Analysis
- max time kernel
151s - max time network
149s - submitted
01/01/1970, 00:00
General
- Target T-T Swift Copy.exe
- Size 1.0MB
- Sample211027-skk4msfcf2
- SHA256 d9ca56d191efaa8ac5beee52f508082d6e8efb29045bb61c23851537982fa6bf
Malware Config
Extracted
-
xloader
-
2.5
-
s4mt
-
http://www.ehawkstech.com/s4mt/
-
deviousrofwft.xyz
-
iphone13.photos
-
cameraderie.info
-
flogotwheelz.com
-
lunasconstructionllc.com
-
unameofficial.com
-
digitalboat.cloud
-
hifi-cans.com
-
breskizci.com
-
kyleandconner.com
-
punnyaseva.com
-
elitephotoedit.com
-
pizzatallrikar.one
-
espacio40.com
-
bvgsf.xyz
-
splootingcorgi.com
-
metaverse360.biz
-
xnegbuy.com
-
buysubarus.com
-
optophonia.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\T-T Swift Copy.exe"C:\Users\Admin\AppData\Local\Temp\T-T Swift Copy.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1144-128-0x00000000010F0000-0x0000000001180000-memory.dmp
memory/1144-127-0x0000000003460000-0x0000000003780000-memory.dmp
memory/1144-126-0x0000000000A00000-0x0000000000A29000-memory.dmp
memory/1144-125-0x0000000001440000-0x000000000145E000-memory.dmp
memory/2268-116-0x00000000029B1000-0x00000000029C5000-memory.dmp
memory/2268-115-0x0000000002270000-0x0000000002271000-memory.dmp
memory/3008-123-0x0000000002C70000-0x0000000002D4B000-memory.dmp
memory/3008-129-0x00000000053E0000-0x000000000550C000-memory.dmp
memory/3264-122-0x0000000000CB0000-0x0000000000CC1000-memory.dmp
memory/3264-121-0x0000000004900000-0x0000000004C20000-memory.dmp
memory/3264-120-0x0000000073F00000-0x0000000073F29000-memory.dmp
memory/3264-119-0x0000000000780000-0x0000000000781000-memory.dmp