Analysis
- max time kernel
152s - max time network
153s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
19/10/2021, 11:45
General
- Target 376f198af24796bf500848fb66bdf471.exe
- Size 1.1MB
- Sample211019-nwqq2sgfdm
- SHA256 c11992880daecda35958fd14fcf3b6e5d32a6bda8c904a888ede0dcbb1f91aa6
Malware Config
Extracted
-
xloader
-
2.5
-
o4um
-
http://www.dependablelawnsnow.com/o4um/
-
kagami-belt.com
-
k7e.xyz
-
slowcontentmarketing.com
-
nativeamericannurse.com
-
stadtquartier.xyz
-
vietlinkmart.com
-
numisme.xyz
-
lypp-sh.com
-
walkerwaughray.com
-
homerightsolutions.com
-
vpdd.top
-
857741.com
-
informednewsreader.com
-
misachoavien.com
-
aslanrefinedhomes.com
-
bjhaitaoshop.com
-
lb-fo.com
-
shadedfaetattoos.com
-
tallulahapp.com
-
amhonlinemarketing.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\376f198af24796bf500848fb66bdf471.exe"C:\Users\Admin\AppData\Local\Temp\376f198af24796bf500848fb66bdf471.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\secinit.exeC:\Windows\System32\secinit.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1672-116-0x0000000002281000-0x0000000002295000-memory.dmp
memory/1672-115-0x0000000002260000-0x0000000002261000-memory.dmp
memory/2912-125-0x0000000001290000-0x00000000012A1000-memory.dmp
memory/2912-118-0x0000000072480000-0x00000000724AA000-memory.dmp
memory/2912-120-0x0000000072480000-0x00000000724AA000-memory.dmp
memory/2912-119-0x0000000000A00000-0x0000000000A01000-memory.dmp
memory/2912-122-0x0000000001250000-0x0000000001261000-memory.dmp
memory/2912-121-0x0000000004A10000-0x0000000004D30000-memory.dmp
memory/2912-124-0x0000000072480000-0x00000000724AA000-memory.dmp
memory/2988-123-0x00000000025B0000-0x0000000002660000-memory.dmp
memory/2988-126-0x0000000002730000-0x00000000027EF000-memory.dmp
memory/2988-132-0x0000000005F10000-0x000000000605F000-memory.dmp
memory/3440-128-0x0000000000390000-0x000000000039A000-memory.dmp
memory/3440-129-0x0000000005000000-0x0000000005029000-memory.dmp
memory/3440-130-0x0000000005030000-0x000000000517A000-memory.dmp
memory/3440-131-0x00000000054E0000-0x0000000005570000-memory.dmp