Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    20-09-2021 20:04

General

  • Target

    SOA.exe

  • Size

    1.1MB

  • MD5

    dd9dd4dc96b829fb76c94d93549077a3

  • SHA1

    ab1b5e44e32b93b10f1697ef407e4e846da30226

  • SHA256

    bf335484cc9fdfc68bda67acbe6eab1f65f0f7dd7043b3aff47b47201ca531c5

  • SHA512

    e93f9a7258f1645df87976c73aae2b0ece10f9093ce6e28eb6df6e9bc7604df2df1b2d8902604b5c53c4e9684c1da988798ca5da4afb05dddd5c063cb64b5529

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

c2ue

C2

http://www.heidevelop.xyz/c2ue/

Decoy

isportdata.com

stellarex.energy

hsucollections.com

menuhaisan.com

joe-tzu.com

lumichargemktg.com

uae.tires

rapidcae.com

softwaresystemsolutions.com

s-galaxy.website

daewon-talks.net

northgamesnetwork.com

catalogue-bouyguestele.com

criativanet.com

theseasonalshift.com

actionfoto.online

openmaildoe.com

trashpenguin.com

ennopure.net

azurermine.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:392
    • C:\Users\Admin\AppData\Local\Temp\SOA.exe
      "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Users\Admin\AppData\Local\Temp\SOA.exe
        "{path}"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2256
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2264
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\SOA.exe"
        3⤵
          PID:512

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/392-143-0x0000000002660000-0x000000000273A000-memory.dmp
      Filesize

      872KB

    • memory/392-136-0x0000000004C50000-0x0000000004D75000-memory.dmp
      Filesize

      1.1MB

    • memory/392-134-0x0000000005F40000-0x000000000606A000-memory.dmp
      Filesize

      1.2MB

    • memory/512-138-0x0000000000000000-mapping.dmp
    • memory/2256-130-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/2256-135-0x00000000012A0000-0x00000000012B1000-memory.dmp
      Filesize

      68KB

    • memory/2256-133-0x0000000001260000-0x0000000001271000-memory.dmp
      Filesize

      68KB

    • memory/2256-132-0x0000000000F00000-0x0000000001220000-memory.dmp
      Filesize

      3.1MB

    • memory/2256-131-0x000000000041D3A0-mapping.dmp
    • memory/2264-137-0x0000000000000000-mapping.dmp
    • memory/2264-140-0x0000000000580000-0x00000000005A9000-memory.dmp
      Filesize

      164KB

    • memory/2264-142-0x0000000004610000-0x00000000046A0000-memory.dmp
      Filesize

      576KB

    • memory/2264-141-0x0000000004780000-0x0000000004AA0000-memory.dmp
      Filesize

      3.1MB

    • memory/2264-139-0x0000000000A00000-0x0000000000A1F000-memory.dmp
      Filesize

      124KB

    • memory/2404-121-0x0000000005560000-0x0000000005561000-memory.dmp
      Filesize

      4KB

    • memory/2404-115-0x0000000000740000-0x0000000000741000-memory.dmp
      Filesize

      4KB

    • memory/2404-123-0x0000000005061000-0x0000000005062000-memory.dmp
      Filesize

      4KB

    • memory/2404-122-0x0000000005420000-0x0000000005421000-memory.dmp
      Filesize

      4KB

    • memory/2404-126-0x00000000062E0000-0x00000000062EE000-memory.dmp
      Filesize

      56KB

    • memory/2404-120-0x00000000054C0000-0x00000000054C1000-memory.dmp
      Filesize

      4KB

    • memory/2404-119-0x0000000005060000-0x0000000005061000-memory.dmp
      Filesize

      4KB

    • memory/2404-124-0x0000000005062000-0x0000000005063000-memory.dmp
      Filesize

      4KB

    • memory/2404-118-0x0000000005820000-0x0000000005821000-memory.dmp
      Filesize

      4KB

    • memory/2404-125-0x0000000005065000-0x0000000005067000-memory.dmp
      Filesize

      8KB

    • memory/2404-129-0x00000000084E0000-0x000000000850B000-memory.dmp
      Filesize

      172KB

    • memory/2404-128-0x0000000008450000-0x00000000084C9000-memory.dmp
      Filesize

      484KB

    • memory/2404-127-0x000000007EF30000-0x000000007EF31000-memory.dmp
      Filesize

      4KB

    • memory/2404-117-0x0000000005000000-0x0000000005052000-memory.dmp
      Filesize

      328KB