Analysis
- max time kernel
152s - max time network
155s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
29/09/2021, 09:48
General
- Target Maschine Angebot Resale.de.exe
- Size 862KB
- Sample210929-lssecseefj
- SHA256 a325ff051ebc1d366533e22fba4a75a4c0b183a28457ed2fea0841f68da06334
Malware Config
Extracted
-
xloader
-
2.5
-
hu8c
-
http://www.yoruba.loan/hu8c/
-
aliceso.photography
-
exploitslozdz.xyz
-
chokefirmbeauty.com
-
sapix-usa.com
-
perfectioncheergym.com
-
igfo.xyz
-
xc6686.com
-
aclproreubensnyder.com
-
xn--bin-2k4mp34c09iwiz.com
-
daumien.com
-
atlanticuniombank.com
-
ookawa.club
-
cherrywoodranchvacationhome.com
-
s6gfec.com
-
ryo-toolset.store
-
talltailfishing.com
-
creativelyaustin.com
-
xn--nqv986be9r.com
-
grpgg2021.space
-
michaelsarcona.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Blocklisted process makes network request 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Maschine Angebot Resale.de.exe"C:\Users\Admin\AppData\Local\Temp\Maschine Angebot Resale.de.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Maschine Angebot Resale.de.exe"C:\Users\Admin\AppData\Local\Temp\Maschine Angebot Resale.de.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Maschine Angebot Resale.de.exe"C:\Users\Admin\AppData\Local\Temp\Maschine Angebot Resale.de.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Maschine Angebot Resale.de.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2068-122-0x0000000005490000-0x00000000054A3000-memory.dmp
memory/2068-117-0x0000000005550000-0x0000000005551000-memory.dmp
memory/2068-118-0x0000000005130000-0x0000000005131000-memory.dmp
memory/2068-119-0x00000000051D0000-0x00000000051D1000-memory.dmp
memory/2068-120-0x0000000005050000-0x000000000554E000-memory.dmp
memory/2068-121-0x00000000085F0000-0x00000000085F1000-memory.dmp
memory/2068-123-0x0000000008B20000-0x0000000008B89000-memory.dmp
memory/2068-124-0x0000000008BA0000-0x0000000008BA2000-memory.dmp
memory/2068-125-0x0000000008BC0000-0x0000000008BF9000-memory.dmp
memory/2068-115-0x0000000000810000-0x0000000000811000-memory.dmp
memory/2648-130-0x0000000002E50000-0x0000000002F09000-memory.dmp
memory/2648-137-0x0000000006550000-0x0000000006607000-memory.dmp
memory/3756-126-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3756-128-0x0000000001050000-0x0000000001370000-memory.dmp
memory/3756-129-0x0000000000FE0000-0x0000000000FF1000-memory.dmp
memory/4028-133-0x00000000010F0000-0x0000000001103000-memory.dmp
memory/4028-134-0x0000000000650000-0x0000000000679000-memory.dmp
memory/4028-135-0x0000000004510000-0x0000000004830000-memory.dmp
memory/4028-136-0x0000000000FC0000-0x0000000001050000-memory.dmp