Analysis
- max time kernel
151s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
22/09/2021, 23:17
General
- Target invoice.exe
- Size 772KB
- Sample210922-29pykaead8
- SHA256 ef4a9aba2afcd39bbfbce4fde4f5b14869115984d430c2e73353e89e214feaa4
Malware Config
Extracted
-
xloader
-
2.5
-
etaf
-
http://www.jingkevip.com/etaf/
-
villamanagementinalgarve.com
-
solslabradoodle.com
-
e0852.com
-
nautilusratio.club
-
freelancecentral.net
-
noeisee.com
-
dzace.com
-
earlylearningadvisors.com
-
happynotebooks.com
-
ustaylormademalls.club
-
mistrymethod.com
-
skullz.xyz
-
criticalequipmentservices.com
-
kudamonobatake.net
-
vslent.com
-
scottishbeachhuts.com
-
048yu.xyz
-
simera.xyz
-
safeguardinspector.com
-
broughttolife.store
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice.exe"C:\Users\Admin\AppData\Local\Temp\invoice.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\invoice.exe"C:\Users\Admin\AppData\Local\Temp\invoice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\invoice.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-125-0x0000000007B40000-0x0000000007B7D000-memory.dmp
memory/628-123-0x0000000007880000-0x0000000007881000-memory.dmp
memory/628-117-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/628-118-0x0000000004D00000-0x0000000004D01000-memory.dmp
memory/628-119-0x0000000005650000-0x0000000005651000-memory.dmp
memory/628-120-0x0000000004C50000-0x000000000514E000-memory.dmp
memory/628-121-0x0000000004DD0000-0x0000000004DD1000-memory.dmp
memory/628-122-0x00000000050F0000-0x000000000510D000-memory.dmp
memory/628-114-0x0000000000150000-0x0000000000151000-memory.dmp
memory/628-124-0x0000000007AC0000-0x0000000007B2D000-memory.dmp
memory/628-116-0x0000000005150000-0x0000000005151000-memory.dmp
memory/2976-126-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2976-129-0x0000000001230000-0x0000000001241000-memory.dmp
memory/2976-128-0x0000000001550000-0x0000000001870000-memory.dmp
memory/2996-130-0x0000000006EF0000-0x0000000006FD4000-memory.dmp
memory/2996-137-0x00000000053F0000-0x000000000557B000-memory.dmp
memory/3988-133-0x0000000000AB0000-0x0000000000AD9000-memory.dmp
memory/3988-132-0x0000000000F50000-0x0000000000F5B000-memory.dmp
memory/3988-134-0x00000000032A0000-0x00000000035C0000-memory.dmp
memory/3988-136-0x0000000003150000-0x00000000031E0000-memory.dmp