Analysis
- max time kernel
149s - max time network
152s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
21/09/2021, 04:31
General
- Target UPDATED e-STATEMENT..exe
- Size 872KB
- Sample210921-e5dneaafgm
- SHA256 fc9f8f3e66f8ea09953b7b5eba261ff36eb9a78a5f92787eb879420ee3bad581
Malware Config
Extracted
-
xloader
-
2.5
-
c2ue
-
http://www.heidevelop.xyz/c2ue/
-
isportdata.com
-
stellarex.energy
-
hsucollections.com
-
menuhaisan.com
-
joe-tzu.com
-
lumichargemktg.com
-
uae.tires
-
rapidcae.com
-
softwaresystemsolutions.com
-
s-galaxy.website
-
daewon-talks.net
-
northgamesnetwork.com
-
catalogue-bouyguestele.com
-
criativanet.com
-
theseasonalshift.com
-
actionfoto.online
-
openmaildoe.com
-
trashpenguin.com
-
ennopure.net
-
azurermine.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1020-138-0x00000000046D0000-0x0000000004760000-memory.dmp
memory/1020-136-0x0000000002E40000-0x0000000002E69000-memory.dmp
memory/1020-137-0x00000000042F0000-0x0000000004610000-memory.dmp
memory/1020-135-0x0000000000AA0000-0x0000000000AB3000-memory.dmp
memory/2408-127-0x0000000009510000-0x000000000953B000-memory.dmp
memory/2408-121-0x00000000058D0000-0x00000000058D1000-memory.dmp
memory/2408-124-0x000000007EBE0000-0x000000007EBE1000-memory.dmp
memory/2408-125-0x0000000005BF0000-0x0000000005BFE000-memory.dmp
memory/2408-126-0x0000000009490000-0x000000000950C000-memory.dmp
memory/2408-116-0x0000000000F50000-0x0000000000F51000-memory.dmp
memory/2408-118-0x0000000005830000-0x0000000005831000-memory.dmp
memory/2408-119-0x0000000005E80000-0x0000000005E81000-memory.dmp
memory/2408-120-0x0000000005980000-0x0000000005981000-memory.dmp
memory/2408-123-0x0000000005980000-0x0000000005E7E000-memory.dmp
memory/2408-122-0x0000000005B20000-0x0000000005B21000-memory.dmp
memory/3064-132-0x0000000000920000-0x00000000009E9000-memory.dmp
memory/3064-139-0x0000000005E20000-0x0000000005F81000-memory.dmp
memory/3492-131-0x00000000011D0000-0x00000000011E1000-memory.dmp
memory/3492-130-0x00000000014C0000-0x00000000017E0000-memory.dmp
memory/3492-128-0x0000000000400000-0x0000000000429000-memory.dmp