Analysis
- max time kernel
150s - max time network
149s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
19/10/2021, 11:45
General
- Target 376f198af24796bf500848fb66bdf471.exe
- Size 1.1MB
- Sample211019-nwqq2sgfdm
- SHA256 c11992880daecda35958fd14fcf3b6e5d32a6bda8c904a888ede0dcbb1f91aa6
Malware Config
Extracted
-
xloader
-
2.5
-
o4um
-
http://www.dependablelawnsnow.com/o4um/
-
kagami-belt.com
-
k7e.xyz
-
slowcontentmarketing.com
-
nativeamericannurse.com
-
stadtquartier.xyz
-
vietlinkmart.com
-
numisme.xyz
-
lypp-sh.com
-
walkerwaughray.com
-
homerightsolutions.com
-
vpdd.top
-
857741.com
-
informednewsreader.com
-
misachoavien.com
-
aslanrefinedhomes.com
-
bjhaitaoshop.com
-
lb-fo.com
-
shadedfaetattoos.com
-
tallulahapp.com
-
amhonlinemarketing.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\376f198af24796bf500848fb66bdf471.exe"C:\Users\Admin\AppData\Local\Temp\376f198af24796bf500848fb66bdf471.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1200-66-0x0000000003F70000-0x0000000004036000-memory.dmp
memory/1200-73-0x0000000006530000-0x000000000667B000-memory.dmp
memory/1212-72-0x0000000000450000-0x00000000004E0000-memory.dmp
memory/1212-70-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1212-71-0x0000000002090000-0x0000000002393000-memory.dmp
memory/1212-69-0x0000000000AE0000-0x0000000000AFC000-memory.dmp
memory/1520-57-0x0000000072480000-0x00000000724AA000-memory.dmp
memory/1520-62-0x0000000000090000-0x0000000000091000-memory.dmp
memory/1520-64-0x0000000002170000-0x0000000002473000-memory.dmp
memory/1520-65-0x00000000001E0000-0x00000000001F1000-memory.dmp
memory/1520-63-0x0000000072480000-0x00000000724AA000-memory.dmp
memory/1520-61-0x0000000072480000-0x00000000724AA000-memory.dmp
memory/1520-58-0x0000000000080000-0x0000000000081000-memory.dmp
memory/1628-54-0x00000000001B0000-0x00000000001B1000-memory.dmp
memory/1628-56-0x0000000074F21000-0x0000000074F23000-memory.dmp
memory/1628-55-0x0000000000261000-0x0000000000275000-memory.dmp