Analysis
- max time kernel
120s - max time network
120s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
05/11/2021, 09:22
General
- Target 1c53f8f351aa28400483b8791dcddb30.exe
- Size 480KB
- Sample211105-lbxbzsbbd2
- SHA256 ee2706bc2dcedaf802a943ae5e94af62e28b004f39059f8c9a2fffd88de49aeb
Malware Config
Extracted
-
xloader
-
2.5
-
fqiq
-
http://www.esyscoloradosprings.com/fqiq/
-
driventow.com
-
ipatchwork.today
-
bolder.equipment
-
seal-brother.com
-
mountlaketerraceapartments.com
-
weeden.xyz
-
sanlifalan.com
-
athafood.com
-
isshinn1.com
-
creationslazzaroni.com
-
eclecticrenaissancewoman.com
-
satellitephonstore.com
-
cotchildcare.com
-
yamacorp.digital
-
ff4cuno43.xyz
-
quicksticks.community
-
govindfinance.com
-
farmersfirstseed.com
-
megacinema.club
-
tablescaperendezvous4two.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c53f8f351aa28400483b8791dcddb30.exe"C:\Users\Admin\AppData\Local\Temp\1c53f8f351aa28400483b8791dcddb30.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1c53f8f351aa28400483b8791dcddb30.exe"C:\Users\Admin\AppData\Local\Temp\1c53f8f351aa28400483b8791dcddb30.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1c53f8f351aa28400483b8791dcddb30.exe"C:\Users\Admin\AppData\Local\Temp\1c53f8f351aa28400483b8791dcddb30.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1c53f8f351aa28400483b8791dcddb30.exe"C:\Users\Admin\AppData\Local\Temp\1c53f8f351aa28400483b8791dcddb30.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/924-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/924-126-0x0000000001670000-0x0000000001990000-memory.dmp
memory/2684-115-0x0000000000160000-0x0000000000161000-memory.dmp
memory/2684-117-0x0000000004E40000-0x0000000004E41000-memory.dmp
memory/2684-118-0x0000000004A20000-0x0000000004A21000-memory.dmp
memory/2684-119-0x0000000004940000-0x0000000004E3E000-memory.dmp
memory/2684-120-0x0000000004A10000-0x0000000004A11000-memory.dmp
memory/2684-121-0x0000000004D20000-0x0000000004D38000-memory.dmp
memory/2684-122-0x00000000071B0000-0x00000000071B1000-memory.dmp
memory/2684-123-0x0000000007160000-0x00000000071AC000-memory.dmp