Analysis
- max time kernel
152s - max time network
152s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
22/09/2021, 12:15
General
- Target Updated SOA 210920.PDF.exe
- Size 505KB
- Sample210922-pexnpsfbcj
- SHA256 81d263a31fc8b6fe2e2db250efd4314912eb09a11027a6cfc67257d7fa5e071a
Malware Config
Extracted
-
xloader
-
2.5
-
ny9y
-
http://www.caddomain.com/ny9y/
-
prelovedboutiqe.com
-
zhantool.com
-
grypeguidgorge.com
-
aa6588.com
-
privateerspacecompany.space
-
phil-goodman.com
-
jckabogados.com
-
familybeautifull.com
-
probinns.com
-
angelika-fritz.online
-
mygeeb.com
-
481344.com
-
freesoft.pro
-
extracter.store
-
fasxpay.com
-
hnjxcd.com
-
wfot2002.com
-
worldexecutor.com
-
tongxintachangjia.com
-
zachtippit.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Updated SOA 210920.PDF.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3036-127-0x0000000000F70000-0x0000000001290000-memory.dmp
memory/3036-128-0x0000000000B00000-0x0000000000B11000-memory.dmp
memory/3036-125-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3060-136-0x0000000004E60000-0x0000000004F62000-memory.dmp
memory/3060-129-0x0000000004D30000-0x0000000004E5C000-memory.dmp
memory/3476-121-0x0000000005190000-0x00000000051AD000-memory.dmp
memory/3476-118-0x00000000050F0000-0x00000000050F1000-memory.dmp
memory/3476-124-0x0000000005F30000-0x0000000005F5C000-memory.dmp
memory/3476-122-0x0000000005050000-0x00000000050E2000-memory.dmp
memory/3476-115-0x00000000007C0000-0x00000000007C1000-memory.dmp
memory/3476-120-0x0000000005400000-0x0000000005401000-memory.dmp
memory/3476-119-0x0000000005070000-0x0000000005071000-memory.dmp
memory/3476-123-0x0000000005ED0000-0x0000000005F2B000-memory.dmp
memory/3476-117-0x00000000056E0000-0x00000000056E1000-memory.dmp
memory/3972-132-0x00000000025D0000-0x00000000025F9000-memory.dmp
memory/3972-131-0x0000000000250000-0x000000000025B000-memory.dmp
memory/3972-134-0x0000000002DE0000-0x0000000003100000-memory.dmp
memory/3972-135-0x0000000002C40000-0x0000000002CD0000-memory.dmp