Analysis
- max time kernel
124s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
15/11/2021, 09:19
General
- Target c50bc8464f722d1c3e5b33e4ec6de2c5.exe
- Size 729KB
- Sample211115-k971psefhk
- SHA256 b08d103ca391e1023d2b40ac31d0940124e81914eeea79b86c01b7566be546e2
Malware Config
Extracted
-
xloader
-
2.5
-
zaip
-
http://www.madlyrics.net/zaip/
-
azxyga.space
-
cahayuu.xyz
-
atapoll.com
-
deadpanrofjvt.xyz
-
mailpostz.com
-
media-mustard.com
-
kondanginyuk.online
-
generatorysolarne.com
-
khayacoffee.com
-
krillnews.com
-
webdyx.com
-
yizongzhongyi.com
-
studiomiden.com
-
weixiaotuo.com
-
padel-ledverlichting.com
-
eastmillnorthandover.com
-
ayhyjj.com
-
hoenirs.info
-
baronbj.com
-
cafesnack.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c50bc8464f722d1c3e5b33e4ec6de2c5.exe"C:\Users\Admin\AppData\Local\Temp\c50bc8464f722d1c3e5b33e4ec6de2c5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c50bc8464f722d1c3e5b33e4ec6de2c5.exe"C:\Users\Admin\AppData\Local\Temp\c50bc8464f722d1c3e5b33e4ec6de2c5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/500-127-0x0000000000400000-0x0000000000429000-memory.dmp
memory/500-129-0x0000000000FC0000-0x00000000012E0000-memory.dmp
memory/2588-118-0x00000000008C0000-0x00000000008C1000-memory.dmp
memory/2588-120-0x0000000005720000-0x0000000005721000-memory.dmp
memory/2588-121-0x0000000005220000-0x0000000005221000-memory.dmp
memory/2588-122-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/2588-123-0x00000000051E0000-0x00000000051E1000-memory.dmp
memory/2588-124-0x0000000008760000-0x0000000008767000-memory.dmp
memory/2588-125-0x0000000008A90000-0x0000000008A91000-memory.dmp
memory/2588-126-0x0000000008C30000-0x0000000008C76000-memory.dmp