PROFOMA INVOICE.zip
PROFOMA INVOICE.exe
866KB
24-09-2021 11:06
24736913b455be2ed3d1cc67c767afc4
8026db0f265178cf013ac579c1b7267f4014bf2c
a109f0b9407728fef1b41d766e8228085ee04661156d84ef543777bf311f450b
Extracted
| Family | xloader |
| Version | 2.5 |
| Campaign | c2ue |
| C2 |
http://www.heidevelop.xyz/c2ue/ |
| Decoy |
isportdata.com stellarex.energy hsucollections.com menuhaisan.com joe-tzu.com lumichargemktg.com uae.tires rapidcae.com softwaresystemsolutions.com s-galaxy.website daewon-talks.net northgamesnetwork.com catalogue-bouyguestele.com criativanet.com theseasonalshift.com actionfoto.online openmaildoe.com trashpenguin.com ennopure.net azurermine.com wingkingtong.com innovativepropsolutions.com transportesajusco.online rosenblasts.info ttsports.store servpix.com liveatthebiltmore.com magentautil.com aquolly.com collabsales.com bredaslo.com suddisaddu.com www920011a.com uudh.info bleuexpress.com xivuko.com upstatehvacpros.com acami.art thqahql.com mauzabe.com mydrones.net franciseshun.com nrrpri.com adndpanel.xyz straightcorndinner.xyz locngrip.com wgylab.xyz greenmamba100.com dmglobalconsult.net alissanoume.xyz |
Filter: none
-
Xloader
Description
Xloader is a rebranded version of Formbook malware.
Tags
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
Description
suricata: ET MALWARE FormBook CnC Checkin (GET)
Tags
-
Xloader Payload
Tags
Reported IOCs
resource yara_rule behavioral2/memory/3800-127-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3800-128-0x000000000041D3A0-mapping.dmp xloader behavioral2/memory/2236-136-0x0000000002F80000-0x0000000002FA9000-memory.dmp xloader -
Blocklisted process makes network requestcscript.exe
Reported IOCs
flow pid process 29 2236 cscript.exe -
Suspicious use of SetThreadContextPROFOMA INVOICE.exePROFOMA INVOICE.execscript.exe
Reported IOCs
description pid process target process PID 2396 set thread context of 3800 2396 PROFOMA INVOICE.exe PROFOMA INVOICE.exe PID 3800 set thread context of 3028 3800 PROFOMA INVOICE.exe Explorer.EXE PID 3800 set thread context of 3028 3800 PROFOMA INVOICE.exe Explorer.EXE PID 2236 set thread context of 3028 2236 cscript.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcessesPROFOMA INVOICE.execscript.exe
Reported IOCs
pid process 3800 PROFOMA INVOICE.exe 3800 PROFOMA INVOICE.exe 3800 PROFOMA INVOICE.exe 3800 PROFOMA INVOICE.exe 3800 PROFOMA INVOICE.exe 3800 PROFOMA INVOICE.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe 2236 cscript.exe -
Suspicious behavior: GetForegroundWindowSpamExplorer.EXE
Reported IOCs
pid process 3028 Explorer.EXE -
Suspicious behavior: MapViewOfSectionPROFOMA INVOICE.execscript.exe
Reported IOCs
pid process 3800 PROFOMA INVOICE.exe 3800 PROFOMA INVOICE.exe 3800 PROFOMA INVOICE.exe 3800 PROFOMA INVOICE.exe 2236 cscript.exe 2236 cscript.exe -
Suspicious use of AdjustPrivilegeTokenPROFOMA INVOICE.execscript.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 3800 PROFOMA INVOICE.exe Token: SeDebugPrivilege 2236 cscript.exe -
Suspicious use of WriteProcessMemoryPROFOMA INVOICE.exeExplorer.EXEcscript.exe
Reported IOCs
