Analysis
- max time kernel
150s - max time network
156s - platform
windows10_x64 - resource
win10v20210410 - submitted
04/08/2021, 05:56
General
- Target DHL Shipment Notification REF 8032021.Pdf.exe
- Size 1.3MB
- Sample210804-bmalbkg5ex
- SHA256 3ba94c54291623972d2c5e31bd34f3e5fbdd9416f2b34e7daeaf2e4fcb96506b
Malware Config
Extracted
-
xloader
-
2.3
-
http://www.maidenmade.com/gno4/
-
callsecuritymusic.com
-
quikngo.com
-
gardenofbabyclothes.com
-
bailbondinculvercity.com
-
nqyaurlz.icu
-
sultanulhind.com
-
toddy-bodies.com
-
kom-hunter.com
-
theradibio.com
-
pageonefourplay.info
-
wildlifetools.com
-
nobleegoist.com
-
girlsjerkoff.com
-
theenlows.com
-
jyqcxl.com
-
southernbluebee.com
-
betfootballthaigold.com
-
remaxaffinityplus.net
-
teamlunsford.com
-
howtoberealonline.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification REF 8032021.Pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification REF 8032021.Pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification REF 8032021.Pdf.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification REF 8032021.Pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL Shipment Notification REF 8032021.Pdf.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2116-128-0x0000000003010000-0x0000000003108000-memory.dmp
memory/2116-135-0x0000000005680000-0x0000000005744000-memory.dmp
memory/2708-134-0x00000000049C0000-0x0000000004A4F000-memory.dmp
memory/2708-132-0x0000000002DC0000-0x0000000002DE9000-memory.dmp
memory/2708-130-0x00000000003C0000-0x00000000007FF000-memory.dmp
memory/2708-131-0x0000000004DB0000-0x00000000050D0000-memory.dmp
memory/3904-120-0x0000000005890000-0x0000000005D8E000-memory.dmp
memory/3904-123-0x00000000052E0000-0x000000000530C000-memory.dmp
memory/3904-122-0x0000000007E60000-0x0000000007EF7000-memory.dmp
memory/3904-121-0x0000000005C80000-0x0000000005C8D000-memory.dmp
memory/3904-114-0x0000000000E90000-0x0000000000E91000-memory.dmp
memory/3904-119-0x0000000006290000-0x0000000006291000-memory.dmp
memory/3904-118-0x0000000005990000-0x0000000005991000-memory.dmp
memory/3904-117-0x0000000005890000-0x0000000005891000-memory.dmp
memory/3904-116-0x0000000005D90000-0x0000000005D91000-memory.dmp
memory/4088-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4088-127-0x00000000012B0000-0x00000000012C0000-memory.dmp
memory/4088-126-0x00000000012D0000-0x00000000015F0000-memory.dmp