Analysis
- max time kernel
110s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
24/11/2021, 18:53
General
- Target 35357a041b14cb08b8e107770a9f9c18.exe
- Size 521KB
- Sample211124-xjm9tsdebk
- SHA256 4c6f60ba070864a86dceaa5785b1dceb395cbe4667b9c539bc0675411b4e16a9
Malware Config
Extracted
-
xloader
-
2.5
-
hno0
-
http://www.heidecide.xyz/hno0/
-
526854.rest
-
loosesalatoyof2.xyz
-
drillshear.com
-
kdsh-uae.com
-
firstnetinsurance.net
-
28684dw.com
-
hikinglifekr.com
-
astramed-clinic.store
-
24hxinh.com
-
livebongdatv.net
-
henrymaskph.com
-
newlanlan.com
-
txboilerparts.com
-
thepurldistrict.com
-
changemylifefast.info
-
sapphirecloset.com
-
ascensionmemberszoom.com
-
huffmanworks.com
-
techarcstudio.com
-
terbulen.store
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\35357a041b14cb08b8e107770a9f9c18.exe"C:\Users\Admin\AppData\Local\Temp\35357a041b14cb08b8e107770a9f9c18.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\35357a041b14cb08b8e107770a9f9c18.exe"C:\Users\Admin\AppData\Local\Temp\35357a041b14cb08b8e107770a9f9c18.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/900-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/900-126-0x00000000010F0000-0x0000000001410000-memory.dmp
memory/2148-115-0x0000000000620000-0x0000000000621000-memory.dmp
memory/2148-117-0x0000000005480000-0x0000000005481000-memory.dmp
memory/2148-118-0x0000000005060000-0x0000000005061000-memory.dmp
memory/2148-119-0x0000000004F80000-0x000000000547E000-memory.dmp
memory/2148-120-0x0000000005030000-0x0000000005031000-memory.dmp
memory/2148-121-0x0000000005320000-0x0000000005324000-memory.dmp
memory/2148-122-0x0000000008A30000-0x0000000008A31000-memory.dmp
memory/2148-123-0x0000000008AD0000-0x0000000008B3D000-memory.dmp