Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-05-2021 21:57
General
-
Target
slot Charges.exe
-
Size
205KB
-
MD5
5830b69895c4f5b70d2f5c94cd718fa6
-
SHA1
4ccc32740d632777fd30c8029ca2ef6c3def984c
-
SHA256
735d11c1fa476083846e9e622af57a902ff20be1a1bbce7d8ec9f7f4179d1bb3
-
SHA512
a7763bd57e9e107992b7073ad02d0dc7981696a2cb7449ee20f8e5b233e61f5f029af23348c5225469c68c015ba8e20e18c8bd5f0b949863b620363edc24dd79
Malware Config
Extracted
xloader
2.3
http://www.onyxcomputing.com/u8nw/
constructionjadams.com
organicwellnessfarm.com
beautiful.tours
medvows.com
foxparanormal.com
fsmxmc.com
graniterealestategroup.net
qgi1.com
astrologicsolutions.com
rafbar.com
bastiontools.net
emotist.com
stacyleets.com
bloodtypealpha.com
healtybenenfitsplus.com
vavadadoa3.com
chefbenhk.com
dotgz.com
xn--z4qm188e645c.com
ethyi.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\slot Charges.exe"C:\Users\Admin\AppData\Local\Temp\slot Charges.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\slot Charges.exe"C:\Users\Admin\AppData\Local\Temp\slot Charges.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\slot Charges.exe"3⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
49365ee03b9fe23b388339b8ac84bd9b
SHA1fb94c016fd957d00dcd85c8ec9ac7ae677d314b1
SHA256f9066e31398e722f92ddc2e7c58a51509b1963405358e1be714454c144644c2f
SHA512a46fd827b213e39cbf0c584a94fd7219f98712d7e8ff3d7ced5924efc9f8521c1752f7774ed906d3f4a1bfc7c8ce49d8fb344567c59f140afa991321b40929b1
-
Filesize
140KB
-
-
-
Filesize
164KB
-
Filesize
3.1MB
-
Filesize
1.3MB
-
Filesize
1.2MB
-
Filesize
864KB
-
Filesize
48KB
-
Filesize
164KB
-
-
Filesize
3.1MB
-
Filesize
572KB