Analysis
- max time kernel
150s - max time network
140s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
21/09/2021, 04:31
General
- Target UPDATED e-STATEMENT..exe
- Size 872KB
- Sample210921-e5dneaafgm
- SHA256 fc9f8f3e66f8ea09953b7b5eba261ff36eb9a78a5f92787eb879420ee3bad581
Malware Config
Extracted
-
xloader
-
2.5
-
c2ue
-
http://www.heidevelop.xyz/c2ue/
-
isportdata.com
-
stellarex.energy
-
hsucollections.com
-
menuhaisan.com
-
joe-tzu.com
-
lumichargemktg.com
-
uae.tires
-
rapidcae.com
-
softwaresystemsolutions.com
-
s-galaxy.website
-
daewon-talks.net
-
northgamesnetwork.com
-
catalogue-bouyguestele.com
-
criativanet.com
-
theseasonalshift.com
-
actionfoto.online
-
openmaildoe.com
-
trashpenguin.com
-
ennopure.net
-
azurermine.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1392-73-0x00000000069A0000-0x0000000006B05000-memory.dmp
memory/1392-64-0x0000000003FC0000-0x000000000407B000-memory.dmp
memory/1544-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1544-63-0x00000000001B0000-0x00000000001C1000-memory.dmp
memory/1544-62-0x0000000000B30000-0x0000000000E33000-memory.dmp
memory/1888-69-0x0000000000270000-0x00000000004F1000-memory.dmp
memory/1888-66-0x0000000075FA1000-0x0000000075FA3000-memory.dmp
memory/1888-67-0x00000000747D1000-0x00000000747D3000-memory.dmp
memory/1888-70-0x00000000000D0000-0x00000000000F9000-memory.dmp
memory/1888-71-0x0000000002350000-0x0000000002653000-memory.dmp
memory/1888-72-0x0000000002290000-0x0000000002320000-memory.dmp
memory/2012-59-0x00000000040D0000-0x00000000040FB000-memory.dmp
memory/2012-58-0x0000000005D60000-0x0000000005DDC000-memory.dmp
memory/2012-57-0x000000007EF40000-0x000000007EF41000-memory.dmp
memory/2012-56-0x00000000005E0000-0x00000000005EE000-memory.dmp
memory/2012-53-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/2012-55-0x0000000004AB0000-0x0000000004AB1000-memory.dmp