Analysis
- max time kernel
154s - max time network
158s - platform
windows7_x64 - resource
win7v20210410 - submitted
17/08/2021, 14:07
General
- Target Payment Confirmation.exe
- Size 945KB
- Sample210817-dpgfl3acys
- SHA256 52b0438a43977e210e58786f139697a9007854f624d8901c891a9af69b87667f
Malware Config
Extracted
-
xloader
-
2.3
-
earz
-
http://www.furnitureizmir.com/earz/
-
halacoupon.com
-
anthos-labs.com
-
hagertylabs.net
-
l1992.com
-
856379580.xyz
-
rcbb-technologies.com
-
realhoggapparel.com
-
sauceprince.com
-
tootingcab.com
-
4chase5.com
-
ordergogibibimbap.com
-
nyj.xyz
-
dermixspa.com
-
premiergiftingco.com
-
razorcentric.com
-
mbrealtyadvisors.com
-
officialjazz.club
-
cctv006.com
-
hbcuatthepolls.info
-
prestamos-ya.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe"C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe"C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/436-76-0x0000000000B40000-0x0000000000BCF000-memory.dmp
memory/436-74-0x00000000021E0000-0x00000000024E3000-memory.dmp
memory/436-72-0x0000000000DD0000-0x0000000000DD9000-memory.dmp
memory/436-73-0x0000000000080000-0x00000000000A8000-memory.dmp
memory/1060-68-0x0000000000700000-0x0000000000A03000-memory.dmp
memory/1060-69-0x00000000000B0000-0x00000000000C0000-memory.dmp
memory/1060-66-0x0000000000400000-0x0000000000428000-memory.dmp
memory/1224-70-0x0000000004190000-0x0000000004242000-memory.dmp
memory/1224-77-0x0000000007D00000-0x0000000007E8C000-memory.dmp
memory/1856-60-0x0000000000F00000-0x0000000000F01000-memory.dmp
memory/1856-65-0x0000000000BB0000-0x0000000000BDA000-memory.dmp
memory/1856-64-0x0000000005E90000-0x0000000005F24000-memory.dmp
memory/1856-63-0x0000000000910000-0x0000000000921000-memory.dmp
memory/1856-62-0x0000000004DA0000-0x0000000004DA1000-memory.dmp