Analysis
- max time kernel
152s - max time network
153s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
06/10/2021, 06:17
General
- Target ORDER REMINDER_0000200.gz.exe
- Size 917KB
- Sample211006-g14edaahdk
- SHA256 5c6bb4be3e5abfc077f779645b07502ad3f9357fa3c486db79d0a2fb4f470527
Malware Config
Extracted
-
xloader
-
2.5
-
gnui
-
http://www.hottorchlighter.com/gnui/
-
himalayanwanderwoods.com
-
finvi.guru
-
iphone13promax.show
-
rpfcomunicacao.com
-
inemilia.com
-
blboutiqueexchange.com
-
sukiller.com
-
tzwa.net
-
noemiklein.com
-
upscalepklptp.xyz
-
unboxk.com
-
greatamericanlandworks.com
-
bataperu.com
-
estebanacostapeugeot.com
-
gombc-a02.com
-
642541.com
-
13f465.com
-
jskswj.com
-
hibar.xyz
-
eltool.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 4 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 50 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER REMINDER_0000200.gz.exe"C:\Users\Admin\AppData\Local\Temp\ORDER REMINDER_0000200.gz.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ORDER REMINDER_0000200.gz.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\ORDER REMINDER_0000200.gz.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2492-122-0x0000000007E80000-0x0000000007E81000-memory.dmp
memory/2492-124-0x0000000003180000-0x000000000318E000-memory.dmp
memory/2492-119-0x0000000007EB0000-0x0000000007EB1000-memory.dmp
memory/2492-120-0x0000000007E30000-0x0000000007E31000-memory.dmp
memory/2492-121-0x0000000008010000-0x0000000008011000-memory.dmp
memory/2492-115-0x0000000000E70000-0x0000000000E71000-memory.dmp
memory/2492-123-0x0000000007CD0000-0x0000000007D6C000-memory.dmp
memory/2492-118-0x0000000008310000-0x0000000008311000-memory.dmp
memory/2492-125-0x0000000005DC0000-0x0000000005E3C000-memory.dmp
memory/2492-126-0x0000000006E40000-0x0000000006E6B000-memory.dmp
memory/2492-117-0x0000000007D70000-0x0000000007D71000-memory.dmp
memory/3036-140-0x0000000005EB0000-0x0000000005FDB000-memory.dmp
memory/3036-130-0x0000000002810000-0x00000000028F6000-memory.dmp
memory/3036-133-0x0000000005C20000-0x0000000005CDA000-memory.dmp
memory/3144-135-0x0000000000180000-0x000000000018B000-memory.dmp
memory/3144-136-0x00000000032B0000-0x00000000032D9000-memory.dmp
memory/3144-138-0x00000000032E0000-0x000000000342A000-memory.dmp
memory/3144-139-0x0000000003790000-0x0000000003820000-memory.dmp
memory/3352-132-0x0000000002E60000-0x0000000002E71000-memory.dmp
memory/3352-131-0x00000000014B0000-0x00000000014C1000-memory.dmp
memory/3352-129-0x0000000001170000-0x0000000001490000-memory.dmp
memory/3352-127-0x0000000000400000-0x0000000000429000-memory.dmp