Analysis
- max time kernel
53s - max time network
121s - platform
windows10_x64 - resource
win10v20210408 - submitted
16/08/2021, 22:02
General
- Target fc610878793ee9ee26ed44da1549f4f8.exe
- Size 1.1MB
- Sample210816-lpg3fc7ehj
- SHA256 5c8d039da52a39b80531b80b28e53060c2bfefb747ef5477d100bb3c819c089b
Malware Config
Extracted
-
xloader
-
2.3
-
wufn
-
http://www.gaigoilaocai.com/wufn/
-
rsautoluxe.com
-
theroseofsharonsalon.com
-
singnema.com
-
nathanielwhite108.com
-
theforumonline.com
-
iqpt.info
-
joneshondaservice.com
-
fafene.com
-
solanohomebuyerclass.com
-
zwq.xyz
-
searchlakeconroehomes.com
-
briative.com
-
frystmor.city
-
systemofyouth.com
-
sctsmney.com
-
tv-safetrading.com
-
thesweetboy.com
-
occulusblu.com
-
pawsthemomentpetphotography.com
-
travelstipsguide.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc610878793ee9ee26ed44da1549f4f8.exe"C:\Users\Admin\AppData\Local\Temp\fc610878793ee9ee26ed44da1549f4f8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fc610878793ee9ee26ed44da1549f4f8.exe"C:\Users\Admin\AppData\Local\Temp\fc610878793ee9ee26ed44da1549f4f8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/992-114-0x0000000000090000-0x0000000000091000-memory.dmp
memory/992-116-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/992-117-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/992-118-0x0000000004B00000-0x0000000004B01000-memory.dmp
memory/992-119-0x0000000004A60000-0x0000000004F5E000-memory.dmp
memory/992-120-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/992-121-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/992-122-0x00000000081C0000-0x00000000081D1000-memory.dmp
memory/992-123-0x00000000082B0000-0x0000000008347000-memory.dmp
memory/992-124-0x000000000AA80000-0x000000000AAAA000-memory.dmp
memory/2836-125-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2836-127-0x0000000001BE0000-0x0000000001F00000-memory.dmp