Analysis
- max time kernel
124s - max time network
124s - platform
windows10_x64 - resource
win10v20210410 - submitted
06/06/2021, 07:02
General
- Target cea33bbc7a347da7c838dd809f672092.exe
- Size 708KB
- Sample210606-932dc5p3ps
- SHA256 f952aa1436789095d76fe6a50ff7ea387aef9751e9b6f0130fcb203040881570
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.aerty.cloud/w88t/
-
ios.run
-
jubefa.com
-
ironwooddeervalley.com
-
huttoplumber.com
-
nkd.xyz
-
vivagirlpower.com
-
imhayastan.info
-
tianjinxinghao.com
-
barktothebeach.com
-
morganhertel.com
-
2linker.com
-
tomrings.com
-
sdx168.com
-
dressusinc.com
-
frontpagesweb.net
-
lotonmyplate.com
-
theballerwhiz.com
-
genrexsys.com
-
jayagunaaluminium.com
-
mubeenmovers.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cea33bbc7a347da7c838dd809f672092.exe"C:\Users\Admin\AppData\Local\Temp\cea33bbc7a347da7c838dd809f672092.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\cea33bbc7a347da7c838dd809f672092.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\cea33bbc7a347da7c838dd809f672092.exe"C:\Users\Admin\AppData\Local\Temp\cea33bbc7a347da7c838dd809f672092.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3636-139-0x0000000004562000-0x0000000004563000-memory.dmp
memory/3636-134-0x0000000007890000-0x0000000007891000-memory.dmp
memory/3636-185-0x000000007E790000-0x000000007E791000-memory.dmp
memory/3636-186-0x0000000004563000-0x0000000004564000-memory.dmp
memory/3636-162-0x00000000092B0000-0x00000000092B1000-memory.dmp
memory/3636-161-0x00000000090F0000-0x00000000090F1000-memory.dmp
memory/3636-156-0x0000000008D80000-0x0000000008D81000-memory.dmp
memory/3636-149-0x0000000008FB0000-0x0000000008FE3000-memory.dmp
memory/3636-141-0x0000000008090000-0x0000000008091000-memory.dmp
memory/3636-132-0x0000000007580000-0x0000000007581000-memory.dmp
memory/3636-133-0x0000000007640000-0x0000000007641000-memory.dmp
memory/3636-130-0x0000000004500000-0x0000000004501000-memory.dmp
memory/3636-131-0x0000000006F50000-0x0000000006F51000-memory.dmp
memory/3636-137-0x0000000007D70000-0x0000000007D71000-memory.dmp
memory/3636-138-0x0000000004560000-0x0000000004561000-memory.dmp
memory/3636-136-0x0000000007710000-0x0000000007711000-memory.dmp
memory/3636-135-0x0000000007980000-0x0000000007981000-memory.dmp
memory/3992-116-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/3992-114-0x0000000000540000-0x0000000000541000-memory.dmp
memory/3992-123-0x0000000000E30000-0x0000000000E60000-memory.dmp
memory/3992-122-0x0000000000CA0000-0x0000000000D18000-memory.dmp
memory/3992-121-0x0000000000D50000-0x0000000000D51000-memory.dmp
memory/3992-120-0x0000000008D50000-0x0000000008D60000-memory.dmp
memory/3992-119-0x0000000004ED0000-0x00000000053CE000-memory.dmp
memory/3992-118-0x0000000004E40000-0x0000000004E41000-memory.dmp
memory/3992-117-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
memory/4092-140-0x0000000001250000-0x0000000001570000-memory.dmp
memory/4092-125-0x0000000000400000-0x0000000000428000-memory.dmp