Analysis
- max time kernel
149s - max time network
196s - platform
windows7_x64 - resource
win7v20210408 - submitted
12/08/2021, 07:02
General
- Target Pending DHL Shipment Notification REF 81121.exe
- Size 677KB
- Sample210812-2f8mcd58te
- SHA256 435b924af18dce67e3fbc2b55fc515b839fe883da2e10fd3c8c21859a1181d64
Malware Config
Extracted
-
xloader
-
2.3
-
ssee
-
http://www.idt-metrofireandsecurity.com/ssee/
-
portalcanaa.com
-
korzino.com
-
dlylms.net
-
smartearphoneshop.com
-
olimiloshop.com
-
auvdigitalstack.com
-
ydxc.chat
-
yhk868.com
-
lifeinthedport.com
-
self-sciencelabs.com
-
scandicpack.com
-
hold-sometimes.xyz
-
beiputei.com
-
yourrealtorcoach.com
-
rxods.com
-
fundsoption.com
-
ahlstromclothes.com
-
ksdieselparts.com
-
accountmangerford.com
-
kuwaitlogistic.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Pending DHL Shipment Notification REF 81121.exe"C:\Users\Admin\AppData\Local\Temp\Pending DHL Shipment Notification REF 81121.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Pending DHL Shipment Notification REF 81121.exe"C:\Users\Admin\AppData\Local\Temp\Pending DHL Shipment Notification REF 81121.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Pending DHL Shipment Notification REF 81121.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/576-77-0x0000000075AA1000-0x0000000075AA3000-memory.dmp
memory/576-75-0x0000000000970000-0x0000000000A00000-memory.dmp
memory/576-74-0x0000000001FE0000-0x00000000022E3000-memory.dmp
memory/576-72-0x00000000000D0000-0x00000000000F9000-memory.dmp
memory/576-71-0x0000000000BC0000-0x0000000000BDA000-memory.dmp
memory/1076-64-0x0000000004220000-0x000000000424A000-memory.dmp
memory/1076-59-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
memory/1076-63-0x00000000057B0000-0x0000000005847000-memory.dmp
memory/1076-62-0x00000000004E0000-0x00000000004F1000-memory.dmp
memory/1076-61-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/1268-69-0x0000000004270000-0x0000000004331000-memory.dmp
memory/1268-76-0x00000000061B0000-0x00000000062CA000-memory.dmp
memory/1484-68-0x0000000000260000-0x0000000000271000-memory.dmp
memory/1484-67-0x0000000000CF0000-0x0000000000FF3000-memory.dmp
memory/1484-65-0x0000000000400000-0x0000000000429000-memory.dmp