Analysis
- max time kernel
151s - max time network
146s - platform
windows10_x64 - resource
win10v20210408 - submitted
31/08/2021, 02:28
General
- Target Order sheet 31082021.exe
- Size 728KB
- Sample210831-j5ysf8stee
- SHA256 1b4d3e69b4e2e533522d48f27a0137e34b92b01e36d348c12f0df4371ed7d573
Malware Config
Extracted
-
xloader
-
2.3
-
p4se
-
http://www.appackersandmoversbengaluru.com/p4se/
-
weightlossforprofessionals.com
-
talkotstopandshop.com
-
everesttechsolutions.com
-
garboarts.com
-
esubastas-online.com
-
electriclastmile.com
-
tomio.tech
-
jacoty.com
-
knot-tied-up.com
-
energychoicesim.com
-
rocketcompaniessham.com
-
madarasapattinam.com
-
promosplace.com
-
newstarchurch.com
-
thesaleskitchen.com
-
slingmodeinc.com
-
jobresulthub.com
-
pillclk.com
-
shipu119.com
-
sibalcar.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order sheet 31082021.exe"C:\Users\Admin\AppData\Local\Temp\Order sheet 31082021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Order sheet 31082021.exe"C:\Users\Admin\AppData\Local\Temp\Order sheet 31082021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Order sheet 31082021.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/652-116-0x0000000004D90000-0x0000000004D91000-memory.dmp
memory/652-117-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/652-118-0x0000000004E90000-0x0000000004EA6000-memory.dmp
memory/652-119-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/652-120-0x0000000005060000-0x0000000005061000-memory.dmp
memory/652-121-0x0000000005BE0000-0x0000000005C45000-memory.dmp
memory/652-122-0x0000000008150000-0x0000000008181000-memory.dmp
memory/652-114-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/2724-127-0x0000000006EF0000-0x0000000006FD2000-memory.dmp
memory/2724-134-0x0000000005310000-0x0000000005418000-memory.dmp
memory/3292-130-0x0000000003180000-0x00000000031A9000-memory.dmp
memory/3292-129-0x0000000000110000-0x0000000000169000-memory.dmp
memory/3292-131-0x00000000031B0000-0x00000000032FA000-memory.dmp
memory/3292-133-0x00000000037E0000-0x000000000386F000-memory.dmp
memory/3488-125-0x0000000000FC0000-0x00000000012E0000-memory.dmp
memory/3488-126-0x0000000000F80000-0x0000000000F90000-memory.dmp
memory/3488-123-0x0000000000400000-0x0000000000429000-memory.dmp