Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20210410 - submitted
16/08/2021, 17:28
General
- Target DHL Shipment doc.exe
- Size 575KB
- Sample210816-j5z26js4e2
- SHA256 ba852a2b1acc3b7c2bb98e6acbe41948de4e8046bbf6c3a874d7462f23d19f1e
Malware Config
Extracted
-
xloader
-
2.3
-
cre4
-
http://www.shiveringcactus.net/cre4/
-
namirani.com
-
winnerscircleapparel.com
-
blackgoldranchoutfitters.com
-
absintheshopping.com
-
billionairetaste.com
-
weida15.com
-
clubsibaritas.com
-
bitmonarch.com
-
xo-car.com
-
terreo.info
-
anymore.one
-
sundarbanstore.com
-
blueshoediaries.com
-
fastloansflorida.com
-
streamzone300.xyz
-
mspxzx.com
-
dailydefileader.com
-
wildblissboutique.com
-
museumsalive.com
-
theeverscholar.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment doc.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment doc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DHL Shipment doc.exe"C:\Users\Admin\AppData\Local\Temp\DHL Shipment doc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DHL Shipment doc.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2740-122-0x0000000002D60000-0x0000000002D71000-memory.dmp
memory/2740-118-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2740-119-0x0000000003030000-0x0000000003350000-memory.dmp
memory/2740-120-0x0000000002D00000-0x0000000002D11000-memory.dmp
memory/2764-123-0x0000000004CF0000-0x0000000004E6F000-memory.dmp
memory/2764-121-0x0000000005D00000-0x0000000005DF7000-memory.dmp
memory/2764-130-0x0000000004E70000-0x0000000004F4F000-memory.dmp
memory/3736-126-0x00000000003C0000-0x00000000003E9000-memory.dmp
memory/3736-125-0x0000000000FD0000-0x0000000001143000-memory.dmp
memory/3736-128-0x00000000048D0000-0x0000000004BF0000-memory.dmp
memory/3736-129-0x00000000045E0000-0x0000000004670000-memory.dmp
memory/4044-117-0x0000000002890000-0x000000000293E000-memory.dmp