Analysis
- max time kernel
150s - max time network
147s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
07/10/2021, 18:11
General
- Target f022b6feca056d1c00e697fdd3f32ee5.exe
- Size 841KB
- Sample211007-wsla6acgc9
- SHA256 5c175aad872d219fa23de0c83ea085fbdca8d76601167089b4e55ee66d520276
Malware Config
Extracted
-
xloader
-
2.5
-
scb0
-
http://www.llaa11.xyz/scb0/
-
austinsv.net
-
nothernballet.com
-
mycoursey.com
-
exodiduis.com
-
frankserranolaw.com
-
dingyiemail.com
-
woodstocktimbersandbeams.com
-
somphones.com
-
goalcations.com
-
boraeresici.com
-
spiegelverwarming.store
-
8676789.rest
-
tametaverse.com
-
suppliesdevon.com
-
sergiofisheronmcl.com
-
reevophilippines.com
-
oemlift.com
-
helloworld.agency
-
klaydoge.com
-
cristinadiasoficial.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f022b6feca056d1c00e697fdd3f32ee5.exe"C:\Users\Admin\AppData\Local\Temp\f022b6feca056d1c00e697fdd3f32ee5.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mobsync.exeC:\Windows\System32\mobsync.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2452-132-0x0000000005320000-0x00000000054AD000-memory.dmp
memory/2452-123-0x0000000005180000-0x0000000005319000-memory.dmp
memory/2452-126-0x0000000000AA0000-0x0000000000B51000-memory.dmp
memory/3204-131-0x0000000000B20000-0x0000000000BB0000-memory.dmp
memory/3204-130-0x0000000004700000-0x0000000004A20000-memory.dmp
memory/3204-129-0x0000000000620000-0x0000000000649000-memory.dmp
memory/3204-128-0x0000000000C00000-0x0000000000C19000-memory.dmp
memory/3572-116-0x0000000002281000-0x0000000002295000-memory.dmp
memory/3572-115-0x00000000005C0000-0x000000000070A000-memory.dmp
memory/4580-119-0x0000000003110000-0x0000000003111000-memory.dmp
memory/4580-125-0x0000000005060000-0x0000000005071000-memory.dmp
memory/4580-124-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/4580-121-0x0000000005120000-0x0000000005440000-memory.dmp
memory/4580-122-0x0000000003520000-0x0000000003531000-memory.dmp
memory/4580-120-0x0000000072480000-0x00000000724A9000-memory.dmp