Analysis
-
max time kernel
156s -
max time network
159s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
02-10-2021 02:23
General
-
Target
Inquiry-URGENT.exe
-
Size
617KB
-
MD5
7c347b3aba43cefc31e91fede356961b
-
SHA1
58bb9e282a8d6c95941d310a23010718901c58dd
-
SHA256
c18d5baf727358a8635a51fc7cfb4c3f4c90c78abcecf051feb4540323e98746
-
SHA512
94b6633784c888527aef5e3f4cba9d03b04118f43c0f6222b2c60e756fdb183fe88e9a9d940b95fb3ac2d85bee4a4a681ab8f77f4de85c9a722c8c8da9eaebe9
Malware Config
Extracted
xloader
2.5
b5ce
http://www.rheilea.com/b5ce/
advellerd.xyz
giasuvina.com
arab-xt-pro.com
ahsltu2ua4.com
trasportesemmanuel.com
kissimmeesoccercup.com
studyengland.com
m2volleyballclub.com
shyuehuan.com
elsml.com
blog-x-history.top
coditeu.com
allattachments.net
vigautruc.com
mentication.com
zambiaedu.xyz
filadelfiacenter.com
avlaborsourceinc.info
tameka-stewart.com
studio-cleo.com
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/460-131-0x0000000000000000-mapping.dmp
-
memory/2188-121-0x00000000083F0000-0x00000000083F1000-memory.dmpFilesize
4KB
-
memory/2188-118-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/2188-119-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/2188-120-0x0000000004E90000-0x000000000538E000-memory.dmpFilesize
5.0MB
-
memory/2188-115-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2188-122-0x0000000005250000-0x0000000005256000-memory.dmpFilesize
24KB
-
memory/2188-123-0x0000000008910000-0x000000000896C000-memory.dmpFilesize
368KB
-
memory/2188-117-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/2188-124-0x0000000008970000-0x000000000899C000-memory.dmpFilesize
176KB
-
memory/2352-134-0x0000000004F30000-0x0000000005250000-memory.dmpFilesize
3.1MB
-
memory/2352-135-0x0000000004E20000-0x0000000004EB0000-memory.dmpFilesize
576KB
-
memory/2352-130-0x0000000000000000-mapping.dmp
-
memory/2352-132-0x0000000001180000-0x00000000011A0000-memory.dmpFilesize
128KB
-
memory/2352-133-0x0000000001040000-0x0000000001069000-memory.dmpFilesize
164KB
-
memory/2648-129-0x0000000002E50000-0x0000000002EFF000-memory.dmpFilesize
700KB
-
memory/2648-136-0x0000000006550000-0x000000000664A000-memory.dmpFilesize
1000KB
-
memory/3852-128-0x0000000001850000-0x0000000001861000-memory.dmpFilesize
68KB
-
memory/3852-127-0x0000000001410000-0x0000000001730000-memory.dmpFilesize
3.1MB
-
memory/3852-126-0x000000000041D430-mapping.dmp
-
memory/3852-125-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB