Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    26-11-2021 10:27

General

  • Target

    DO 2168569 2172145000025112021.exe

  • Size

    584KB

  • MD5

    cb8bd5b9563bf3cfbafbbbbf99048266

  • SHA1

    9972dd790388aa860598448da56312571e4f4f5e

  • SHA256

    16afc1275bbb9dc325bcb03d7d0fb57b704adc0438c5c006070bdd07f2259230

  • SHA512

    858f481523f80cd8490deb9539a4ca8d5109aba5c6328ad0ea6f7aa063c229c462bc3a19197b08c7e6811df41c21b7fe8d7bf27f69a3c93d96f97795a88956a6

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

u0n0

C2

http://www.52xjg3.xyz/u0n0/

Decoy

learnwithvr.net

minismi2.com

slimfitbottle.com

gzartisan.com

fullfamilyclub.com

adaptationstudios.com

domynt.com

aboydnfuid.com

dirtroaddesigns.net

timhortons-ca.xyz

gladiator-111.com

breakingza.com

njjbds.com

keithrgordon.com

litestore365.host

unichromegame.com

wundversorgung-tirol.com

wholistic-choice.com

shingletownrrn.com

kapikenya.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Users\Admin\AppData\Local\Temp\DO 2168569 2172145000025112021.exe
      "C:\Users\Admin\AppData\Local\Temp\DO 2168569 2172145000025112021.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Users\Admin\AppData\Local\Temp\DO 2168569 2172145000025112021.exe
        "C:\Users\Admin\AppData\Local\Temp\DO 2168569 2172145000025112021.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1580
    • C:\Windows\SysWOW64\help.exe
      "C:\Windows\SysWOW64\help.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3488
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\DO 2168569 2172145000025112021.exe"
        3⤵
          PID:3240

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1580-127-0x0000000000400000-0x0000000000429000-memory.dmp
      Filesize

      164KB

    • memory/1580-130-0x0000000001570000-0x0000000001890000-memory.dmp
      Filesize

      3.1MB

    • memory/1580-131-0x0000000000FB0000-0x00000000010FA000-memory.dmp
      Filesize

      1.3MB

    • memory/1580-128-0x000000000041D440-mapping.dmp
    • memory/2704-126-0x0000000006170000-0x0000000006171000-memory.dmp
      Filesize

      4KB

    • memory/2704-118-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
      Filesize

      4KB

    • memory/2704-122-0x00000000056C0000-0x00000000056C8000-memory.dmp
      Filesize

      32KB

    • memory/2704-123-0x00000000056E0000-0x00000000056E1000-memory.dmp
      Filesize

      4KB

    • memory/2704-124-0x0000000005A70000-0x0000000005A71000-memory.dmp
      Filesize

      4KB

    • memory/2704-125-0x0000000005C10000-0x0000000005C6A000-memory.dmp
      Filesize

      360KB

    • memory/2704-115-0x0000000000210000-0x0000000000211000-memory.dmp
      Filesize

      4KB

    • memory/2704-120-0x00000000050A0000-0x00000000050A1000-memory.dmp
      Filesize

      4KB

    • memory/2704-119-0x0000000004F00000-0x0000000004F01000-memory.dmp
      Filesize

      4KB

    • memory/2704-121-0x0000000000983000-0x0000000000985000-memory.dmp
      Filesize

      8KB

    • memory/2704-117-0x0000000000980000-0x0000000000981000-memory.dmp
      Filesize

      4KB

    • memory/3020-132-0x0000000005F40000-0x00000000060C0000-memory.dmp
      Filesize

      1.5MB

    • memory/3020-139-0x0000000002710000-0x00000000027E7000-memory.dmp
      Filesize

      860KB

    • memory/3240-134-0x0000000000000000-mapping.dmp
    • memory/3488-133-0x0000000000000000-mapping.dmp
    • memory/3488-136-0x0000000000720000-0x0000000000749000-memory.dmp
      Filesize

      164KB

    • memory/3488-135-0x0000000000830000-0x0000000000837000-memory.dmp
      Filesize

      28KB

    • memory/3488-137-0x0000000003220000-0x0000000003540000-memory.dmp
      Filesize

      3.1MB

    • memory/3488-138-0x0000000002E70000-0x0000000002F00000-memory.dmp
      Filesize

      576KB