Analysis
- max time kernel
145s - max time network
149s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
06/10/2021, 10:12
General
- Target VC-Q-1056410-21GR1.exe
- Size 714KB
- Sample211006-l8g9bsbab4
- SHA256 f76c77ec8ce93ed76e97e714bb04a010ec289f3a08c321e95ac09c4f4285b2c5
Malware Config
Extracted
-
xloader
-
2.5
-
epns
-
http://www.lnvietnam.online/epns/
-
mmfaccao.com
-
blttsperma.quest
-
946abe.net
-
indispensablehands.com
-
jkformationfrance.com
-
phonerepaire.com
-
lienquan-trian.com
-
youkuti.com
-
empowermindbodystudios.com
-
seunicapf.com
-
fk-link.xyz
-
kunai.tech
-
difficultbutdoablebrand.com
-
ejworkspace.com
-
teracorp.biz
-
thekids.today
-
quintaalentejana.com
-
annaviruksham.com
-
jshengrong.com
-
nsmetalmakina.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 6 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VC-Q-1056410-21GR1.exe"C:\Users\Admin\AppData\Local\Temp\VC-Q-1056410-21GR1.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VC-Q-1056410-21GR1.exeC:\Users\Admin\AppData\Local\Temp\VC-Q-1056410-21GR1.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/556-61-0x0000000000390000-0x00000000003A1000-memory.dmp
memory/556-56-0x0000000000400000-0x0000000000429000-memory.dmp
memory/556-59-0x0000000000340000-0x0000000000351000-memory.dmp
memory/556-58-0x0000000000910000-0x0000000000C13000-memory.dmp
memory/1092-54-0x0000000000240000-0x0000000000241000-memory.dmp
memory/1092-53-0x0000000074B41000-0x0000000074B43000-memory.dmp
memory/1360-60-0x0000000004DC0000-0x0000000004E90000-memory.dmp
memory/1360-62-0x0000000006F60000-0x0000000007091000-memory.dmp
memory/1360-68-0x0000000008D10000-0x0000000008E4D000-memory.dmp
memory/1744-64-0x0000000000C80000-0x0000000000C88000-memory.dmp
memory/1744-65-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1744-66-0x0000000000910000-0x0000000000C13000-memory.dmp
memory/1744-67-0x0000000000640000-0x00000000006D0000-memory.dmp