Analysis
- max time kernel
152s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
19/10/2021, 14:09
General
- Target PO.exe
- Size 348KB
- Sample211019-rf46aagghr
- SHA256 fff77f3852a66a56bad4ec5bc1c1bc2afb0b08b8ea65393384a1ee6917dcb355
Malware Config
Extracted
-
xloader
-
2.5
-
riho
-
http://www.teamsterslocal553.com/riho/
-
surfcitydawg.com
-
pwuq9t.com
-
prefectfxtrader.com
-
369xy.com
-
bjhygj888.com
-
cabinetfuid.com
-
houstondynamics.net
-
bertiebots.com
-
taboohospitality.com
-
fearlessthread.com
-
loropiana-store.online
-
growthventuresinc.net
-
artairazur.xyz
-
tvframesdisply.com
-
flammifer.biz
-
gtnetpro.com
-
b3sportaintment.com
-
housing-staff.net
-
superdelicioso.com
-
14mpt.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO.exe"C:\Users\Admin\AppData\Local\Temp\PO.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO.exe"C:\Users\Admin\AppData\Local\Temp\PO.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1112-126-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1112-130-0x0000000001400000-0x0000000001411000-memory.dmp
memory/1112-128-0x0000000001430000-0x0000000001750000-memory.dmp
memory/2720-121-0x0000000004E80000-0x000000000537E000-memory.dmp
memory/2720-118-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/2720-123-0x00000000090C0000-0x00000000090C8000-memory.dmp
memory/2720-124-0x0000000009180000-0x0000000009181000-memory.dmp
memory/2720-125-0x00000000009F0000-0x0000000000A3A000-memory.dmp
memory/2720-115-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/2720-120-0x0000000004E60000-0x0000000004E61000-memory.dmp
memory/2720-119-0x0000000004E80000-0x000000000537E000-memory.dmp
memory/2720-117-0x0000000005380000-0x0000000005381000-memory.dmp
memory/2720-122-0x0000000004E80000-0x000000000537E000-memory.dmp
memory/2860-134-0x0000000000EA0000-0x0000000000EBE000-memory.dmp
memory/2860-135-0x0000000000150000-0x0000000000179000-memory.dmp
memory/2860-136-0x0000000002EC0000-0x00000000031E0000-memory.dmp
memory/2860-137-0x0000000000B50000-0x0000000000BE0000-memory.dmp
memory/3064-131-0x0000000004E10000-0x0000000004F70000-memory.dmp
memory/3064-138-0x00000000027C0000-0x000000000285C000-memory.dmp