Analysis
- max time kernel
151s - max time network
146s - platform
windows10_x64 - resource
win10v20210408 - submitted
16/09/2021, 04:41
General
- Target nAIj8iSBKtENT6y.exe
- Size 411KB
- Sample210916-fa43jscaa8
- SHA256 39c5b29df15e13a18cbc4b77a44208aa927af8851555a4d220d8af0be7aeb235
Malware Config
Extracted
-
xloader
-
2.4
-
t75f
-
http://www.438451.com/t75f/
-
ice-lemon.pro
-
ar3spro.cloud
-
9055837.com
-
fucksociety.net
-
prettyofficialx.com
-
mfxw.xyz
-
relationshipquiz.info
-
customia.xyz
-
juanayjuan.com
-
zidiankj.com
-
facture-booking.com
-
secondmining.store
-
aboutyou.club
-
gongxichen.com
-
laurabraincreative.com
-
pierrot-bros.com
-
saintpaulaccountingservices.com
-
dom-maya.com
-
garderobamarzen.net
-
la-salamandre-assurances.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nAIj8iSBKtENT6y.exe"C:\Users\Admin\AppData\Local\Temp\nAIj8iSBKtENT6y.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/496-134-0x0000000004910000-0x00000000049A0000-memory.dmp
memory/496-131-0x0000000000250000-0x0000000000270000-memory.dmp
memory/496-132-0x0000000003030000-0x0000000003059000-memory.dmp
memory/496-133-0x0000000004560000-0x0000000004880000-memory.dmp
memory/664-118-0x00000000052B0000-0x00000000057AE000-memory.dmp
memory/664-121-0x00000000099E0000-0x00000000099E1000-memory.dmp
memory/664-122-0x0000000006F60000-0x0000000006FC0000-memory.dmp
memory/664-123-0x000000000C460000-0x000000000C48B000-memory.dmp
memory/664-120-0x0000000005510000-0x0000000005517000-memory.dmp
memory/664-114-0x0000000000850000-0x0000000000851000-memory.dmp
memory/664-119-0x0000000005240000-0x0000000005241000-memory.dmp
memory/664-117-0x00000000052B0000-0x00000000052B1000-memory.dmp
memory/664-116-0x00000000057B0000-0x00000000057B1000-memory.dmp
memory/2012-127-0x00000000016E0000-0x00000000016F1000-memory.dmp
memory/2012-126-0x0000000001820000-0x0000000001B40000-memory.dmp
memory/2012-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3024-128-0x0000000005E30000-0x0000000005F6D000-memory.dmp
memory/3024-135-0x0000000006C10000-0x0000000006D72000-memory.dmp