Analysis
- max time kernel
153s - max time network
146s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
05/10/2021, 13:54
General
- Target DOC20211005-0918629831.exe
- Size 1.0MB
- Sample211005-q7j4raacap
- SHA256 85eb901d5863c16a7526addfb18464967c45348aec3e1d1bf6014958fa4aff8f
Malware Config
Extracted
-
xloader
-
2.5
-
ntfs
-
http://www.164661.com/ntfs/
-
cast-host.com
-
sheenwoman.com
-
cateringpairs.com
-
butikgamis.com
-
esd66.com
-
beautystaze.com
-
findavetnearme.com
-
lyketigers.com
-
nesboutiqe.com
-
jadeutil.com
-
survivalfresh.com
-
realestatebramlett.com
-
glorynap.com
-
awards.institute
-
huangtapps.com
-
beyondwithyou.com
-
cryptocustomerhelp.com
-
plataformasoma.net
-
lstpark.com
-
noalareelecionindefinida.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DOC20211005-0918629831.exe"C:\Users\Admin\AppData\Local\Temp\DOC20211005-0918629831.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2160-124-0x0000000006BE0000-0x0000000006BE1000-memory.dmp
memory/2160-125-0x0000000006231000-0x0000000006232000-memory.dmp
memory/2160-120-0x0000000005720000-0x0000000005721000-memory.dmp
memory/2160-121-0x0000000006230000-0x0000000006231000-memory.dmp
memory/2160-122-0x0000000006200000-0x0000000006221000-memory.dmp
memory/2160-123-0x0000000006C20000-0x0000000006C21000-memory.dmp
memory/2160-117-0x0000000005B80000-0x0000000005B81000-memory.dmp
memory/2160-119-0x0000000005680000-0x0000000005681000-memory.dmp
memory/2160-126-0x0000000007670000-0x000000000767B000-memory.dmp
memory/2160-127-0x0000000009C70000-0x0000000009C71000-memory.dmp
memory/2160-115-0x0000000000BD0000-0x0000000000BD1000-memory.dmp
memory/2160-118-0x0000000005580000-0x0000000005581000-memory.dmp
memory/3008-141-0x0000000005000000-0x00000000050CA000-memory.dmp
memory/3008-133-0x00000000032F0000-0x000000000339D000-memory.dmp
memory/3792-128-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3792-131-0x0000000001820000-0x0000000001B40000-memory.dmp
memory/3792-132-0x00000000017A0000-0x00000000017B1000-memory.dmp
memory/4068-138-0x0000000000110000-0x0000000000139000-memory.dmp
memory/4068-139-0x00000000045B0000-0x00000000048D0000-memory.dmp
memory/4068-137-0x0000000000230000-0x000000000052C000-memory.dmp
memory/4068-140-0x0000000004400000-0x0000000004490000-memory.dmp