Analysis
- max time kernel
151s - max time network
152s - platform
windows7_x64 - resource
win7v20210410 - submitted
17/08/2021, 11:30
General
- Target RFQ, Scope of Requirements PDF.exe
- Size 949KB
- Sample210817-eec4c5bryn
- SHA256 9744a8f624cc86bce830db5caf4a5a8b2263b51f53ca384908b2557e5f9ce99d
Malware Config
Extracted
-
xloader
-
2.3
-
ssee
-
http://www.idt-metrofireandsecurity.com/ssee/
-
portalcanaa.com
-
korzino.com
-
dlylms.net
-
smartearphoneshop.com
-
olimiloshop.com
-
auvdigitalstack.com
-
ydxc.chat
-
yhk868.com
-
lifeinthedport.com
-
self-sciencelabs.com
-
scandicpack.com
-
hold-sometimes.xyz
-
beiputei.com
-
yourrealtorcoach.com
-
rxods.com
-
fundsoption.com
-
ahlstromclothes.com
-
ksdieselparts.com
-
accountmangerford.com
-
kuwaitlogistic.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ, Scope of Requirements PDF.exe"C:\Users\Admin\AppData\Local\Temp\RFQ, Scope of Requirements PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RFQ, Scope of Requirements PDF.exe"C:\Users\Admin\AppData\Local\Temp\RFQ, Scope of Requirements PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\RFQ, Scope of Requirements PDF.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/960-78-0x00000000765F1000-0x00000000765F3000-memory.dmp
memory/960-76-0x0000000001E00000-0x0000000001E90000-memory.dmp
memory/960-75-0x0000000001F80000-0x0000000002283000-memory.dmp
memory/960-74-0x00000000000D0000-0x00000000000F9000-memory.dmp
memory/960-73-0x0000000000460000-0x0000000000476000-memory.dmp
memory/1256-70-0x0000000005080000-0x0000000005179000-memory.dmp
memory/1256-77-0x0000000007180000-0x00000000072B3000-memory.dmp
memory/1932-68-0x00000000009E0000-0x0000000000CE3000-memory.dmp
memory/1932-69-0x00000000001C0000-0x00000000001D1000-memory.dmp
memory/1932-66-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2000-60-0x0000000000EF0000-0x0000000000EF1000-memory.dmp
memory/2000-65-0x0000000000A10000-0x0000000000A3A000-memory.dmp
memory/2000-64-0x0000000005F80000-0x0000000006018000-memory.dmp
memory/2000-63-0x0000000000220000-0x0000000000231000-memory.dmp
memory/2000-62-0x0000000000320000-0x0000000000321000-memory.dmp