Analysis
- max time kernel
149s - max time network
148s - submitted
01/01/1970, 00:00
General
- Target T-T Swift Copy.exe
- Size 1.0MB
- Sample211027-skk4msfcf2
- SHA256 d9ca56d191efaa8ac5beee52f508082d6e8efb29045bb61c23851537982fa6bf
Malware Config
Extracted
-
xloader
-
2.5
-
s4mt
-
http://www.ehawkstech.com/s4mt/
-
deviousrofwft.xyz
-
iphone13.photos
-
cameraderie.info
-
flogotwheelz.com
-
lunasconstructionllc.com
-
unameofficial.com
-
digitalboat.cloud
-
hifi-cans.com
-
breskizci.com
-
kyleandconner.com
-
punnyaseva.com
-
elitephotoedit.com
-
pizzatallrikar.one
-
espacio40.com
-
bvgsf.xyz
-
splootingcorgi.com
-
metaverse360.biz
-
xnegbuy.com
-
buysubarus.com
-
optophonia.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\T-T Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\T-T Swift Copy.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/552-55-0x0000000076431000-0x0000000076433000-memory.dmp
memory/552-56-0x00000000002C0000-0x00000000002C1000-memory.dmp
memory/552-57-0x0000000000311000-0x0000000000325000-memory.dmp
memory/880-65-0x0000000002240000-0x0000000002543000-memory.dmp
memory/880-59-0x0000000000080000-0x0000000000081000-memory.dmp
memory/880-63-0x0000000000090000-0x0000000000091000-memory.dmp
memory/880-64-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/880-58-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/880-66-0x0000000000150000-0x0000000000161000-memory.dmp
memory/1256-67-0x0000000006830000-0x0000000006903000-memory.dmp
memory/1256-73-0x0000000003F60000-0x0000000004003000-memory.dmp
memory/1384-70-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1384-71-0x0000000000780000-0x0000000000A83000-memory.dmp
memory/1384-69-0x0000000000BC0000-0x0000000000BC6000-memory.dmp
memory/1384-72-0x0000000000330000-0x00000000003C0000-memory.dmp