Analysis
- max time kernel
150s - max time network
157s - platform
windows10_x64 - resource
win10v20210408 - submitted
27/07/2021, 13:13
General
- Target Payment_invoice.exe
- Size 638KB
- Sample210727-prwql9j77a
- SHA256 08893f139b09f2dc17635f17baf1f34d2fdf730ea44a41ba54b914ffc024f0c9
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.illoftapartments.com/uecu/
-
ishtarhotel.com
-
woodstrends.icu
-
jalenowens.com
-
manno.expert
-
ssg1asia.com
-
telepathylaw.com
-
quickoprintnv.com
-
abrosnm3.com
-
lumberjackcatering.com
-
beachujamaica.com
-
thomasjeffersonbyrd.com
-
starryfinds.com
-
shelavish2.com
-
royalglamempirellc.com
-
deixandomeuemprego.com
-
alexgoestech.xyz
-
opticamn.com
-
fermanchevybrandon.com
-
milbodegas.info
-
adunarsrl.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment_invoice.exe"C:\Users\Admin\AppData\Local\Temp\Payment_invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/740-114-0x00000000008E0000-0x00000000008E1000-memory.dmp
memory/740-116-0x0000000005610000-0x0000000005611000-memory.dmp
memory/740-117-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/740-118-0x0000000005340000-0x0000000005341000-memory.dmp
memory/740-119-0x0000000005110000-0x000000000560E000-memory.dmp
memory/740-120-0x00000000086F0000-0x00000000086F2000-memory.dmp
memory/740-121-0x0000000008830000-0x0000000008831000-memory.dmp
memory/740-122-0x0000000006CE0000-0x0000000006D62000-memory.dmp
memory/740-123-0x0000000006C10000-0x0000000006C41000-memory.dmp
memory/936-124-0x0000000000400000-0x0000000000428000-memory.dmp
memory/936-127-0x0000000000FD0000-0x0000000000FE0000-memory.dmp
memory/936-126-0x00000000014F0000-0x0000000001810000-memory.dmp
memory/2536-128-0x0000000002720000-0x00000000027DA000-memory.dmp
memory/2536-135-0x0000000005E10000-0x0000000005F3E000-memory.dmp
memory/2820-131-0x0000000000DD0000-0x0000000000DF8000-memory.dmp
memory/2820-132-0x0000000004FC0000-0x00000000052E0000-memory.dmp
memory/2820-130-0x00000000013A0000-0x00000000013B9000-memory.dmp
memory/2820-134-0x0000000004DA0000-0x0000000004E2F000-memory.dmp