Analysis
- max time kernel
151s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
27/08/2021, 05:17
General
- Target USD INV#1191189.exe
- Size 376KB
- Sample210827-tfymwvbdta
- SHA256 b09fdc39338aacafb7eb0163757d2b9863f78e5467af017ff4ad2f09e0e266a2
Malware Config
Extracted
-
xloader
-
2.3
-
b6cu
-
http://www.xn--marketingrevolucin-61b.com/b6cu/
-
votreconseilfinancier.com
-
wholesaleplay.com
-
komfy.store
-
hsyunfan.com
-
tournamenttips.com
-
yourbusine.xyz
-
wrg-referrals.com
-
harmless-oily.com
-
whizdomtowealth.com
-
xusmods.com
-
cleanerstoday.com
-
finopscert.com
-
paerexpress.com
-
kankb.com
-
res-o.info
-
balonpantolon.com
-
freedownloadbiz.info
-
jeffegriffin.com
-
gobahis119.com
-
ourcalvinsarm.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\USD INV#1191189.exe"C:\Users\Admin\AppData\Local\Temp\USD INV#1191189.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\USD INV#1191189.exe"C:\Users\Admin\AppData\Local\Temp\USD INV#1191189.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\USD INV#1191189.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/804-116-0x0000000005610000-0x0000000005612000-memory.dmp
memory/804-114-0x0000000003380000-0x0000000003381000-memory.dmp
memory/2624-123-0x0000000000AE0000-0x0000000000AE6000-memory.dmp
memory/2624-124-0x0000000003240000-0x0000000003269000-memory.dmp
memory/2624-125-0x0000000004770000-0x0000000004A90000-memory.dmp
memory/2624-126-0x0000000004B20000-0x0000000004BAF000-memory.dmp
memory/3044-120-0x00000000066B0000-0x0000000006830000-memory.dmp
memory/3044-127-0x0000000006830000-0x0000000006931000-memory.dmp
memory/3832-117-0x0000000000DA0000-0x00000000010C0000-memory.dmp
memory/3832-118-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3832-119-0x00000000001F0000-0x0000000000200000-memory.dmp