Analysis
- max time kernel
150s - max time network
153s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
26/11/2021, 10:39
General
- Target 2ac8d894e24bcd30aca57b0fd640250c.exe
- Size 723KB
- Sample211126-mpyyeafbd8
- SHA256 5627d54b0f87a8fa0e9a33d2cbce145140eb0e88e77f1076e7658310b742aa83
Malware Config
Extracted
-
xloader
-
2.5
-
ht08
-
http://www.septemberstockevent200.com/ht08/
-
joye.club
-
istanbulemlakgalerisi.online
-
annikadaniel.love
-
oooci.com
-
curebase-test.com
-
swisstradecenter.com
-
hacticum.com
-
centercodebase.com
-
recbi56ni.com
-
mmj0115.xyz
-
sharpstead.com
-
sprklbeauty.com
-
progettogenesi.cloud
-
dolinum.com
-
amaroqadvisors.com
-
traininig.com
-
leewaysvcs.com
-
nashhomesearch.com
-
joy1263.com
-
serkanyamac.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 54 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2ac8d894e24bcd30aca57b0fd640250c.exe"C:\Users\Admin\AppData\Local\Temp\2ac8d894e24bcd30aca57b0fd640250c.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mobsync.exeC:\Windows\System32\mobsync.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/868-131-0x00000000028A0000-0x0000000002930000-memory.dmp
memory/868-130-0x0000000002C30000-0x0000000002F50000-memory.dmp
memory/868-129-0x0000000002350000-0x0000000002379000-memory.dmp
memory/868-128-0x00000000000B0000-0x00000000000BB000-memory.dmp
memory/2164-119-0x00000000027B1000-0x00000000027C5000-memory.dmp
memory/2164-118-0x0000000000570000-0x000000000061E000-memory.dmp
memory/2540-122-0x0000000073B00000-0x0000000073B29000-memory.dmp
memory/2540-124-0x0000000004A20000-0x0000000004D40000-memory.dmp
memory/2540-125-0x0000000002EC0000-0x0000000002ED1000-memory.dmp
memory/2540-121-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/3016-126-0x0000000001380000-0x0000000001440000-memory.dmp
memory/3016-132-0x0000000006870000-0x000000000699B000-memory.dmp