Analysis
- max time kernel
150s - max time network
153s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
29/09/2021, 02:18
General
- Target BhVQ8rqxTUy5ijy.exe
- Size 724KB
- Sample210929-crbksaddgn
- SHA256 7b858664b4283d8d0be155dc6bbe9f279e066b6cf2dd985eef95698e77333900
Malware Config
Extracted
-
xloader
-
2.5
-
jdt0
-
http://www.jen4x.com/jdt0/
-
william188.com
-
kmknim.com
-
freedomnofear.com
-
industrialohare.com
-
devopswave.com
-
g1fz.com
-
aliceguidi.info
-
linkared.com
-
crossboda.com
-
lpddr3.com
-
ktnword.xyz
-
productsdesign.top
-
dulichnhatviet.com
-
piazzaassociates.com
-
inpude.com
-
kmi.contractors
-
getkyrobak.com
-
sportinggoodssuperstore.com
-
trifoly.info
-
aspectjudge.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BhVQ8rqxTUy5ijy.exe"C:\Users\Admin\AppData\Local\Temp\BhVQ8rqxTUy5ijy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1908-126-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1908-128-0x0000000001800000-0x0000000001B20000-memory.dmp
memory/1908-129-0x00000000017E0000-0x00000000017F1000-memory.dmp
memory/3040-136-0x0000000000F00000-0x0000000000F90000-memory.dmp
memory/3040-135-0x0000000004820000-0x0000000004B40000-memory.dmp
memory/3040-133-0x0000000000380000-0x00000000003A9000-memory.dmp
memory/3040-132-0x0000000001120000-0x000000000141C000-memory.dmp
memory/3048-130-0x0000000000430000-0x00000000004EC000-memory.dmp
memory/3048-137-0x00000000049F0000-0x0000000004B26000-memory.dmp
memory/3572-125-0x0000000008780000-0x00000000087B8000-memory.dmp
memory/3572-118-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
memory/3572-117-0x0000000005330000-0x0000000005331000-memory.dmp
memory/3572-119-0x0000000004C30000-0x0000000004CC2000-memory.dmp
memory/3572-115-0x00000000003E0000-0x00000000003E1000-memory.dmp
memory/3572-120-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/3572-121-0x00000000081A0000-0x00000000081A1000-memory.dmp
memory/3572-124-0x0000000008760000-0x0000000008762000-memory.dmp
memory/3572-123-0x00000000086F0000-0x0000000008758000-memory.dmp
memory/3572-122-0x0000000008100000-0x0000000008113000-memory.dmp