Analysis
- max time kernel
154s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
19/10/2021, 10:07
General
- Target f4cd57e3512cbf801352ea10c2225d4b.exe
- Size 1.1MB
- Sample211019-l5nlyaffd3
- SHA256 1e5bb5e00fddfcc62c8bfe71b46a4c8c6c22986c7a51931d16b8ddc465170d72
Malware Config
Extracted
-
xloader
-
2.5
-
ht08
-
http://www.septemberstockevent200.com/ht08/
-
joye.club
-
istanbulemlakgalerisi.online
-
annikadaniel.love
-
oooci.com
-
curebase-test.com
-
swisstradecenter.com
-
hacticum.com
-
centercodebase.com
-
recbi56ni.com
-
mmj0115.xyz
-
sharpstead.com
-
sprklbeauty.com
-
progettogenesi.cloud
-
dolinum.com
-
amaroqadvisors.com
-
traininig.com
-
leewaysvcs.com
-
nashhomesearch.com
-
joy1263.com
-
serkanyamac.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f4cd57e3512cbf801352ea10c2225d4b.exe"C:\Users\Admin\AppData\Local\Temp\f4cd57e3512cbf801352ea10c2225d4b.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2012-121-0x0000000005150000-0x0000000005470000-memory.dmp
memory/2012-119-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/2012-118-0x0000000003280000-0x0000000003281000-memory.dmp
memory/2012-122-0x0000000005070000-0x0000000005081000-memory.dmp
memory/2364-115-0x0000000002260000-0x0000000002261000-memory.dmp
memory/2364-116-0x0000000002281000-0x0000000002295000-memory.dmp
memory/3032-123-0x0000000006CE0000-0x0000000006E17000-memory.dmp
memory/3032-129-0x00000000071D0000-0x0000000007354000-memory.dmp
memory/3536-128-0x0000000004CF0000-0x0000000004D80000-memory.dmp
memory/3536-125-0x0000000000F90000-0x0000000000FB7000-memory.dmp
memory/3536-127-0x0000000004F30000-0x0000000005250000-memory.dmp
memory/3536-126-0x0000000000BD0000-0x0000000000BF9000-memory.dmp