Analysis
- max time kernel
150s - max time network
181s - platform
windows7_x64 - resource
win7v20210408 - submitted
31/08/2021, 02:28
General
- Target Order sheet 31082021.exe
- Size 728KB
- Sample210831-j5ysf8stee
- SHA256 1b4d3e69b4e2e533522d48f27a0137e34b92b01e36d348c12f0df4371ed7d573
Malware Config
Extracted
-
xloader
-
2.3
-
p4se
-
http://www.appackersandmoversbengaluru.com/p4se/
-
weightlossforprofessionals.com
-
talkotstopandshop.com
-
everesttechsolutions.com
-
garboarts.com
-
esubastas-online.com
-
electriclastmile.com
-
tomio.tech
-
jacoty.com
-
knot-tied-up.com
-
energychoicesim.com
-
rocketcompaniessham.com
-
madarasapattinam.com
-
promosplace.com
-
newstarchurch.com
-
thesaleskitchen.com
-
slingmodeinc.com
-
jobresulthub.com
-
pillclk.com
-
shipu119.com
-
sibalcar.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order sheet 31082021.exe"C:\Users\Admin\AppData\Local\Temp\Order sheet 31082021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order sheet 31082021.exe"C:\Users\Admin\AppData\Local\Temp\Order sheet 31082021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order sheet 31082021.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/564-77-0x0000000001D20000-0x0000000001DAF000-memory.dmp
memory/564-76-0x0000000001DC0000-0x00000000020C3000-memory.dmp
memory/564-75-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/564-74-0x0000000000540000-0x000000000055C000-memory.dmp
memory/564-72-0x0000000076641000-0x0000000076643000-memory.dmp
memory/764-66-0x0000000000400000-0x0000000000429000-memory.dmp
memory/764-68-0x0000000000AC0000-0x0000000000DC3000-memory.dmp
memory/764-69-0x0000000000120000-0x0000000000130000-memory.dmp
memory/1208-70-0x0000000004CF0000-0x0000000004E85000-memory.dmp
memory/1208-78-0x0000000003D40000-0x0000000003E48000-memory.dmp
memory/1648-60-0x0000000001190000-0x0000000001191000-memory.dmp
memory/1648-65-0x00000000010A0000-0x00000000010D1000-memory.dmp
memory/1648-64-0x00000000050E0000-0x0000000005145000-memory.dmp
memory/1648-63-0x0000000000510000-0x0000000000526000-memory.dmp
memory/1648-62-0x0000000004D80000-0x0000000004D81000-memory.dmp