Analysis
- max time kernel
39s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/08/2021, 18:32
General
- Target ad0e083604e877c46c305244b2b4db33.exe
- Size 557KB
- Sample210805-d3fdb6skta
- SHA256 7f3487008181899cb240230130ea395a1b4a925a0fcd216dfdced242e5495deb
Malware Config
Extracted
-
xloader
-
2.3
-
att3
-
http://www.travelscappadocia.com/att3/
-
oakbridgefundservices.com
-
fancyforts.com
-
coisadoce.com
-
learnfrommymentor.com
-
digitalgurughana.com
-
phk0.com
-
jantiprojeekspertiz.com
-
xiabyhuc.com
-
todayonly8.info
-
pgzapgmn.icu
-
sistemasarafranco.com
-
nest-estudio.com
-
2259.xyz
-
kenobi.tech
-
mortgageloansbyjeff.com
-
thameensa.com
-
navigators.digital
-
ecocleanmalta.com
-
advancedrecyclinginc.com
-
pmotriz.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad0e083604e877c46c305244b2b4db33.exe"C:\Users\Admin\AppData\Local\Temp\ad0e083604e877c46c305244b2b4db33.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exe"PowerShell" copy-item 'C:\Users\Admin\AppData\Local\Temp\ad0e083604e877c46c305244b2b4db33.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sysups.exe'2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\ad0e083604e877c46c305244b2b4db33.exe"C:\Users\Admin\AppData\Local\Temp\ad0e083604e877c46c305244b2b4db33.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/396-125-0x0000000004CF0000-0x0000000004D05000-memory.dmp
memory/396-116-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/396-132-0x0000000004FE0000-0x00000000054DE000-memory.dmp
memory/396-118-0x00000000054E0000-0x00000000054E1000-memory.dmp
memory/396-131-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/396-114-0x00000000002F0000-0x00000000002F1000-memory.dmp
memory/948-129-0x00000000074B0000-0x00000000074B1000-memory.dmp
memory/948-124-0x0000000004782000-0x0000000004783000-memory.dmp
memory/948-147-0x0000000004783000-0x0000000004784000-memory.dmp
memory/948-144-0x0000000009010000-0x0000000009011000-memory.dmp
memory/948-128-0x0000000007410000-0x0000000007411000-memory.dmp
memory/948-122-0x00000000075B0000-0x00000000075B1000-memory.dmp
memory/948-130-0x0000000007440000-0x0000000007441000-memory.dmp
memory/948-121-0x00000000047D0000-0x00000000047D1000-memory.dmp
memory/948-123-0x0000000004780000-0x0000000004781000-memory.dmp
memory/948-133-0x0000000007BE0000-0x0000000007BE1000-memory.dmp
memory/948-143-0x0000000008FC0000-0x0000000008FC1000-memory.dmp
memory/948-135-0x00000000072B0000-0x00000000072B1000-memory.dmp
memory/948-136-0x00000000084D0000-0x00000000084D1000-memory.dmp
memory/948-137-0x0000000008270000-0x0000000008271000-memory.dmp
memory/948-142-0x0000000009250000-0x0000000009251000-memory.dmp
memory/3176-134-0x0000000001350000-0x0000000001670000-memory.dmp
memory/3176-126-0x0000000000400000-0x0000000000429000-memory.dmp