Analysis
- max time kernel
151s - max time network
150s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
19/10/2021, 03:42
General
- Target siam.exe
- Size 252KB
- Sample211019-d9c21afbf4
- SHA256 b207cf6e0fe84692f4311e2768d913bae8005da5f7ed4cf1cee2459a6f62faa9
Malware Config
Extracted
-
xloader
-
2.5
-
w240
-
http://www.palisadesburgers.com/w240/
-
deathgummys.com
-
accentuable.info
-
logisticairpetrelocators.com
-
playdropmats.com
-
ewshop.club
-
bislists.com
-
pkkjoo.net
-
goldenkaktus.com
-
bigspiderproductions.com
-
funessences.com
-
gimpydogproductions.com
-
motivatedmarketinggroup.com
-
bjadd.com
-
2ux3ms.com
-
zafzi.com
-
oldmanemailplan.xyz
-
quotexlibya.com
-
mobco.store
-
stofferogbo.kim
-
akidsguidetotheworld.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 4 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 60 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\siam.exe"C:\Users\Admin\AppData\Local\Temp\siam.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\siam.exe"C:\Users\Admin\AppData\Local\Temp\siam.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\siam.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1356-130-0x0000000004270000-0x0000000004300000-memory.dmp
memory/1356-129-0x00000000044A0000-0x00000000047C0000-memory.dmp
memory/1356-126-0x0000000000940000-0x0000000000953000-memory.dmp
memory/1356-127-0x0000000000330000-0x0000000000359000-memory.dmp
memory/3008-124-0x0000000005000000-0x0000000005138000-memory.dmp
memory/3008-121-0x0000000006780000-0x0000000006922000-memory.dmp
memory/3008-131-0x0000000002FC0000-0x000000000306C000-memory.dmp
memory/3636-123-0x0000000000A20000-0x0000000000A31000-memory.dmp
memory/3636-122-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3636-120-0x0000000000600000-0x0000000000611000-memory.dmp
memory/3636-119-0x0000000000A40000-0x0000000000D60000-memory.dmp
memory/3636-116-0x0000000000400000-0x0000000000429000-memory.dmp