Analysis
- max time kernel
149s - max time network
184s - platform
windows7_x64 - resource
win7v20210410 - submitted
27/08/2021, 03:17
General
- Target SOA.exe
- Size 1.1MB
- Sample210827-9pgvdex2w6
- SHA256 db33772c98a3b201320bf4b88830aa7ec9e2c85797cf4460ab67f8d4d93964f4
Malware Config
Extracted
-
xloader
-
2.3
-
bp39
-
http://www.piadineriae45.com/bp39/
-
glembos.com
-
adjud.net
-
beautifyoils.com
-
chilewiki.com
-
duxingzi.com
-
happygromedia.com
-
restpostenboerse.com
-
vowsweddingofficiants.com
-
ladingjiwa.xyz
-
keepmakingefforts-001.com
-
yeniao.net
-
eyildirmaz.com
-
sayanghae.com
-
promoteboost.com
-
lzft.net
-
proudindiacompany.com
-
birchwoodmeridianlink.com
-
mesinionisasi.com
-
wwwrigalinks.com
-
wewearthepants.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SOA.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/576-77-0x0000000001E20000-0x0000000001EB0000-memory.dmp
memory/576-76-0x00000000768B1000-0x00000000768B3000-memory.dmp
memory/576-75-0x0000000001FB0000-0x00000000022B3000-memory.dmp
memory/576-74-0x0000000000090000-0x00000000000B9000-memory.dmp
memory/576-73-0x0000000000A10000-0x0000000000A1B000-memory.dmp
memory/760-68-0x0000000000840000-0x0000000000B43000-memory.dmp
memory/760-69-0x0000000000160000-0x0000000000171000-memory.dmp
memory/760-66-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1256-70-0x00000000067A0000-0x00000000068CC000-memory.dmp
memory/1256-78-0x0000000006DB0000-0x0000000006F1A000-memory.dmp
memory/1668-60-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
memory/1668-65-0x0000000005120000-0x000000000517D000-memory.dmp
memory/1668-64-0x0000000005EA0000-0x0000000005F2D000-memory.dmp
memory/1668-63-0x00000000002D0000-0x00000000002E6000-memory.dmp
memory/1668-62-0x0000000004DB0000-0x0000000004DB1000-memory.dmp