Analysis
- max time kernel
128s - max time network
131s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
02/11/2021, 14:15
General
- Target Shipment_details578261170350SHPDHL.exe
- Size 446KB
- Sample211102-rkkmfacgh2
- SHA256 44b990910f6785cce2886bf106ad968f4b9149d47c4fa568a371044e4477c2f2
Malware Config
Extracted
-
xloader
-
2.5
-
gab8
-
http://www.purodetalle.com/gab8/
-
amateurfeetworship.com
-
big-food.biz
-
metaversevolution.com
-
profecional-pacasmayo.com
-
royzoom.com
-
bekindevolution.com
-
hokozaki.com
-
waltersswholesale.com
-
wayfinderacu.com
-
schnurrgallery.com
-
babygearrentals.net
-
imggtoken.club
-
24x7x366.com
-
lakiernictwo.info
-
les-cours.com
-
dwticket.com
-
onarollshades.com
-
ramireztradepartners.com
-
safarparfums.com
-
6ngie.info
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipment_details578261170350SHPDHL.exe"C:\Users\Admin\AppData\Local\Temp\Shipment_details578261170350SHPDHL.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Shipment_details578261170350SHPDHL.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Shipment_details578261170350SHPDHL.exe"C:\Users\Admin\AppData\Local\Temp\Shipment_details578261170350SHPDHL.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Shipment_details578261170350SHPDHL.exe"C:\Users\Admin\AppData\Local\Temp\Shipment_details578261170350SHPDHL.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Shipment_details578261170350SHPDHL.exe"C:\Users\Admin\AppData\Local\Temp\Shipment_details578261170350SHPDHL.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/68-142-0x0000000001510000-0x0000000001830000-memory.dmp
memory/68-128-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2252-118-0x00000000002E0000-0x00000000002E1000-memory.dmp
memory/2252-120-0x0000000005050000-0x0000000005051000-memory.dmp
memory/2252-121-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/2252-122-0x0000000004B20000-0x0000000004B21000-memory.dmp
memory/2252-123-0x0000000004BB0000-0x0000000004BB1000-memory.dmp
memory/2252-124-0x0000000005030000-0x0000000005037000-memory.dmp
memory/2252-125-0x0000000006FB0000-0x0000000006FB1000-memory.dmp
memory/2252-126-0x0000000006840000-0x000000000688C000-memory.dmp
memory/3600-135-0x0000000007A00000-0x0000000007A01000-memory.dmp
memory/3600-140-0x0000000008500000-0x0000000008501000-memory.dmp
memory/3600-132-0x0000000006C10000-0x0000000006C11000-memory.dmp
memory/3600-133-0x0000000007360000-0x0000000007361000-memory.dmp
memory/3600-134-0x0000000007310000-0x0000000007311000-memory.dmp
memory/3600-130-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
memory/3600-136-0x0000000007B50000-0x0000000007B51000-memory.dmp
memory/3600-137-0x0000000007C10000-0x0000000007C11000-memory.dmp
memory/3600-138-0x0000000007AD0000-0x0000000007AD1000-memory.dmp
memory/3600-139-0x0000000006D20000-0x0000000006D21000-memory.dmp
memory/3600-141-0x0000000006D22000-0x0000000006D23000-memory.dmp
memory/3600-131-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
memory/3600-143-0x00000000083F0000-0x00000000083F1000-memory.dmp
memory/3600-144-0x0000000002FE0000-0x0000000002FE1000-memory.dmp
memory/3600-151-0x0000000009380000-0x00000000093B3000-memory.dmp
memory/3600-158-0x0000000009340000-0x0000000009341000-memory.dmp
memory/3600-163-0x00000000094B0000-0x00000000094B1000-memory.dmp
memory/3600-165-0x0000000006D23000-0x0000000006D24000-memory.dmp
memory/3600-164-0x000000007EA90000-0x000000007EA91000-memory.dmp
memory/3600-166-0x00000000096D0000-0x00000000096D1000-memory.dmp