description pid process target process PID 2396 wrote to memory of 3800 2396 PROFOMA INVOICE.exe PROFOMA INVOICE.exe PID 2396 wrote to memory of 3800 2396 PROFOMA INVOICE.exe PROFOMA INVOICE.exe PID 2396 wrote to memory of 3800 2396 PROFOMA INVOICE.exe PROFOMA INVOICE.exe PID 2396 wrote to memory of 3800 2396 PROFOMA INVOICE.exe PROFOMA INVOICE.exe PID 2396 wrote to memory of 3800 2396 PROFOMA INVOICE.exe PROFOMA INVOICE.exe PID 2396 wrote to memory of 3800 2396 PROFOMA INVOICE.exe PROFOMA INVOICE.exe PID 3028 wrote to memory of 2236 3028 Explorer.EXE cscript.exe PID 3028 wrote to memory of 2236 3028 Explorer.EXE cscript.exe PID 3028 wrote to memory of 2236 3028 Explorer.EXE cscript.exe PID 2236 wrote to memory of 516 2236 cscript.exe cmd.exe PID 2236 wrote to memory of 516 2236 cscript.exe cmd.exe PID 2236 wrote to memory of 516 2236 cscript.exe cmd.exe
-
C:\Windows\Explorer.EXEPID:3028C:\Windows\Explorer.EXESuspicious behavior: GetForegroundWindowSpamSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PROFOMA INVOICE.exePID:2396"C:\Users\Admin\AppData\Local\Temp\PROFOMA INVOICE.exe"Suspicious use of SetThreadContextSuspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PROFOMA INVOICE.exePID:3800"{path}"Suspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exePID:2236"C:\Windows\SysWOW64\cscript.exe"Blocklisted process makes network requestSuspicious use of SetThreadContextSuspicious behavior: EnumeratesProcessesSuspicious behavior: MapViewOfSectionSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exePID:516/c del "C:\Users\Admin\AppData\Local\Temp\PROFOMA INVOICE.exe"
-
memory/516-137-0x0000000000000000-mapping.dmp
-
memory/2236-135-0x0000000000EA0000-0x0000000000EC7000-memory.dmp
-
memory/2236-136-0x0000000002F80000-0x0000000002FA9000-memory.dmp
-
memory/2236-138-0x00000000053B0000-0x00000000056D0000-memory.dmp
-
memory/2236-139-0x0000000005220000-0x00000000052B0000-memory.dmp
-
memory/2236-134-0x0000000000000000-mapping.dmp
-
memory/2396-122-0x0000000005440000-0x0000000005441000-memory.dmp
-
memory/2396-123-0x0000000005C40000-0x0000000005C41000-memory.dmp
-
memory/2396-124-0x0000000002A40000-0x0000000002A4E000-memory.dmp
-
memory/2396-121-0x0000000005180000-0x0000000005181000-memory.dmp
-
memory/2396-126-0x00000000091C0000-0x00000000091EB000-memory.dmp
-
memory/2396-120-0x0000000005240000-0x000000000573E000-memory.dmp
-
memory/2396-115-0x0000000000890000-0x0000000000891000-memory.dmp
-
memory/2396-119-0x00000000052E0000-0x00000000052E1000-memory.dmp
-
memory/2396-118-0x0000000005740000-0x0000000005741000-memory.dmp
-
memory/2396-117-0x00000000051A0000-0x00000000051A1000-memory.dmp
-
memory/2396-125-0x0000000009110000-0x0000000009189000-memory.dmp
-
memory/3028-131-0x00000000065B0000-0x0000000006758000-memory.dmp
-
memory/3028-133-0x00000000069B0000-0x0000000006ACC000-memory.dmp
-
memory/3028-140-0x0000000005750000-0x0000000005885000-memory.dmp
-
memory/3800-132-0x00000000034F0000-0x0000000003501000-memory.dmp
-
memory/3800-129-0x0000000001740000-0x0000000001A60000-memory.dmp
-
memory/3800-130-0x0000000001700000-0x0000000001711000-memory.dmp
-
memory/3800-127-0x0000000000400000-0x0000000000429000-memory.dmp
-
memory/3800-128-0x000000000041D3A0-mapping.dmp