Analysis
- max time kernel
148s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
22/10/2021, 16:17
General
- Target [email protected],pdf.exe
- Size 64KB
- Sample211022-trclhsbgh8
- SHA256 dd4af1effdd1081fccbd05d035c4dfac3b992a358e2a6a6140095d0385ca7f5e
Malware Config
Extracted
-
xloader
-
2.5
-
g8ne
-
http://www.melindair.xyz/g8ne/
-
freesiacreations.com
-
ecopolymer.group
-
ahb9.com
-
ramapuramholdings.com
-
urban-gourmets.com
-
8xaocu.xyz
-
lancasteremerald.com
-
aktau.group
-
thebeachseekers.com
-
ki5rod.com
-
nmsships.com
-
dppu56.com
-
hairwegoca.net
-
aratakablogz.com
-
staunchgomkdt.xyz
-
leslaw.us
-
restaurantperladelmare.com
-
martensakcio.com
-
motherssecret.store
-
deersolutionsfranchising.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[email protected],pdf.exe"C:\Users\Admin\AppData\Local\Temp\[email protected],pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[email protected],pdf.exeC:\Users\Admin\AppData\Local\Temp\[email protected],pdf.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/648-115-0x0000000000780000-0x0000000000781000-memory.dmp
memory/648-117-0x0000000005030000-0x0000000005031000-memory.dmp
memory/648-118-0x0000000005B40000-0x0000000005B96000-memory.dmp
memory/648-119-0x0000000005C90000-0x0000000005C91000-memory.dmp
memory/648-120-0x0000000006200000-0x0000000006201000-memory.dmp
memory/648-121-0x0000000005C40000-0x0000000005C6A000-memory.dmp
memory/2744-130-0x0000000002CE0000-0x0000000003000000-memory.dmp
memory/2744-129-0x0000000000840000-0x0000000000899000-memory.dmp
memory/2744-131-0x0000000000160000-0x0000000000189000-memory.dmp
memory/2744-133-0x0000000002BA0000-0x0000000002C30000-memory.dmp
memory/2800-127-0x0000000005260000-0x00000000053AF000-memory.dmp
memory/2800-134-0x00000000053B0000-0x0000000005512000-memory.dmp
memory/3208-126-0x0000000000BF0000-0x0000000000C01000-memory.dmp
memory/3208-125-0x0000000000F50000-0x0000000001270000-memory.dmp
memory/3208-122-0x0000000000400000-0x0000000000429000-memory.dmp