Analysis
- max time kernel
149s - max time network
150s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
02/11/2021, 22:57
General
- Target T39209.exe
- Size 540KB
- Sample211102-2w85aacgc2
- SHA256 77a0d2b3cf7736f6ba6798b004ce89ce2cbbd049a8eaef6bec53cc854b4e79c9
Malware Config
Extracted
-
xloader
-
2.5
-
gnui
-
http://www.hottorchlighter.com/gnui/
-
himalayanwanderwoods.com
-
finvi.guru
-
iphone13promax.show
-
rpfcomunicacao.com
-
inemilia.com
-
blboutiqueexchange.com
-
sukiller.com
-
tzwa.net
-
noemiklein.com
-
upscalepklptp.xyz
-
unboxk.com
-
greatamericanlandworks.com
-
bataperu.com
-
estebanacostapeugeot.com
-
gombc-a02.com
-
642541.com
-
13f465.com
-
jskswj.com
-
hibar.xyz
-
eltool.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 4 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\T39209.exe"C:\Users\Admin\AppData\Local\Temp\T39209.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\T39209.exe"C:\Users\Admin\AppData\Local\Temp\T39209.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\T39209.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1108-77-0x0000000001D30000-0x0000000001DC0000-memory.dmp
memory/1108-76-0x0000000001EC0000-0x00000000021C3000-memory.dmp
memory/1108-75-0x0000000000140000-0x0000000000169000-memory.dmp
memory/1108-74-0x0000000000920000-0x000000000092B000-memory.dmp
memory/1268-68-0x0000000004A80000-0x0000000004B53000-memory.dmp
memory/1268-78-0x00000000065C0000-0x0000000006685000-memory.dmp
memory/1268-71-0x0000000006A60000-0x0000000006BCB000-memory.dmp
memory/1620-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1620-66-0x0000000000A80000-0x0000000000D83000-memory.dmp
memory/1620-67-0x0000000000180000-0x0000000000191000-memory.dmp
memory/1620-69-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1620-70-0x00000000001D0000-0x00000000001E1000-memory.dmp
memory/1620-63-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1620-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1728-55-0x0000000000DB0000-0x0000000000DB1000-memory.dmp
memory/1728-60-0x00000000043C0000-0x000000000440C000-memory.dmp
memory/1728-59-0x00000000008C0000-0x00000000008C7000-memory.dmp
memory/1728-58-0x00000000003B0000-0x00000000003B1000-memory.dmp
memory/1728-57-0x00000000764D1000-0x00000000764D3000-memory.dmp