Analysis
- max time kernel
150s - max time network
142s - platform
windows10_x64 - resource
win10-en - submitted
02/09/2021, 11:24
General
- Target Quotation#QO210109A87356.exe
- Size 688KB
- Sample210902-eqrq4esyms
- SHA256 fdd78bbf6d05b69fbdcaa24727822f1ec7e9b652266ac34ed69916537e6aeff2
Malware Config
Extracted
-
xloader
-
2.3
-
ssee
-
http://www.idt-metrofireandsecurity.com/ssee/
-
portalcanaa.com
-
korzino.com
-
dlylms.net
-
smartearphoneshop.com
-
olimiloshop.com
-
auvdigitalstack.com
-
ydxc.chat
-
yhk868.com
-
lifeinthedport.com
-
self-sciencelabs.com
-
scandicpack.com
-
hold-sometimes.xyz
-
beiputei.com
-
yourrealtorcoach.com
-
rxods.com
-
fundsoption.com
-
ahlstromclothes.com
-
ksdieselparts.com
-
accountmangerford.com
-
kuwaitlogistic.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation#QO210109A87356.exe"C:\Users\Admin\AppData\Local\Temp\Quotation#QO210109A87356.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Quotation#QO210109A87356.exe"C:\Users\Admin\AppData\Local\Temp\Quotation#QO210109A87356.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Quotation#QO210109A87356.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2140-135-0x0000000004EB0000-0x0000000004F40000-memory.dmp
memory/2140-134-0x0000000005130000-0x0000000005450000-memory.dmp
memory/2140-132-0x0000000001310000-0x0000000001330000-memory.dmp
memory/2140-133-0x00000000010F0000-0x0000000001119000-memory.dmp
memory/2372-129-0x0000000006310000-0x000000000646F000-memory.dmp
memory/2372-136-0x0000000006470000-0x00000000065CE000-memory.dmp
memory/4032-121-0x0000000005A30000-0x0000000005A46000-memory.dmp
memory/4032-124-0x000000000A2D0000-0x000000000A2FA000-memory.dmp
memory/4032-123-0x0000000007B60000-0x0000000007BBF000-memory.dmp
memory/4032-122-0x0000000007C00000-0x0000000007C01000-memory.dmp
memory/4032-115-0x0000000000F10000-0x0000000000F11000-memory.dmp
memory/4032-120-0x0000000003390000-0x0000000003391000-memory.dmp
memory/4032-119-0x0000000005820000-0x0000000005821000-memory.dmp
memory/4032-118-0x00000000058A0000-0x00000000058A1000-memory.dmp
memory/4032-117-0x0000000005D00000-0x0000000005D01000-memory.dmp
memory/4088-125-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4088-128-0x0000000000FB0000-0x0000000000FC1000-memory.dmp
memory/4088-127-0x0000000001440000-0x0000000001760000-memory.dmp