Analysis
- max time kernel
150s - max time network
152s - platform
windows7_x64 - resource
win7v20210410 - submitted
03/07/2021, 06:12
General
- Target Inv.Copy-Amended.exe
- Size 564KB
- Sample210703-vm1sl6f4v6
- SHA256 9d404915e1094a0bc1db1256b1c39c2d76589fec00700e2a9874f2822a429ba8
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.bknmarket.com/c7jh/
-
frealz.com
-
janggipay.com
-
k12paymentceter.com
-
garnishclub.com
-
5975199.com
-
xyzenix.com
-
khspt.com
-
tccollection.net
-
electricscooter.parts
-
ouhongda.com
-
soltosoul.love
-
lentspace.com
-
mimik33.info
-
five-minute-diary.com
-
stanleyguzman.com
-
davidhidalgo.info
-
bfcalc.com
-
app-leadpulse.com
-
yogaforhumans.com
-
eaglerockinvest.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Blocklisted process makes network request 2 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inv.Copy-Amended.exe"C:\Users\Admin\AppData\Local\Temp\Inv.Copy-Amended.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inv.Copy-Amended.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inv.Copy-Amended.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/268-73-0x0000000001E90000-0x0000000002193000-memory.dmp
memory/268-74-0x0000000001D40000-0x0000000001DCF000-memory.dmp
memory/268-71-0x0000000000510000-0x0000000000528000-memory.dmp
memory/268-72-0x00000000000F0000-0x0000000000118000-memory.dmp
memory/1208-60-0x0000000000B60000-0x0000000000B61000-memory.dmp
memory/1208-59-0x0000000075561000-0x0000000075563000-memory.dmp
memory/1208-63-0x0000000000B61000-0x0000000000B62000-memory.dmp
memory/1256-75-0x0000000006150000-0x00000000062AC000-memory.dmp
memory/1256-67-0x0000000007580000-0x0000000007716000-memory.dmp
memory/1708-66-0x0000000000160000-0x0000000000170000-memory.dmp
memory/1708-65-0x0000000000D30000-0x0000000001033000-memory.dmp
memory/1708-61-0x0000000000400000-0x0000000000428000-memory.dmp