Analysis
- max time kernel
149s - max time network
150s - submitted
01/01/1970, 00:00
General
- Target QUOTATION_doc.exe
- Size 1.0MB
- Sample211027-ta3rdafed4
- SHA256 a67796ab32ba225ab871923548c5b98147a848edeffb72089724d6131d20dc0c
Malware Config
Extracted
-
xloader
-
2.5
-
ht08
-
http://www.septemberstockevent200.com/ht08/
-
joye.club
-
istanbulemlakgalerisi.online
-
annikadaniel.love
-
oooci.com
-
curebase-test.com
-
swisstradecenter.com
-
hacticum.com
-
centercodebase.com
-
recbi56ni.com
-
mmj0115.xyz
-
sharpstead.com
-
sprklbeauty.com
-
progettogenesi.cloud
-
dolinum.com
-
amaroqadvisors.com
-
traininig.com
-
leewaysvcs.com
-
nashhomesearch.com
-
joy1263.com
-
serkanyamac.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 27 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION_doc.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION_doc.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mobsync.exeC:\Windows\System32\mobsync.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/888-63-0x00000000000D0000-0x00000000000D1000-memory.dmp
memory/888-69-0x00000000002D0000-0x00000000002E1000-memory.dmp
memory/888-68-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/888-57-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/888-58-0x00000000000C0000-0x00000000000C1000-memory.dmp
memory/888-66-0x0000000000290000-0x00000000002A1000-memory.dmp
memory/888-65-0x00000000020C0000-0x00000000023C3000-memory.dmp
memory/888-64-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/988-73-0x0000000000640000-0x0000000000734000-memory.dmp
memory/988-74-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/988-75-0x0000000002230000-0x0000000002533000-memory.dmp
memory/988-76-0x0000000001FB0000-0x0000000002040000-memory.dmp
memory/1328-56-0x00000000002D1000-0x00000000002E5000-memory.dmp
memory/1328-55-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/1328-54-0x00000000765A1000-0x00000000765A3000-memory.dmp
memory/1408-67-0x0000000006890000-0x00000000069B0000-memory.dmp
memory/1408-70-0x0000000007540000-0x0000000007675000-memory.dmp
memory/1408-77-0x0000000009700000-0x000000000987D000-memory.dmp