Analysis
- max time kernel
148s - max time network
150s - platform
windows10_x64 - resource
win10v20210408 - submitted
01/10/2021, 08:20
General
- Target ADV.EXE
- Size 767KB
- Sample211001-j8fdmabcf3
- SHA256 a273caaec30c51f646c6b2d4e6d4823e01f510f3d48ceb963664e50c1e3a5f31
Malware Config
Extracted
-
xloader
-
2.5
-
gtc5
-
http://www.studio-pdx.com/gtc5/
-
lifeomamori.com
-
socialautoposter.pro
-
houseathomes.com
-
it-brainpool.com
-
paraiba-unique.com
-
johndempseydesign.com
-
szjige.com
-
potszx.com
-
589781.com
-
gxjyjh.com
-
mybus360.com
-
hottinguer-asset.com
-
mateeth.com
-
juliamaggard-realtor.com
-
eightverses.com
-
291861.com
-
michelesmoneyservices.com
-
dagacuadao.info
-
stressfreemoveinc.com
-
mtpropertygrp.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ADV.EXE"C:\Users\Admin\AppData\Local\Temp\ADV.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ADV.EXE"C:\Users\Admin\AppData\Local\Temp\ADV.EXE"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ADV.EXE"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/804-120-0x0000000008870000-0x0000000008871000-memory.dmp
memory/804-117-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/804-118-0x00000000053B0000-0x00000000053B1000-memory.dmp
memory/804-119-0x0000000005330000-0x000000000582E000-memory.dmp
memory/804-114-0x0000000000940000-0x0000000000941000-memory.dmp
memory/804-121-0x00000000055C0000-0x00000000055C7000-memory.dmp
memory/804-122-0x0000000008D90000-0x0000000008DF0000-memory.dmp
memory/804-123-0x0000000008DF0000-0x0000000008E20000-memory.dmp
memory/804-116-0x0000000005830000-0x0000000005831000-memory.dmp
memory/1756-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1756-126-0x00000000015C0000-0x00000000018E0000-memory.dmp
memory/1756-127-0x0000000000F00000-0x000000000104A000-memory.dmp
memory/3056-128-0x0000000006A40000-0x0000000006B0F000-memory.dmp
memory/3056-137-0x0000000006C00000-0x0000000006D25000-memory.dmp
memory/3304-133-0x0000000000E90000-0x0000000000EA2000-memory.dmp
memory/3304-134-0x0000000002F70000-0x0000000002F99000-memory.dmp
memory/3304-135-0x0000000004F70000-0x0000000005290000-memory.dmp
memory/3304-136-0x0000000004EC0000-0x0000000004F50000-memory.dmp