Analysis
- max time kernel
148s - max time network
149s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
10/11/2021, 04:59
General
- Target Payment Order.exe
- Size 426KB
- Sample211110-fmecnagch8
- SHA256 236e7cb220d65dd5fe8a2f9aa0274331cc0e0f7e724839a76423dbb1a0cde625
Malware Config
Extracted
-
xloader
-
2.5
-
nurc
-
http://www.imzztoken.xyz/nurc/
-
digitalassetagency.xyz
-
zeuss.info
-
palisadestahoe.net
-
pjduffy.xyz
-
emperorsoasis.com
-
mapogosmello.com
-
restorativeeducationllc.com
-
ortakoyfirini.xyz
-
valentina-gil.com
-
anshulmehandi.online
-
hokkistar.com
-
quotexqatar.com
-
designssavelives.com
-
invokethepowerofprayer.com
-
lawsofcozy.com
-
drredu.com
-
by8115.com
-
idwalalodge.com
-
christinevandenhove.com
-
comicbookkitchenparty.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Order.exe"C:\Users\Admin\AppData\Local\Temp\Payment Order.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Order.exe"C:\Users\Admin\AppData\Local\Temp\Payment Order.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment Order.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1344-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1344-127-0x0000000000F00000-0x0000000001220000-memory.dmp
memory/1344-128-0x0000000000E80000-0x0000000000E91000-memory.dmp
memory/2876-131-0x0000000000E90000-0x0000000000EAE000-memory.dmp
memory/2876-135-0x0000000003650000-0x00000000036E0000-memory.dmp
memory/2876-133-0x0000000003A90000-0x0000000003DB0000-memory.dmp
memory/2876-132-0x0000000002EB0000-0x0000000002ED9000-memory.dmp
memory/3024-129-0x0000000002B30000-0x0000000002C29000-memory.dmp
memory/3024-136-0x0000000005290000-0x000000000541B000-memory.dmp
memory/3036-120-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/3036-118-0x0000000005550000-0x0000000005551000-memory.dmp
memory/3036-119-0x0000000005470000-0x000000000596E000-memory.dmp
memory/3036-115-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
memory/3036-122-0x0000000008DD0000-0x0000000008DD1000-memory.dmp
memory/3036-117-0x0000000005970000-0x0000000005971000-memory.dmp
memory/3036-121-0x0000000008A90000-0x0000000008A97000-memory.dmp
memory/3036-123-0x0000000008F70000-0x0000000008FB6000-memory.dmp