Analysis
- max time kernel
150s - max time network
159s - platform
windows10_x64 - resource
win10v20210408 - submitted
19/08/2021, 09:29
General
- Target PO#4500484210.exe
- Size 707KB
- Sample210819-pmly96l91a
- SHA256 c6851d4bfcc3b1845ed1ca30aec2c03e658b94cbba0a6d5e398c9da9b6b461a2
Malware Config
Extracted
-
xloader
-
2.3
-
n58i
-
http://www.mack3sleeve.com/n58i/
-
nl-cafe.com
-
votetedjaleta.com
-
britrobertsrealtor.com
-
globipark.com
-
citysucces.com
-
verisignwebsite-verified.com
-
riddlepc.com
-
rosecityclimbing.com
-
oleandrinextract.com
-
salmankonstruksi.com
-
needhamchannel.com
-
refreshx2z.com
-
youth66.com
-
pla-russia.com
-
halloweenmaskpro.com
-
exdysis.com
-
1gcz.com
-
lookgoodman.com
-
rlxagva.com
-
stlcityc.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 43 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO#4500484210.exe"C:\Users\Admin\AppData\Local\Temp\PO#4500484210.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2340-126-0x0000000000F60000-0x0000000001280000-memory.dmp
memory/2340-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2340-127-0x0000000000A50000-0x0000000000B9A000-memory.dmp
memory/3028-135-0x0000000002E20000-0x0000000002F17000-memory.dmp
memory/3028-128-0x0000000006AC0000-0x0000000006C65000-memory.dmp
memory/3564-134-0x0000000004B60000-0x0000000004BF0000-memory.dmp
memory/3564-133-0x0000000004EA0000-0x00000000051C0000-memory.dmp
memory/3564-131-0x00000000010E0000-0x0000000001100000-memory.dmp
memory/3564-132-0x0000000000E20000-0x0000000000E49000-memory.dmp
memory/3728-121-0x00000000051D0000-0x00000000051E1000-memory.dmp
memory/3728-117-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/3728-114-0x0000000000430000-0x0000000000431000-memory.dmp
memory/3728-116-0x00000000053F0000-0x00000000053F1000-memory.dmp
memory/3728-123-0x0000000009C70000-0x0000000009CA4000-memory.dmp
memory/3728-122-0x0000000007570000-0x0000000007611000-memory.dmp
memory/3728-120-0x0000000004E40000-0x0000000004E41000-memory.dmp
memory/3728-119-0x0000000004EF0000-0x00000000053EE000-memory.dmp
memory/3728-118-0x0000000004F90000-0x0000000004F91000-memory.dmp