Analysis
- max time kernel
118s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
11/11/2021, 11:24
General
- Target f7058072591bbc7032cc0daedbccbf85.exe
- Size 452KB
- Sample211111-nhp8csgcfk
- SHA256 433494d21eabe777d1947da83d6281e5ac35bf98eea4791fcebf5e1561723384
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
fpdi
C2
-
http://www.walletwriter.space/fpdi/
Decoy
-
jencio.com
-
b9jty7.com
-
banahinvestments.com
-
capitolfurniture.net
-
jlvip1086.com
-
pompeyocargo.com
-
designbyshubhi.info
-
elbauldepecas.com
-
bracelexx.online
-
advanceporbrx.xyz
-
ruihongco.com
-
wipemirecord.com
-
goodfoodsme.com
-
sommpick.com
-
rangilugujarat.com
-
realestate5g.com
-
spunkdlashes.com
-
palisadestahoehousing.com
-
brandingsocal.com
-
privatejetsboston.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7058072591bbc7032cc0daedbccbf85.exe"C:\Users\Admin\AppData\Local\Temp\f7058072591bbc7032cc0daedbccbf85.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f7058072591bbc7032cc0daedbccbf85.EXE"C:\Users\Admin\AppData\Local\Temp\f7058072591bbc7032cc0daedbccbf85.EXE"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2996-118-0x0000000000570000-0x0000000000576000-memory.dmp
memory/2996-119-0x0000000000570000-0x000000000057A000-memory.dmp
memory/3652-120-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3652-122-0x0000000000A00000-0x0000000000D20000-memory.dmp