Analysis
- max time kernel
149s - max time network
147s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
19/10/2021, 13:13
General
- Target DBS_Swift $12,863.exe
- Size 344KB
- Sample211019-qf4dbaggbn
- SHA256 def69bd673ae57b70c20087596b787eb27c1f0da7053ba2991e87cf7f032c43c
Malware Config
Extracted
-
xloader
-
2.3
-
ssee
-
http://www.idt-metrofireandsecurity.com/ssee/
-
portalcanaa.com
-
korzino.com
-
dlylms.net
-
smartearphoneshop.com
-
olimiloshop.com
-
auvdigitalstack.com
-
ydxc.chat
-
yhk868.com
-
lifeinthedport.com
-
self-sciencelabs.com
-
scandicpack.com
-
hold-sometimes.xyz
-
beiputei.com
-
yourrealtorcoach.com
-
rxods.com
-
fundsoption.com
-
ahlstromclothes.com
-
ksdieselparts.com
-
accountmangerford.com
-
kuwaitlogistic.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 4 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1124-67-0x0000000000A00000-0x0000000000D03000-memory.dmp
memory/1124-71-0x00000000002D0000-0x00000000002E1000-memory.dmp
memory/1124-70-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1124-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1124-63-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1124-64-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1124-68-0x0000000000180000-0x0000000000191000-memory.dmp
memory/1272-80-0x00000000072C0000-0x000000000741F000-memory.dmp
memory/1272-72-0x0000000007140000-0x00000000072B6000-memory.dmp
memory/1272-69-0x0000000006670000-0x0000000006789000-memory.dmp
memory/1676-61-0x0000000000F00000-0x0000000000F4A000-memory.dmp
memory/1676-54-0x0000000000FB0000-0x0000000000FB1000-memory.dmp
memory/1676-60-0x00000000005B0000-0x00000000005B8000-memory.dmp
memory/1676-59-0x0000000004C52000-0x0000000004C53000-memory.dmp
memory/1676-58-0x0000000004C51000-0x0000000004C52000-memory.dmp
memory/1676-57-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/1676-56-0x00000000754F1000-0x00000000754F3000-memory.dmp
memory/1896-77-0x0000000000090000-0x00000000000B9000-memory.dmp
memory/1896-76-0x00000000022B0000-0x00000000025B3000-memory.dmp
memory/1896-75-0x0000000000E90000-0x0000000000EA8000-memory.dmp
memory/1896-79-0x0000000000970000-0x0000000000A00000-memory.dmp