Analysis
- max time kernel
149s - max time network
151s - platform
windows7_x64 - resource
win7v20210410 - submitted
20/07/2021, 05:43
General
- Target Signed PEARLTECH contract and PO.exe
- Size 949KB
- Sample210720-8ablnmbeh2
- SHA256 084cb2109cff42297ef1b5982900b2022ccc35210cff2231f95acc0aec4e8e36
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.cryptodeposit.info/u8aa/
-
quantexchanges.com
-
hizliarac.com
-
dropsdementanovohamburgo.com
-
tcinsurancegroup.net
-
byobvendors.com
-
arteasba.com
-
azrealtorsmastermind.com
-
voiceof5aabtv.com
-
zoom-bloopers.com
-
jxsenmei.com
-
interia-poczta.email
-
coolgiftbaskets.net
-
magetu.info
-
weedliberal.com
-
drsergiocastilloangiologo.com
-
starinsiderau.com
-
weightneutralmetflex.com
-
youxiandian.com
-
liberation.media
-
ferrari-news.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Signed PEARLTECH contract and PO.exe"C:\Users\Admin\AppData\Local\Temp\Signed PEARLTECH contract and PO.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Signed PEARLTECH contract and PO.exe"C:\Users\Admin\AppData\Local\Temp\Signed PEARLTECH contract and PO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Signed PEARLTECH contract and PO.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/308-60-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/308-62-0x00000000049B0000-0x00000000049B1000-memory.dmp
memory/308-63-0x0000000000510000-0x000000000052B000-memory.dmp
memory/308-64-0x0000000004EE0000-0x0000000004F4F000-memory.dmp
memory/308-65-0x0000000000A20000-0x0000000000A4B000-memory.dmp
memory/624-68-0x0000000000BC0000-0x0000000000EC3000-memory.dmp
memory/624-69-0x00000000001E0000-0x00000000001F0000-memory.dmp
memory/624-66-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1264-70-0x0000000004120000-0x00000000041F7000-memory.dmp
memory/1264-77-0x00000000049D0000-0x0000000004AA4000-memory.dmp
memory/1764-72-0x0000000000460000-0x0000000000467000-memory.dmp
memory/1764-74-0x0000000001FE0000-0x00000000022E3000-memory.dmp
memory/1764-73-0x0000000000100000-0x0000000000129000-memory.dmp
memory/1764-76-0x0000000001EE0000-0x0000000001F6F000-memory.dmp