Analysis
-
max time kernel
150s -
max time network
163s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
27-07-2021 16:04
General
-
Target
Order-CNS Amura Precision Co., Ltd 9A210118KR.exe
-
Size
252KB
-
MD5
f02f2961032796a25c7e090bb4f70566
-
SHA1
8c530a1533800db7d8dea165ea93421e2c996dad
-
SHA256
7a34064785bd677a927fa90988d9001aed285762f230d0fe08db7b2ca89ce987
-
SHA512
92df5ef56be6a6f5eeaeeb9b11559ca0a2960de9e7e0ba3a24308d603fa7be3375e41f7a618b6d02a4d7739b3ac75ba91203bf2ecfe963689539bc05dcdb0507
Malware Config
Extracted
xloader
2.3
http://www.skelligsseasafari.com/dzqd/
weekendsday.com
kansasfriedchiken.com
bestselfdrive.com
timeleveragechallenge.com
theunboxiblenation.net
adriaeurope-group.com
acrylicphotobloc.com
theincentivized.com
histreetbutler.com
kumamkt.com
cutepuppyspot.store
crisp-ui.com
easyecotour.com
longshotloungeenglewood.com
esotericclothingco.com
henglai58.com
handmadecircles.com
k9itsrk940aeq6.xyz
service-it-net.com
rt-p-c-14h9-1elk-jpzs.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 6 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order-CNS Amura Precision Co., Ltd 9A210118KR.exe"C:\Users\Admin\AppData\Local\Temp\Order-CNS Amura Precision Co., Ltd 9A210118KR.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order-CNS Amura Precision Co., Ltd 9A210118KR.exe"C:\Users\Admin\AppData\Local\Temp\Order-CNS Amura Precision Co., Ltd 9A210118KR.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order-CNS Amura Precision Co., Ltd 9A210118KR.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1236-125-0x0000000000000000-mapping.dmp
-
memory/1296-117-0x0000000000A60000-0x0000000000D80000-memory.dmpFilesize
3.1MB
-
memory/1296-114-0x000000000041D100-mapping.dmp
-
memory/1296-118-0x0000000000510000-0x000000000065A000-memory.dmpFilesize
1.3MB
-
memory/1296-116-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2476-120-0x0000000000000000-mapping.dmp
-
memory/2476-123-0x0000000000E10000-0x0000000000E22000-memory.dmpFilesize
72KB
-
memory/2476-124-0x0000000000670000-0x0000000000699000-memory.dmpFilesize
164KB
-
memory/2476-126-0x0000000004560000-0x0000000004880000-memory.dmpFilesize
3.1MB
-
memory/2476-127-0x0000000004330000-0x00000000043BF000-memory.dmpFilesize
572KB
-
memory/2756-119-0x0000000004C50000-0x0000000004D6F000-memory.dmpFilesize
1.1MB
-
memory/2756-128-0x0000000004D70000-0x0000000004E33000-memory.dmpFilesize
780KB
-
memory/3540-115-0x00000000004F0000-0x00000000004F2000-memory.dmpFilesize
8KB