Analysis
- max time kernel
151s - max time network
154s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
16/11/2021, 14:17
General
- Target swift copy.exe
- Size 334KB
- Sample211116-rlpmsabbcr
- SHA256 d559f37dbda95ac2f2e50388cae80a4ee30c81216b644f65ecf4c1ceb87a0b5a
Malware Config
Extracted
-
xloader
-
2.5
-
mub6
-
http://www.hiranilawfirm.com/mub6/
-
gsjbd47.club
-
adaptiveranking.xyz
-
najikye0.xyz
-
cherishstar.com
-
chicandcitizen.paris
-
starmoon2022.com
-
515east85thstreet3d.com
-
evenshine.net
-
viptoor.com
-
splncial.com
-
casatowerdubai.com
-
394661.com
-
sahodyafbdchapter.com
-
hellenburg.net
-
bribribribri.com
-
empiredigitaldating.com
-
szkoleniawcag.online
-
easybeasts.com
-
jewelry-ms.com
-
knittools.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swift copy.exe"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\swift copy.exe"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\swift copy.exe"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\swift copy.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1920-115-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/1920-117-0x0000000005940000-0x0000000005941000-memory.dmp
memory/1920-118-0x0000000005360000-0x0000000005361000-memory.dmp
memory/1920-119-0x0000000005440000-0x000000000593E000-memory.dmp
memory/1920-120-0x0000000005410000-0x0000000005411000-memory.dmp
memory/1920-121-0x0000000005930000-0x0000000005937000-memory.dmp
memory/1920-122-0x0000000007AB0000-0x0000000007AB1000-memory.dmp
memory/1920-123-0x0000000007A60000-0x0000000007AA6000-memory.dmp
memory/2856-128-0x0000000001000000-0x0000000001011000-memory.dmp
memory/2856-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2856-127-0x0000000001020000-0x0000000001340000-memory.dmp
memory/3064-129-0x0000000004E10000-0x0000000004FA7000-memory.dmp
memory/3064-136-0x00000000027C0000-0x000000000289B000-memory.dmp
memory/3320-133-0x0000000000170000-0x0000000000199000-memory.dmp
memory/3320-132-0x0000000000E30000-0x0000000000E57000-memory.dmp
memory/3320-134-0x00000000045A0000-0x00000000048C0000-memory.dmp
memory/3320-135-0x0000000004360000-0x00000000043F0000-memory.dmp