Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
21-10-2021 09:31
General
-
Target
oooo.exe
-
Size
164KB
-
MD5
33f851f65f6b0b30c69cc8c113079565
-
SHA1
a6dec10d7b33bf25d351f1d1a6ada52cbb7dcaf2
-
SHA256
ee30bcf64cc2b2664a526d9bf03da79d2bcb3b9633783621642fcf3b5aecebd3
-
SHA512
c4f323feadc237965cabd2ad2b33187ad120f32071b7dbd89d6e65e0cce7a3e7f9e8fa8d10923383d9dcd582238194a775bc59ec6a2cdfaf73a7c453d6ad23df
Score
10/10
Malware Config
Extracted
Family
xloader
Version
2.5
Campaign
mexq
C2
http://www.aliexpress-br.com/mexq/
Decoy
cyebang.com
hcswwsz.com
50003008.com
yfly624.xyz
trungtamhohap.xyz
sotlbb.com
bizhan69.com
brandmty.net
fucibou.xyz
orderinformantmailer.store
nobleminers.com
divinevoid.com
quickappraisal.net
adventuretravelsworld.com
ashainitiativemp.com
ikkbs-a02.com
rd26x.com
goraeda.com
abbastanza.info
andypartridge.photography
Signatures
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
Xloader Payload 1 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 60 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\oooo.exe"C:\Users\Admin\AppData\Local\Temp\oooo.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\oooo.exe"3⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3048-117-0x00000000049F0000-0x0000000004B6A000-memory.dmpFilesize
1.5MB
-
memory/3048-124-0x0000000004B70000-0x0000000004C94000-memory.dmpFilesize
1.1MB
-
memory/3704-115-0x00000000016B0000-0x00000000019D0000-memory.dmpFilesize
3.1MB
-
memory/3704-116-0x0000000001BA0000-0x0000000001BB1000-memory.dmpFilesize
68KB
-
memory/4352-119-0x0000000000000000-mapping.dmp
-
memory/4380-118-0x0000000000000000-mapping.dmp
-
memory/4380-120-0x0000000000C80000-0x00000000010BF000-memory.dmpFilesize
4.2MB
-
memory/4380-121-0x0000000000330000-0x0000000000359000-memory.dmpFilesize
164KB
-
memory/4380-122-0x0000000004870000-0x0000000004B90000-memory.dmpFilesize
3.1MB
-
memory/4380-123-0x0000000004760000-0x00000000047F0000-memory.dmpFilesize
576KB