Analysis
-
max time kernel
299s -
max time network
300s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-09-2021 16:16
General
-
Target
UPDATED e-STATEMENT..exe
-
Size
872KB
-
MD5
a3279da350cf134f736629e5e55c0a41
-
SHA1
d28cc3a2cc3e16cf38634cab8db41aacebf4709b
-
SHA256
fc9f8f3e66f8ea09953b7b5eba261ff36eb9a78a5f92787eb879420ee3bad581
-
SHA512
248040d33716b6f7fb5c0764380c67489d2acdc52784b2d8020faa57f09edc383ab7ecd85c297ef2516698e2cfa92e7d8edc8fc0c510263e5a2b91e1f650d79b
Malware Config
Extracted
xloader
2.5
c2ue
http://www.heidevelop.xyz/c2ue/
isportdata.com
stellarex.energy
hsucollections.com
menuhaisan.com
joe-tzu.com
lumichargemktg.com
uae.tires
rapidcae.com
softwaresystemsolutions.com
s-galaxy.website
daewon-talks.net
northgamesnetwork.com
catalogue-bouyguestele.com
criativanet.com
theseasonalshift.com
actionfoto.online
openmaildoe.com
trashpenguin.com
ennopure.net
azurermine.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\UPDATED e-STATEMENT..exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/508-135-0x0000000000000000-mapping.dmp
-
memory/3028-138-0x00000000029E0000-0x0000000002AA2000-memory.dmpFilesize
776KB
-
memory/3028-131-0x0000000002830000-0x00000000028E9000-memory.dmpFilesize
740KB
-
memory/3460-128-0x000000000041D3A0-mapping.dmp
-
memory/3460-130-0x0000000001530000-0x0000000001541000-memory.dmpFilesize
68KB
-
memory/3460-129-0x0000000001550000-0x0000000001870000-memory.dmpFilesize
3.1MB
-
memory/3460-127-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/3704-137-0x00000000047E0000-0x0000000004870000-memory.dmpFilesize
576KB
-
memory/3704-136-0x00000000049A0000-0x0000000004CC0000-memory.dmpFilesize
3.1MB
-
memory/3704-133-0x0000000000930000-0x0000000000D6F000-memory.dmpFilesize
4.2MB
-
memory/3704-134-0x0000000000450000-0x0000000000479000-memory.dmpFilesize
164KB
-
memory/3704-132-0x0000000000000000-mapping.dmp
-
memory/4068-121-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/4068-126-0x0000000009D70000-0x0000000009D9B000-memory.dmpFilesize
172KB
-
memory/4068-125-0x000000000B260000-0x000000000B2DC000-memory.dmpFilesize
496KB
-
memory/4068-124-0x000000007F350000-0x000000007F351000-memory.dmpFilesize
4KB
-
memory/4068-123-0x0000000005890000-0x000000000589E000-memory.dmpFilesize
56KB
-
memory/4068-122-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/4068-115-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/4068-120-0x0000000005410000-0x000000000590E000-memory.dmpFilesize
5.0MB
-
memory/4068-119-0x0000000005410000-0x0000000005411000-memory.dmpFilesize
4KB
-
memory/4068-118-0x0000000005910000-0x0000000005911000-memory.dmpFilesize
4KB
-
memory/4068-117-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB