Analysis
- max time kernel
151s - max time network
151s - platform
windows10_x64 - resource
win10v20210408 - submitted
27/08/2021, 03:17
General
- Target SOA.exe
- Size 1.1MB
- Sample210827-9pgvdex2w6
- SHA256 db33772c98a3b201320bf4b88830aa7ec9e2c85797cf4460ab67f8d4d93964f4
Malware Config
Extracted
-
xloader
-
2.3
-
bp39
-
http://www.piadineriae45.com/bp39/
-
glembos.com
-
adjud.net
-
beautifyoils.com
-
chilewiki.com
-
duxingzi.com
-
happygromedia.com
-
restpostenboerse.com
-
vowsweddingofficiants.com
-
ladingjiwa.xyz
-
keepmakingefforts-001.com
-
yeniao.net
-
eyildirmaz.com
-
sayanghae.com
-
promoteboost.com
-
lzft.net
-
proudindiacompany.com
-
birchwoodmeridianlink.com
-
mesinionisasi.com
-
wwwrigalinks.com
-
wewearthepants.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA.exe"C:\Users\Admin\AppData\Local\Temp\SOA.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SOA.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/804-114-0x0000000000940000-0x0000000000941000-memory.dmp
memory/804-116-0x00000000058A0000-0x00000000058A1000-memory.dmp
memory/804-117-0x0000000005440000-0x0000000005441000-memory.dmp
memory/804-118-0x00000000053A0000-0x000000000589E000-memory.dmp
memory/804-119-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/804-120-0x0000000005800000-0x0000000005816000-memory.dmp
memory/804-121-0x000000000B130000-0x000000000B131000-memory.dmp
memory/804-122-0x000000000B090000-0x000000000B11D000-memory.dmp
memory/804-123-0x0000000008A50000-0x0000000008AAD000-memory.dmp
memory/2616-127-0x0000000001880000-0x0000000001891000-memory.dmp
memory/2616-126-0x0000000001440000-0x0000000001760000-memory.dmp
memory/2616-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3044-128-0x0000000007120000-0x00000000071D5000-memory.dmp
memory/3044-137-0x00000000066B0000-0x00000000067CF000-memory.dmp
memory/3332-133-0x00000000001A0000-0x00000000001C9000-memory.dmp
memory/3332-132-0x00000000003A0000-0x00000000003B2000-memory.dmp
memory/3332-135-0x00000000043B0000-0x00000000046D0000-memory.dmp
memory/3332-136-0x0000000004190000-0x0000000004220000-memory.dmp