Analysis
- max time kernel
41s - max time network
125s - platform
windows10_x64 - resource
win10v20210410 - submitted
04/08/2021, 14:22
General
- Target 4ebdb80a36728294c6086c4ed91605b0.exe
- Size 1.1MB
- Sample210804-6l9wp941b6
- SHA256 236348545989c7d1816067f0e7bf78c80d4782e2ac28ab6d9ddbb1a2d4f71cc4
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.mobiessence.com/6mam/
-
gxduoke.com
-
lawmetricssolicitors.com
-
e-bizbox.com
-
ilovemehoodie.com
-
marcuslafond.com
-
bransolute.com
-
kuppers.info
-
kykyryky.art
-
vavasoo.com
-
tlamj.com
-
besport24.com
-
hibachiexpressnctogo.com
-
elglink99.com
-
maximos.world
-
uniamaa.com
-
aladinfarma.com
-
opticatervisof.com
-
delhibudokankarate.com
-
juliekifyukstyle.com
-
fuzhourexian.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ebdb80a36728294c6086c4ed91605b0.exe"C:\Users\Admin\AppData\Local\Temp\4ebdb80a36728294c6086c4ed91605b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4ebdb80a36728294c6086c4ed91605b0.exe"C:\Users\Admin\AppData\Local\Temp\4ebdb80a36728294c6086c4ed91605b0.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4ebdb80a36728294c6086c4ed91605b0.exe"C:\Users\Admin\AppData\Local\Temp\4ebdb80a36728294c6086c4ed91605b0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2284-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2284-126-0x0000000001210000-0x0000000001530000-memory.dmp
memory/3896-114-0x0000000000690000-0x0000000000691000-memory.dmp
memory/3896-116-0x0000000005480000-0x0000000005481000-memory.dmp
memory/3896-117-0x0000000005020000-0x0000000005021000-memory.dmp
memory/3896-118-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/3896-119-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
memory/3896-120-0x0000000006E80000-0x0000000006E93000-memory.dmp
memory/3896-121-0x0000000004F80000-0x000000000547E000-memory.dmp
memory/3896-122-0x0000000008890000-0x0000000008927000-memory.dmp
memory/3896-123-0x00000000053B0000-0x00000000053DB000-memory.dmp