Analysis
- max time kernel
152s - max time network
151s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
27/09/2021, 08:28
General
- Target Inquiry Order 26-09-2021.exe
- Size 818KB
- Sample210927-kc16wsgbd6
- SHA256 c4c9d27ea805c32e7f0e66dc0d9534d8fbd87f4c1327727b2e1e9ae937f02c45
Malware Config
Extracted
-
xloader
-
2.5
-
b5ce
-
http://www.rheilea.com/b5ce/
-
advellerd.xyz
-
giasuvina.com
-
arab-xt-pro.com
-
ahsltu2ua4.com
-
trasportesemmanuel.com
-
kissimmeesoccercup.com
-
studyengland.com
-
m2volleyballclub.com
-
shyuehuan.com
-
elsml.com
-
blog-x-history.top
-
coditeu.com
-
allattachments.net
-
vigautruc.com
-
mentication.com
-
zambiaedu.xyz
-
filadelfiacenter.com
-
avlaborsourceinc.info
-
tameka-stewart.com
-
studio-cleo.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inquiry Order 26-09-2021.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2852-126-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2852-128-0x0000000001590000-0x00000000018B0000-memory.dmp
memory/2852-129-0x00000000014E0000-0x00000000014F1000-memory.dmp
memory/3028-137-0x0000000004D00000-0x0000000004DF3000-memory.dmp
memory/3028-130-0x0000000002730000-0x0000000002816000-memory.dmp
memory/3168-121-0x0000000005150000-0x0000000005157000-memory.dmp
memory/3168-119-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/3168-124-0x0000000008810000-0x000000000886E000-memory.dmp
memory/3168-125-0x0000000008880000-0x00000000088AF000-memory.dmp
memory/3168-122-0x0000000004D80000-0x000000000527E000-memory.dmp
memory/3168-115-0x0000000000380000-0x0000000000381000-memory.dmp
memory/3168-120-0x00000000082F0000-0x00000000082F1000-memory.dmp
memory/3168-123-0x0000000008970000-0x0000000008971000-memory.dmp
memory/3168-118-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/3168-117-0x0000000005280000-0x0000000005281000-memory.dmp
memory/3576-133-0x0000000000E00000-0x0000000000E29000-memory.dmp
memory/3576-132-0x0000000001180000-0x000000000118A000-memory.dmp
memory/3576-135-0x0000000005590000-0x00000000058B0000-memory.dmp
memory/3576-136-0x00000000054D0000-0x0000000005560000-memory.dmp