Analysis
- max time kernel
150s - max time network
153s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
02/11/2021, 14:55
General
- Target PO #20004235.exe
- Size 482KB
- Sample211102-saffeachh4
- SHA256 26fff5fc343d24c23cbce78800c7e687aa263fa78141490d970f7bb9bb7a9965
Malware Config
Extracted
-
xloader
-
2.5
-
efa8
-
http://www.viewba.store/efa8/
-
novusioux.host
-
keinarosario.info
-
buyvapecart.com
-
departwell.com
-
returnpoint.info
-
ceramic10.com
-
594121.com
-
billstechadvice.com
-
nakaifans.com
-
mailserver-secure.com
-
percentrostered.net
-
margranmarmoraria.online
-
alwahda.net
-
brightromantic.com
-
gulebic.com
-
legendofmystia.com
-
gamex724.com
-
reuben8.com
-
palisadestahoehousing.com
-
nonthagorn.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 4 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\PO #20004235.exe"C:\Users\Admin\AppData\Local\Temp\PO #20004235.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO #20004235.exe"C:\Users\Admin\AppData\Local\Temp\PO #20004235.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO #20004235.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/340-138-0x00000000040A0000-0x0000000004130000-memory.dmp
memory/340-137-0x0000000004240000-0x0000000004560000-memory.dmp
memory/340-135-0x0000000000090000-0x000000000009C000-memory.dmp
memory/340-136-0x0000000002190000-0x00000000021B9000-memory.dmp
memory/392-129-0x0000000006510000-0x0000000006640000-memory.dmp
memory/392-139-0x00000000060F0000-0x0000000006218000-memory.dmp
memory/392-132-0x0000000005F40000-0x00000000060E7000-memory.dmp
memory/1856-127-0x00000000016D0000-0x00000000019F0000-memory.dmp
memory/1856-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1856-128-0x00000000015E0000-0x00000000015F1000-memory.dmp
memory/1856-130-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1856-131-0x0000000001630000-0x0000000001641000-memory.dmp
memory/3116-123-0x0000000006DC0000-0x0000000006E0C000-memory.dmp
memory/3116-115-0x0000000000050000-0x0000000000051000-memory.dmp
memory/3116-122-0x0000000006E10000-0x0000000006E11000-memory.dmp
memory/3116-121-0x00000000065D0000-0x00000000065D7000-memory.dmp
memory/3116-120-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
memory/3116-119-0x0000000000C30000-0x0000000000C31000-memory.dmp
memory/3116-118-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
memory/3116-117-0x0000000004FE0000-0x0000000004FE1000-memory.dmp