Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/10/2021, 06:23
General
- Target investigaci¢n-URGENTE GRUPO DANI.exe
- Size 708KB
- Sample211005-g5g2yahcf2
- SHA256 73db754f5e709731e9c07c230fa6512ee75e07184c367e3f80b1bf646e7b72da
Malware Config
Extracted
-
xloader
-
2.5
-
b5ce
-
http://www.rheilea.com/b5ce/
-
advellerd.xyz
-
giasuvina.com
-
arab-xt-pro.com
-
ahsltu2ua4.com
-
trasportesemmanuel.com
-
kissimmeesoccercup.com
-
studyengland.com
-
m2volleyballclub.com
-
shyuehuan.com
-
elsml.com
-
blog-x-history.top
-
coditeu.com
-
allattachments.net
-
vigautruc.com
-
mentication.com
-
zambiaedu.xyz
-
filadelfiacenter.com
-
avlaborsourceinc.info
-
tameka-stewart.com
-
studio-cleo.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\investigaci¢n-URGENTE GRUPO DANI.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/808-114-0x00000000006E0000-0x00000000006E1000-memory.dmp
memory/808-116-0x00000000055D0000-0x00000000055D1000-memory.dmp
memory/808-117-0x0000000005170000-0x0000000005171000-memory.dmp
memory/808-118-0x0000000005140000-0x0000000005141000-memory.dmp
memory/808-119-0x00000000050D0000-0x00000000055CE000-memory.dmp
memory/808-120-0x0000000005460000-0x0000000005461000-memory.dmp
memory/808-121-0x00000000053C0000-0x00000000053CA000-memory.dmp
memory/808-122-0x00000000079B0000-0x00000000079FC000-memory.dmp
memory/1020-129-0x0000000000020000-0x0000000000047000-memory.dmp
memory/1020-130-0x0000000002590000-0x00000000025B9000-memory.dmp
memory/1020-132-0x00000000045C0000-0x00000000048E0000-memory.dmp
memory/1020-133-0x00000000043D0000-0x0000000004460000-memory.dmp
memory/3056-127-0x0000000006C00000-0x0000000006D1D000-memory.dmp
memory/3056-134-0x00000000057D0000-0x0000000005925000-memory.dmp
memory/3308-125-0x00000000017B0000-0x0000000001AD0000-memory.dmp
memory/3308-126-0x00000000016E0000-0x00000000016F1000-memory.dmp
memory/3308-123-0x0000000000400000-0x0000000000429000-memory.dmp