Users\Admin\AppData\Local\Temp\5cdf122ace2e580ddc241bec6b8b708b.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/568-114-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/568-116-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
memory/568-117-0x0000000005460000-0x0000000005461000-memory.dmp
memory/568-118-0x0000000005000000-0x0000000005001000-memory.dmp
memory/568-119-0x0000000004F60000-0x000000000545E000-memory.dmp
memory/568-120-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/568-121-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/568-122-0x0000000005430000-0x000000000543D000-memory.dmp
memory/568-123-0x0000000000EF0000-0x0000000000F6C000-memory.dmp
memory/568-124-0x0000000009B00000-0x0000000009B36000-memory.dmp
memory/3760-125-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3760-128-0x0000000001A70000-0x0000000001D90000-memory.dmp