Analysis
- max time kernel
118s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
13/11/2021, 10:56
General
- Target 412241a9318ff1dac966423d98e42ca6.exe
- Size 443KB
- Sample211113-m1ph4sehg3
- SHA256 b4c8ee0de2b2db7adf56e9cbe744b5737b6efe3c3b851bfab64b1690dca0d5ca
Malware Config
Extracted
-
xloader
-
2.5
-
scb0
-
http://www.llaa11.xyz/scb0/
-
austinsv.net
-
nothernballet.com
-
mycoursey.com
-
exodiduis.com
-
frankserranolaw.com
-
dingyiemail.com
-
woodstocktimbersandbeams.com
-
somphones.com
-
goalcations.com
-
boraeresici.com
-
spiegelverwarming.store
-
8676789.rest
-
tametaverse.com
-
suppliesdevon.com
-
sergiofisheronmcl.com
-
reevophilippines.com
-
oemlift.com
-
helloworld.agency
-
klaydoge.com
-
cristinadiasoficial.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\412241a9318ff1dac966423d98e42ca6.exe"C:\Users\Admin\AppData\Local\Temp\412241a9318ff1dac966423d98e42ca6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\412241a9318ff1dac966423d98e42ca6.exe"C:\Users\Admin\AppData\Local\Temp\412241a9318ff1dac966423d98e42ca6.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\412241a9318ff1dac966423d98e42ca6.exe"C:\Users\Admin\AppData\Local\Temp\412241a9318ff1dac966423d98e42ca6.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\412241a9318ff1dac966423d98e42ca6.exe"C:\Users\Admin\AppData\Local\Temp\412241a9318ff1dac966423d98e42ca6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1500-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1500-126-0x0000000001710000-0x0000000001A30000-memory.dmp
memory/2768-115-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/2768-117-0x0000000005000000-0x0000000005001000-memory.dmp
memory/2768-118-0x0000000004B00000-0x0000000004B01000-memory.dmp
memory/2768-119-0x0000000004A10000-0x0000000004AA2000-memory.dmp
memory/2768-120-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/2768-121-0x0000000004EE0000-0x0000000004EE7000-memory.dmp
memory/2768-122-0x0000000008340000-0x0000000008341000-memory.dmp
memory/2768-123-0x00000000082F0000-0x0000000008336000-memory.dmp