Analysis
- max time kernel
124s - max time network
126s - platform
windows7_x64 - resource
win7v20210410 - submitted
06/06/2021, 07:02
General
- Target cea33bbc7a347da7c838dd809f672092.exe
- Size 708KB
- Sample210606-932dc5p3ps
- SHA256 f952aa1436789095d76fe6a50ff7ea387aef9751e9b6f0130fcb203040881570
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.aerty.cloud/w88t/
-
ios.run
-
jubefa.com
-
ironwooddeervalley.com
-
huttoplumber.com
-
nkd.xyz
-
vivagirlpower.com
-
imhayastan.info
-
tianjinxinghao.com
-
barktothebeach.com
-
morganhertel.com
-
2linker.com
-
tomrings.com
-
sdx168.com
-
dressusinc.com
-
frontpagesweb.net
-
lotonmyplate.com
-
theballerwhiz.com
-
genrexsys.com
-
jayagunaaluminium.com
-
mubeenmovers.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cea33bbc7a347da7c838dd809f672092.exe"C:\Users\Admin\AppData\Local\Temp\cea33bbc7a347da7c838dd809f672092.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\cea33bbc7a347da7c838dd809f672092.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\cea33bbc7a347da7c838dd809f672092.exe"C:\Users\Admin\AppData\Local\Temp\cea33bbc7a347da7c838dd809f672092.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/904-68-0x0000000000400000-0x0000000000428000-memory.dmp
memory/904-76-0x0000000000CE0000-0x0000000000FE3000-memory.dmp
memory/984-75-0x0000000004942000-0x0000000004943000-memory.dmp
memory/984-87-0x00000000061A0000-0x00000000061A1000-memory.dmp
memory/984-67-0x0000000076E11000-0x0000000076E13000-memory.dmp
memory/984-110-0x0000000006390000-0x0000000006391000-memory.dmp
memory/984-109-0x0000000006380000-0x0000000006381000-memory.dmp
memory/984-70-0x0000000002280000-0x0000000002281000-memory.dmp
memory/984-71-0x0000000004980000-0x0000000004981000-memory.dmp
memory/984-72-0x0000000002600000-0x0000000002601000-memory.dmp
memory/984-95-0x0000000005690000-0x0000000005691000-memory.dmp
memory/984-74-0x0000000004940000-0x0000000004941000-memory.dmp
memory/984-94-0x0000000006300000-0x0000000006301000-memory.dmp
memory/984-77-0x00000000048A0000-0x00000000048A1000-memory.dmp
memory/984-80-0x0000000005730000-0x0000000005731000-memory.dmp
memory/984-85-0x0000000006160000-0x0000000006161000-memory.dmp
memory/984-86-0x000000007EF30000-0x000000007EF31000-memory.dmp
memory/1104-65-0x0000000004410000-0x0000000004440000-memory.dmp
memory/1104-62-0x00000000043D0000-0x00000000043D1000-memory.dmp
memory/1104-60-0x0000000000C20000-0x0000000000C21000-memory.dmp
memory/1104-63-0x0000000000A70000-0x0000000000A80000-memory.dmp
memory/1104-64-0x00000000049E0000-0x0000000004A58000-memory.dmp