Analysis
- max time kernel
148s - max time network
159s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
03/11/2021, 15:53
General
- Target PO #20004235.exe
- Size 353KB
- Sample211103-tbmfsaebe9
- SHA256 73a254fe8cce08216fdd98cfa4c0072ee082d3aae0942b74e6fc0eec2df9df83
Malware Config
Extracted
-
xloader
-
2.5
-
efa8
-
http://www.viewba.store/efa8/
-
novusioux.host
-
keinarosario.info
-
buyvapecart.com
-
departwell.com
-
returnpoint.info
-
ceramic10.com
-
594121.com
-
billstechadvice.com
-
nakaifans.com
-
mailserver-secure.com
-
percentrostered.net
-
margranmarmoraria.online
-
alwahda.net
-
brightromantic.com
-
gulebic.com
-
legendofmystia.com
-
gamex724.com
-
reuben8.com
-
palisadestahoehousing.com
-
nonthagorn.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 4 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO #20004235.exe"C:\Users\Admin\AppData\Local\Temp\PO #20004235.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO #20004235.exe"C:\Users\Admin\AppData\Local\Temp\PO #20004235.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO #20004235.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/584-134-0x0000000000D50000-0x0000000000D6E000-memory.dmp
memory/584-135-0x0000000002F70000-0x0000000002F99000-memory.dmp
memory/584-137-0x0000000003B30000-0x0000000003E50000-memory.dmp
memory/584-138-0x0000000003600000-0x0000000003690000-memory.dmp
memory/3060-139-0x0000000002790000-0x0000000002851000-memory.dmp
memory/3060-129-0x00000000022C0000-0x0000000002396000-memory.dmp
memory/3060-132-0x0000000004D30000-0x0000000004E80000-memory.dmp
memory/3612-123-0x00000000071A0000-0x00000000071ED000-memory.dmp
memory/3612-122-0x00000000077F0000-0x00000000077F1000-memory.dmp
memory/3612-121-0x0000000005970000-0x0000000005976000-memory.dmp
memory/3612-115-0x0000000000B70000-0x0000000000B71000-memory.dmp
memory/3612-120-0x0000000005580000-0x0000000005581000-memory.dmp
memory/3612-119-0x0000000005470000-0x0000000005471000-memory.dmp
memory/3612-118-0x0000000005490000-0x0000000005491000-memory.dmp
memory/3612-117-0x0000000005990000-0x0000000005991000-memory.dmp
memory/4456-127-0x0000000001640000-0x0000000001960000-memory.dmp
memory/4456-131-0x0000000003390000-0x00000000033A1000-memory.dmp
memory/4456-130-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4456-128-0x0000000001A60000-0x0000000001A71000-memory.dmp
memory/4456-124-0x0000000000400000-0x0000000000429000-memory.dmp