Analysis
- max time kernel
150s - max time network
147s - platform
windows10_x64 - resource
win10v20210408 - submitted
24/06/2021, 06:21
General
- Target purchase order pdf.exe
- Size 776KB
- Sample210624-65e45vldge
- SHA256 042afd1bcf79f7231ff41744fef68a03c0ea372d2fc4734f2ff9f2954b112e7c
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.innercriticarchetypes.com/h388/
-
americangrindstone.com
-
qdy6.club
-
bestsecretrecipes.info
-
11restoran.com
-
mrhashtags.com
-
theexecutivestudio.com
-
levilatte.com
-
indiantrio.com
-
msdhigh.com
-
spartandiesel.com
-
soccersundays.com
-
eliteworldcars.com
-
superlemon001.com
-
greenlight.school
-
kuryeforum.xyz
-
abc-322.com
-
campbellretreat.com
-
argonmode.net
-
movievilla.info
-
brateix.info
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 40 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\purchase order pdf.exe"C:\Users\Admin\AppData\Local\Temp\purchase order pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\purchase order pdf.exe"C:\Users\Admin\AppData\Local\Temp\purchase order pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\purchase order pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/672-114-0x0000000000650000-0x0000000000651000-memory.dmp
memory/672-116-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/672-117-0x0000000005530000-0x0000000005531000-memory.dmp
memory/672-118-0x00000000050D0000-0x00000000050D1000-memory.dmp
memory/672-119-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/672-120-0x0000000005230000-0x0000000005231000-memory.dmp
memory/672-121-0x0000000004E60000-0x0000000004EFC000-memory.dmp
memory/672-122-0x0000000005310000-0x0000000005320000-memory.dmp
memory/672-123-0x0000000007620000-0x00000000076B3000-memory.dmp
memory/672-124-0x0000000009D10000-0x0000000009D6B000-memory.dmp
memory/2024-134-0x0000000000110000-0x000000000011C000-memory.dmp
memory/2024-138-0x00000000049A0000-0x0000000004A30000-memory.dmp
memory/2024-137-0x00000000045F0000-0x0000000004910000-memory.dmp
memory/2024-135-0x00000000030C0000-0x00000000030E9000-memory.dmp
memory/2724-132-0x0000000006390000-0x0000000006469000-memory.dmp
memory/2724-130-0x00000000066E0000-0x00000000067C9000-memory.dmp
memory/2724-139-0x0000000000D20000-0x0000000000DCE000-memory.dmp
memory/3180-131-0x0000000003000000-0x0000000003011000-memory.dmp
memory/3180-125-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3180-128-0x00000000012F0000-0x0000000001610000-memory.dmp
memory/3180-129-0x0000000001720000-0x0000000001731000-memory.dmp