Analysis
- max time kernel
152s - max time network
150s - platform
windows7_x64 - resource
win7v20210410 - submitted
24/05/2021, 13:14
General
- Target netwire.exe
- Size 1.1MB
- Sample210524-21n2cfpff2
- SHA256 4da679e366dc987277f7850f71d5343e7c9b8cff4b2df89dd2f335f512de62c1
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.adultpeace.com/p2io/
-
essentiallyourscandles.com
-
cleanxcare.com
-
bigplatesmallwallet.com
-
iotcloud.technology
-
dmgt4m2g8y2uh.net
-
malcorinmobiliaria.com
-
thriveglucose.com
-
fuhaitongxin.com
-
magetu.info
-
pyithuhluttaw.net
-
myfavbutik.com
-
xzklrhy.com
-
anewdistraction.com
-
mercuryaid.net
-
thesoulrevitalist.com
-
swayam-moj.com
-
liminaltechnology.com
-
lucytime.com
-
alfenas.info
-
carmelodesign.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\netwire.exe"C:\Users\Admin\AppData\Local\Temp\netwire.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\netwire.exe"C:\Users\Admin\AppData\Local\Temp\netwire.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\netwire.exe"5⤵
- Deletes itself
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/568-81-0x0000000000460000-0x00000000004EF000-memory.dmp
memory/568-80-0x0000000075281000-0x0000000075283000-memory.dmp
memory/568-79-0x0000000002190000-0x0000000002493000-memory.dmp
memory/568-78-0x0000000000080000-0x00000000000A8000-memory.dmp
memory/568-77-0x0000000049F50000-0x0000000049F9C000-memory.dmp
memory/744-72-0x0000000000A50000-0x0000000000D53000-memory.dmp
memory/744-70-0x0000000000120000-0x0000000000130000-memory.dmp
memory/744-67-0x0000000000400000-0x0000000000428000-memory.dmp
memory/744-73-0x0000000000160000-0x0000000000170000-memory.dmp
memory/1096-60-0x00000000001B0000-0x00000000001B1000-memory.dmp
memory/1096-66-0x0000000007660000-0x00000000076C2000-memory.dmp
memory/1096-65-0x0000000005000000-0x00000000050A9000-memory.dmp
memory/1096-64-0x0000000000390000-0x0000000000395000-memory.dmp
memory/1096-63-0x000000007EF40000-0x000000007EF41000-memory.dmp
memory/1096-62-0x0000000004E10000-0x0000000004E11000-memory.dmp
memory/1248-74-0x0000000006580000-0x00000000066B8000-memory.dmp
memory/1248-71-0x0000000006C70000-0x0000000006DF9000-memory.dmp
memory/1248-82-0x0000000004190000-0x0000000004260000-memory.dmp