Analysis
- max time kernel
150s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
22/07/2021, 13:03
General
- Target PI-0387991.exe
- Size 878KB
- Sample210722-sqsjaj76sa
- SHA256 8cd1a5c6360cc1c0e513d4cc39f649bcb33b61c47c4b498b992ea8e9a41a48cd
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.bodymoisturizer.online/q4kr/
-
realmodapk.com
-
hanoharuka.com
-
shivalikspiritualproducts.com
-
womenshealthclinincagra.com
-
racketpark.com
-
startuporig.com
-
azkachinas.com
-
klanblog.com
-
linuxradio.tools
-
siteoficial-liquida.com
-
glsbuyer.com
-
bestdeez.com
-
teens2cash.com
-
valleyviewconstruct.com
-
myfortniteskins.com
-
cambecare.com
-
csec2011.com
-
idookap.com
-
warmwallsrecords.com
-
smartmirror.one
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 47 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PI-0387991.exe"C:\Users\Admin\AppData\Local\Temp\PI-0387991.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/632-121-0x0000000006390000-0x0000000006392000-memory.dmp
memory/632-116-0x00000000051E0000-0x0000000005235000-memory.dmp
memory/632-117-0x0000000009C20000-0x0000000009C21000-memory.dmp
memory/632-118-0x0000000005440000-0x0000000005441000-memory.dmp
memory/632-119-0x0000000005290000-0x0000000005291000-memory.dmp
memory/632-120-0x0000000005250000-0x0000000005251000-memory.dmp
memory/632-122-0x00000000077C0000-0x00000000077C1000-memory.dmp
memory/632-123-0x0000000005870000-0x00000000058E6000-memory.dmp
memory/632-124-0x00000000057E0000-0x000000000580A000-memory.dmp
memory/632-114-0x0000000000920000-0x0000000000921000-memory.dmp
memory/2428-129-0x0000000002480000-0x0000000002544000-memory.dmp
memory/2428-136-0x00000000049F0000-0x0000000004B0A000-memory.dmp
memory/2692-125-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2692-128-0x00000000013A0000-0x00000000013B0000-memory.dmp
memory/2692-127-0x00000000017C0000-0x0000000001AE0000-memory.dmp
memory/3244-132-0x0000000004EF0000-0x0000000005210000-memory.dmp
memory/3244-131-0x0000000000B40000-0x0000000000B53000-memory.dmp
memory/3244-133-0x0000000002D10000-0x0000000002D39000-memory.dmp
memory/3244-135-0x0000000004BB0000-0x0000000004C3F000-memory.dmp