Analysis
- max time kernel
111s - max time network
129s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
03/11/2021, 19:20
General
- Target 9cdc6fca894d41cc415e6810793212a7.exe
- Size 604KB
- Sample211103-x17d2aeeh8
- SHA256 e1f8c7d02c06ad8a4d9a2e46a9c9d73e8cb95c854ca4c0558ae8c83e11f8c63b
Malware Config
Extracted
-
xloader
-
2.5
-
sywu
-
http://www.interrstellar.xyz/sywu/
-
odfj.top
-
ceracareofficial.top
-
38leckiestreet.com
-
minibustaxiservice.com
-
juliorodriguez.info
-
bslol.tech
-
tequesquitengomorelos.com
-
xiaye.tech
-
retamedia.com
-
ppaltobk.com
-
patriciaavalos.com
-
williejfrink.com
-
registrarmilhas.online
-
quotexromania.com
-
78923iox.com
-
thesavingsplaceforseniors.com
-
earth-lights.net
-
theconnectedforests.com
-
danziki.info
-
tripleincome.trade
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9cdc6fca894d41cc415e6810793212a7.exe"C:\Users\Admin\AppData\Local\Temp\9cdc6fca894d41cc415e6810793212a7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9cdc6fca894d41cc415e6810793212a7.exe"C:\Users\Admin\AppData\Local\Temp\9cdc6fca894d41cc415e6810793212a7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2704-115-0x0000000000910000-0x0000000000911000-memory.dmp
memory/2704-117-0x0000000005880000-0x0000000005881000-memory.dmp
memory/2704-118-0x0000000005270000-0x0000000005271000-memory.dmp
memory/2704-119-0x0000000005380000-0x000000000587E000-memory.dmp
memory/2704-120-0x00000000051D0000-0x00000000051D1000-memory.dmp
memory/2704-121-0x0000000005500000-0x0000000005506000-memory.dmp
memory/2704-122-0x0000000006020000-0x0000000006021000-memory.dmp
memory/2704-123-0x0000000005830000-0x000000000587D000-memory.dmp
memory/3316-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3316-126-0x0000000001330000-0x0000000001650000-memory.dmp