Analysis
- max time kernel
156s - max time network
164s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
02/10/2021, 03:22
General
- Target Inquiry-URGENT.exe
- Size 617KB
- Sample211002-dwwbesdef7
- SHA256 c18d5baf727358a8635a51fc7cfb4c3f4c90c78abcecf051feb4540323e98746
Malware Config
Extracted
-
xloader
-
2.5
-
b5ce
-
http://www.rheilea.com/b5ce/
-
advellerd.xyz
-
giasuvina.com
-
arab-xt-pro.com
-
ahsltu2ua4.com
-
trasportesemmanuel.com
-
kissimmeesoccercup.com
-
studyengland.com
-
m2volleyballclub.com
-
shyuehuan.com
-
elsml.com
-
blog-x-history.top
-
coditeu.com
-
allattachments.net
-
vigautruc.com
-
mentication.com
-
zambiaedu.xyz
-
filadelfiacenter.com
-
avlaborsourceinc.info
-
tameka-stewart.com
-
studio-cleo.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Inquiry-URGENT.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1688-124-0x0000000008890000-0x00000000088BC000-memory.dmp
memory/1688-123-0x0000000008820000-0x000000000887C000-memory.dmp
memory/1688-118-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/1688-119-0x0000000004C20000-0x0000000004C21000-memory.dmp
memory/1688-120-0x0000000008300000-0x0000000008301000-memory.dmp
memory/1688-121-0x0000000004B60000-0x0000000004BF2000-memory.dmp
memory/1688-122-0x0000000008270000-0x0000000008276000-memory.dmp
memory/1688-115-0x0000000000340000-0x0000000000341000-memory.dmp
memory/1688-117-0x0000000005150000-0x0000000005151000-memory.dmp
memory/2108-133-0x00000000008A0000-0x00000000008AA000-memory.dmp
memory/2108-134-0x0000000004910000-0x0000000004939000-memory.dmp
memory/2108-137-0x0000000005170000-0x0000000005200000-memory.dmp
memory/2108-136-0x0000000005320000-0x0000000005640000-memory.dmp
memory/3028-138-0x0000000005670000-0x00000000057DB000-memory.dmp
memory/3028-131-0x0000000005520000-0x000000000566F000-memory.dmp
memory/3028-129-0x0000000001030000-0x00000000010FC000-memory.dmp
memory/3480-130-0x00000000036B0000-0x00000000036C1000-memory.dmp
memory/3480-128-0x0000000001880000-0x0000000001891000-memory.dmp
memory/3480-127-0x00000000018D0000-0x0000000001BF0000-memory.dmp
memory/3480-125-0x0000000000400000-0x0000000000429000-memory.dmp