Analysis
- max time kernel
151s - max time network
150s - platform
windows10_x64 - resource
win10v20210408 - submitted
20/09/2021, 04:19
General
- Target t0ID2yWRERNRIz4.exe
- Size 818KB
- Sample210920-exhmdsfdhr
- SHA256 7b4c1bf9a15a419080fe02866aa26f162f79d5e01763c6af5915b07988556223
Malware Config
Extracted
-
xloader
-
2.5
-
gjeh
-
http://www.getaudionow.com/gjeh/
-
carmator.com
-
bsbqrp.com
-
siemens-mp.com
-
dunnfloorcoverings.com
-
cpassminimedicalschools.info
-
howtodesignyourhomeoffice.com
-
famliytaste.com
-
freesocialmarketing.com
-
jejuhaenyeo.net
-
tradebot.icu
-
arzug.com
-
carrefour-solucoes.online
-
ladyom.com
-
aoironote.com
-
newmexicocarwreckattorney.com
-
wealthpatternsllc.net
-
thinkpinkalicous.com
-
prajapati.company
-
bjhwky.com
-
jsdigitalekuns.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Modifies registry class 9 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\t0ID2yWRERNRIz4.exe"C:\Users\Admin\AppData\Local\Temp\t0ID2yWRERNRIz4.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/496-135-0x0000000004340000-0x00000000043D0000-memory.dmp
memory/496-133-0x0000000000620000-0x0000000000649000-memory.dmp
memory/496-131-0x0000000000820000-0x0000000000826000-memory.dmp
memory/496-132-0x00000000044E0000-0x0000000004800000-memory.dmp
memory/904-120-0x0000000005CF0000-0x0000000005CF1000-memory.dmp
memory/904-119-0x0000000004E90000-0x0000000004E91000-memory.dmp
memory/904-122-0x0000000007B80000-0x0000000007B81000-memory.dmp
memory/904-123-0x0000000007DC0000-0x0000000007E26000-memory.dmp
memory/904-124-0x0000000007EC0000-0x0000000007EF6000-memory.dmp
memory/904-116-0x00000000053F0000-0x00000000053F1000-memory.dmp
memory/904-117-0x0000000004EF0000-0x0000000004EF1000-memory.dmp
memory/904-118-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/904-121-0x0000000005F20000-0x0000000005F3D000-memory.dmp
memory/904-114-0x0000000000560000-0x0000000000561000-memory.dmp
memory/2644-129-0x0000000008F80000-0x00000000090B3000-memory.dmp
memory/2644-136-0x0000000002C20000-0x0000000002CC6000-memory.dmp
memory/3840-127-0x0000000001010000-0x0000000001330000-memory.dmp
memory/3840-128-0x0000000000F50000-0x0000000000F61000-memory.dmp
memory/3840-125-0x0000000000400000-0x0000000000429000-memory.dmp