Analysis
- max time kernel
150s - max time network
150s - submitted
01/01/1970, 00:00
General
- Target QUOTATION_doc.exe
- Size 1.0MB
- Sample211027-ta3rdafed4
- SHA256 a67796ab32ba225ab871923548c5b98147a848edeffb72089724d6131d20dc0c
Malware Config
Extracted
-
xloader
-
2.5
-
ht08
-
http://www.septemberstockevent200.com/ht08/
-
joye.club
-
istanbulemlakgalerisi.online
-
annikadaniel.love
-
oooci.com
-
curebase-test.com
-
swisstradecenter.com
-
hacticum.com
-
centercodebase.com
-
recbi56ni.com
-
mmj0115.xyz
-
sharpstead.com
-
sprklbeauty.com
-
progettogenesi.cloud
-
dolinum.com
-
amaroqadvisors.com
-
traininig.com
-
leewaysvcs.com
-
nashhomesearch.com
-
joy1263.com
-
serkanyamac.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION_doc.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION_doc.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mobsync.exeC:\Windows\System32\mobsync.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/808-122-0x0000000000D60000-0x0000000000D71000-memory.dmp
memory/808-120-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/808-119-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/808-121-0x00000000044B0000-0x00000000047D0000-memory.dmp
memory/2680-115-0x0000000002360000-0x0000000002361000-memory.dmp
memory/2680-116-0x00000000029B1000-0x00000000029C5000-memory.dmp
memory/3056-123-0x00000000028C0000-0x0000000002987000-memory.dmp
memory/3056-129-0x0000000006140000-0x000000000625B000-memory.dmp
memory/3112-128-0x0000000004D20000-0x0000000004DB0000-memory.dmp
memory/3112-126-0x0000000001010000-0x0000000001039000-memory.dmp
memory/3112-127-0x0000000004FD0000-0x00000000052F0000-memory.dmp
memory/3112-125-0x00000000012D0000-0x00000000012DC000-memory.dmp