Analysis
- max time kernel
146s - max time network
146s - platform
windows10_x64 - resource
win10v20210410 - submitted
24/05/2021, 13:14
General
- Target netwire.exe
- Size 1.1MB
- Sample210524-21n2cfpff2
- SHA256 4da679e366dc987277f7850f71d5343e7c9b8cff4b2df89dd2f335f512de62c1
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.adultpeace.com/p2io/
-
essentiallyourscandles.com
-
cleanxcare.com
-
bigplatesmallwallet.com
-
iotcloud.technology
-
dmgt4m2g8y2uh.net
-
malcorinmobiliaria.com
-
thriveglucose.com
-
fuhaitongxin.com
-
magetu.info
-
pyithuhluttaw.net
-
myfavbutik.com
-
xzklrhy.com
-
anewdistraction.com
-
mercuryaid.net
-
thesoulrevitalist.com
-
swayam-moj.com
-
liminaltechnology.com
-
lucytime.com
-
alfenas.info
-
carmelodesign.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\netwire.exe"C:\Users\Admin\AppData\Local\Temp\netwire.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\netwire.exe"C:\Users\Admin\AppData\Local\Temp\netwire.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\netwire.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2520-129-0x0000000001750000-0x0000000001A70000-memory.dmp
memory/2520-130-0x0000000001220000-0x0000000001230000-memory.dmp
memory/2520-126-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2600-137-0x0000000004C10000-0x0000000004C9F000-memory.dmp
memory/2600-136-0x0000000004D30000-0x0000000005050000-memory.dmp
memory/2600-135-0x0000000000B50000-0x0000000000B78000-memory.dmp
memory/2600-134-0x0000000000C40000-0x0000000000C53000-memory.dmp
memory/3064-138-0x0000000004DB0000-0x0000000004F36000-memory.dmp
memory/3064-131-0x00000000025D0000-0x000000000269E000-memory.dmp
memory/4040-120-0x0000000005650000-0x0000000005651000-memory.dmp
memory/4040-125-0x0000000008650000-0x00000000086B2000-memory.dmp
memory/4040-124-0x0000000006110000-0x00000000061B9000-memory.dmp
memory/4040-123-0x00000000056F0000-0x00000000056F5000-memory.dmp
memory/4040-121-0x0000000005530000-0x0000000005A2E000-memory.dmp
memory/4040-122-0x000000007E760000-0x000000007E761000-memory.dmp
memory/4040-114-0x0000000000930000-0x0000000000931000-memory.dmp
memory/4040-119-0x0000000005390000-0x0000000005391000-memory.dmp
memory/4040-118-0x0000000005530000-0x0000000005531000-memory.dmp
memory/4040-117-0x0000000005A30000-0x0000000005A31000-memory.dmp
memory/4040-116-0x0000000005490000-0x0000000005491000-memory.dmp