Analysis
- max time kernel
150s - max time network
150s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
15/10/2021, 10:17
General
- Target GPSCHN202109144.exe
- Size 653KB
- Sample211015-mbc4saage4
- SHA256 0ce4e2f71989e9a0a4aef640b12237135e2be4b037f9cf533ca7925224e9daa8
Malware Config
Extracted
-
xloader
-
2.5
-
mqi9
-
http://www.vulcanopresale.icu/mqi9/
-
spectehnika-rb.com
-
daleproaudio.xyz
-
cpw887.com
-
gosbs-b01.com
-
clarkmanagementhawaii.com
-
taobaoi68.xyz
-
hoppedchardonnay.com
-
extremesavings.net
-
newbiepanda.com
-
arul-jegadish.com
-
kellibrat.com
-
avto-mercury.info
-
percussionportal.com
-
colorfulworldpublishing.com
-
notvaccinatedjobs.com
-
cattavida.com
-
pioniersa.com
-
yanduy.com
-
mzjing.com
-
piedmontpines.school
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Blocklisted process makes network request 1 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 24 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GPSCHN202109144.exe"C:\Users\Admin\AppData\Local\Temp\GPSCHN202109144.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GPSCHN202109144.exe"{path}"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\GPSCHN202109144.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/640-74-0x0000000000960000-0x00000000009F0000-memory.dmp
memory/640-73-0x0000000000A70000-0x0000000000D73000-memory.dmp
memory/640-72-0x0000000000110000-0x0000000000139000-memory.dmp
memory/640-71-0x0000000000E60000-0x0000000000E78000-memory.dmp
memory/1308-65-0x0000000000B90000-0x0000000000E93000-memory.dmp
memory/1308-66-0x0000000000140000-0x0000000000151000-memory.dmp
memory/1308-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1308-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1308-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1392-58-0x0000000005AC0000-0x0000000005B3D000-memory.dmp
memory/1392-59-0x0000000000670000-0x000000000069B000-memory.dmp
memory/1392-53-0x00000000002A0000-0x00000000002A1000-memory.dmp
memory/1392-57-0x00000000004A0000-0x00000000004AE000-memory.dmp
memory/1392-56-0x00000000006B0000-0x00000000006B1000-memory.dmp
memory/1392-55-0x00000000751D1000-0x00000000751D3000-memory.dmp
memory/1404-67-0x0000000006A60000-0x0000000006BAE000-memory.dmp
memory/1404-75-0x0000000008B20000-0x0000000008C7D000-memory.dmp