Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7v20210410 - submitted
24/05/2021, 15:54
General
- Target Ciikfddtznhxmtqufdujkifxwmwhrfjkcl_Signed_.exe
- Size 774KB
- Sample210524-bbklp55mdj
- SHA256 d04efc1f583b9d7a2f2e600a43eeb8fb8359432c591a4f8cc583caf881097421
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.f3g.fund/qd8i/
-
sunilnitee.com
-
amaury-berthelot.com
-
kymandcompany.com
-
zilingmall.com
-
oaveourbowls.com
-
newboxmall.com
-
postmaple.com
-
platinumseitai.com
-
caretaker4u.com
-
kairossol.com
-
greenboughcounseling.com
-
worldug.com
-
maximumvelocityproperties.com
-
rvstoragecentraloregon.com
-
loukylaw.com
-
moderndaytattoo.com
-
4tofollow.com
-
bctnahytq.icu
-
thesonicsorcerer.com
-
mohammedalshaqsiadvocate.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Ciikfddtznhxmtqufdujkifxwmwhrfjkcl_Signed_.exe"C:\Users\Admin\AppData\Local\Temp\Ciikfddtznhxmtqufdujkifxwmwhrfjkcl_Signed_.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1256-70-0x0000000005080000-0x00000000051BB000-memory.dmp
memory/1256-78-0x00000000051C0000-0x0000000005270000-memory.dmp
memory/1256-72-0x00000000065F0000-0x00000000066DD000-memory.dmp
memory/1452-67-0x0000000010410000-0x0000000010438000-memory.dmp
memory/1452-71-0x00000000002F0000-0x0000000000300000-memory.dmp
memory/1452-66-0x00000000000B0000-0x00000000000B1000-memory.dmp
memory/1452-68-0x0000000002090000-0x0000000002393000-memory.dmp
memory/1452-69-0x00000000001E0000-0x00000000001F0000-memory.dmp
memory/1828-74-0x0000000000960000-0x0000000000986000-memory.dmp
memory/1828-75-0x0000000000070000-0x0000000000098000-memory.dmp
memory/1828-76-0x0000000001F20000-0x0000000002223000-memory.dmp
memory/1828-77-0x0000000000850000-0x00000000008DF000-memory.dmp
memory/2004-64-0x00000000765F1000-0x00000000765F3000-memory.dmp
memory/2004-59-0x0000000000230000-0x0000000000231000-memory.dmp
memory/2004-61-0x0000000000270000-0x000000000028A000-memory.dmp