Analysis
- max time kernel
150s - max time network
161s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
19/10/2021, 13:13
General
- Target DBS_Swift $12,863.exe
- Size 344KB
- Sample211019-qf4dbaggbn
- SHA256 def69bd673ae57b70c20087596b787eb27c1f0da7053ba2991e87cf7f032c43c
Malware Config
Extracted
-
xloader
-
2.3
-
ssee
-
http://www.idt-metrofireandsecurity.com/ssee/
-
portalcanaa.com
-
korzino.com
-
dlylms.net
-
smartearphoneshop.com
-
olimiloshop.com
-
auvdigitalstack.com
-
ydxc.chat
-
yhk868.com
-
lifeinthedport.com
-
self-sciencelabs.com
-
scandicpack.com
-
hold-sometimes.xyz
-
beiputei.com
-
yourrealtorcoach.com
-
rxods.com
-
fundsoption.com
-
ahlstromclothes.com
-
ksdieselparts.com
-
accountmangerford.com
-
kuwaitlogistic.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\DBS_Swift $12,863.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/668-126-0x0000000000400000-0x0000000000429000-memory.dmp
memory/668-129-0x0000000000FE0000-0x0000000001300000-memory.dmp
memory/668-130-0x0000000000B50000-0x0000000000B61000-memory.dmp
memory/1236-134-0x0000000000D60000-0x0000000000D6C000-memory.dmp
memory/1236-137-0x0000000004E70000-0x0000000004F00000-memory.dmp
memory/1236-136-0x0000000005120000-0x0000000005440000-memory.dmp
memory/1236-135-0x0000000002FB0000-0x0000000002FD9000-memory.dmp
memory/1860-125-0x0000000007040000-0x000000000708A000-memory.dmp
memory/1860-120-0x0000000004E50000-0x0000000004EE2000-memory.dmp
memory/1860-119-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
memory/1860-118-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/1860-117-0x0000000005400000-0x0000000005401000-memory.dmp
memory/1860-115-0x0000000000620000-0x0000000000621000-memory.dmp
memory/1860-121-0x0000000004E50000-0x0000000004EE2000-memory.dmp
memory/1860-124-0x0000000006FA0000-0x0000000006FA1000-memory.dmp
memory/1860-123-0x00000000091D0000-0x00000000091D8000-memory.dmp
memory/1860-122-0x0000000004EE2000-0x0000000004EE3000-memory.dmp
memory/2848-131-0x0000000005DC0000-0x0000000005F0B000-memory.dmp
memory/2848-138-0x00000000061E0000-0x0000000006345000-memory.dmp