Analysis
- max time kernel
150s - max time network
149s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
05/10/2021, 06:23
General
- Target investigaci¢n-URGENTE GRUPO DANI.exe
- Size 708KB
- Sample211005-g5g2yahcf2
- SHA256 73db754f5e709731e9c07c230fa6512ee75e07184c367e3f80b1bf646e7b72da
Malware Config
Extracted
-
xloader
-
2.5
-
b5ce
-
http://www.rheilea.com/b5ce/
-
advellerd.xyz
-
giasuvina.com
-
arab-xt-pro.com
-
ahsltu2ua4.com
-
trasportesemmanuel.com
-
kissimmeesoccercup.com
-
studyengland.com
-
m2volleyballclub.com
-
shyuehuan.com
-
elsml.com
-
blog-x-history.top
-
coditeu.com
-
allattachments.net
-
vigautruc.com
-
mentication.com
-
zambiaedu.xyz
-
filadelfiacenter.com
-
avlaborsourceinc.info
-
tameka-stewart.com
-
studio-cleo.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1384-62-0x00000000060D0000-0x00000000061CC000-memory.dmp
memory/1384-64-0x0000000007320000-0x0000000007490000-memory.dmp
memory/1384-71-0x0000000008FF0000-0x000000000912E000-memory.dmp
memory/1560-69-0x0000000001FF0000-0x00000000022F3000-memory.dmp
memory/1560-67-0x0000000000220000-0x0000000000227000-memory.dmp
memory/1560-70-0x0000000001E70000-0x0000000001F00000-memory.dmp
memory/1560-68-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1608-63-0x0000000000250000-0x0000000000261000-memory.dmp
memory/1608-58-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1608-61-0x00000000001C0000-0x00000000001D1000-memory.dmp
memory/1608-60-0x00000000008A0000-0x0000000000BA3000-memory.dmp
memory/2004-55-0x0000000004F40000-0x0000000004F41000-memory.dmp
memory/2004-56-0x00000000004B0000-0x00000000004BA000-memory.dmp
memory/2004-53-0x0000000000F90000-0x0000000000F91000-memory.dmp
memory/2004-57-0x0000000004EF0000-0x0000000004F3C000-memory.dmp