Analysis
- max time kernel
149s - max time network
147s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
02/11/2021, 22:57
General
- Target T39209.exe
- Size 540KB
- Sample211102-2w85aacgc2
- SHA256 77a0d2b3cf7736f6ba6798b004ce89ce2cbbd049a8eaef6bec53cc854b4e79c9
Malware Config
Extracted
-
xloader
-
2.5
-
gnui
-
http://www.hottorchlighter.com/gnui/
-
himalayanwanderwoods.com
-
finvi.guru
-
iphone13promax.show
-
rpfcomunicacao.com
-
inemilia.com
-
blboutiqueexchange.com
-
sukiller.com
-
tzwa.net
-
noemiklein.com
-
upscalepklptp.xyz
-
unboxk.com
-
greatamericanlandworks.com
-
bataperu.com
-
estebanacostapeugeot.com
-
gombc-a02.com
-
642541.com
-
13f465.com
-
jskswj.com
-
hibar.xyz
-
eltool.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\T39209.exe"C:\Users\Admin\AppData\Local\Temp\T39209.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\T39209.exe"C:\Users\Admin\AppData\Local\Temp\T39209.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\T39209.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/376-135-0x0000000003E40000-0x0000000003ED0000-memory.dmp
memory/376-133-0x0000000003B20000-0x0000000003E40000-memory.dmp
memory/376-132-0x0000000000F70000-0x0000000000F99000-memory.dmp
memory/376-131-0x00000000010B0000-0x00000000010BC000-memory.dmp
memory/2704-121-0x0000000005BC0000-0x0000000005BC7000-memory.dmp
memory/2704-119-0x0000000005790000-0x0000000005C8E000-memory.dmp
memory/2704-123-0x0000000009270000-0x00000000092BC000-memory.dmp
memory/2704-122-0x00000000090D0000-0x00000000090D1000-memory.dmp
memory/2704-117-0x0000000005C90000-0x0000000005C91000-memory.dmp
memory/2704-118-0x0000000005870000-0x0000000005871000-memory.dmp
memory/2704-115-0x0000000000F80000-0x0000000000F81000-memory.dmp
memory/2704-120-0x00000000059D0000-0x00000000059D1000-memory.dmp
memory/3020-136-0x0000000002710000-0x00000000027D7000-memory.dmp
memory/3020-129-0x0000000004F60000-0x00000000050E0000-memory.dmp
memory/3456-128-0x00000000012F0000-0x0000000001301000-memory.dmp
memory/3456-127-0x0000000000FD0000-0x00000000012F0000-memory.dmp
memory/3456-124-0x0000000000400000-0x0000000000429000-memory.dmp