Analysis
- max time kernel
153s - max time network
150s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
02/12/2021, 13:24
General
- Target REQUEST FOR SPECIFICATION.exe
- Size 477KB
- Sample211202-qndsmacaa9
- SHA256 9e4e02725cde43b4da85cdf054b11ad0e4a622bb54f4a967b1634ebcaea9666a
Malware Config
Extracted
-
xloader
-
2.5
-
xgmi
-
http://www.mxnorge.com/xgmi/
-
inemilia.com
-
zeuss.info
-
znzv666.com
-
wearablehealthsensor.com
-
24hservice.online
-
paisabazar.online
-
dqhuanbao.com
-
atalyk.com
-
tzxlkj.com
-
surprisebra.com
-
oometea.com
-
northvisiondigital.com
-
goldenbayexpert.com
-
ricottagomlvr.xyz
-
vjuror.com
-
dudacruz.online
-
mypasscodekeycard.com
-
cameraip.digital
-
rapidtraderfx.com
-
merittanning.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 23 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR SPECIFICATION.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR SPECIFICATION.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR SPECIFICATION.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1096-73-0x00000000008C0000-0x0000000000950000-memory.dmp
memory/1096-70-0x0000000000DB0000-0x0000000000DD2000-memory.dmp
memory/1096-72-0x00000000021E0000-0x00000000024E3000-memory.dmp
memory/1096-71-0x0000000000070000-0x0000000000099000-memory.dmp
memory/1420-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1420-65-0x0000000000A00000-0x0000000000D03000-memory.dmp
memory/1420-66-0x0000000000280000-0x0000000000291000-memory.dmp
memory/1420-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1420-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1424-67-0x0000000004AA0000-0x0000000004BD0000-memory.dmp
memory/1424-74-0x00000000041E0000-0x0000000004276000-memory.dmp
memory/1704-55-0x00000000002F0000-0x00000000002F1000-memory.dmp
memory/1704-59-0x0000000004750000-0x00000000047A9000-memory.dmp
memory/1704-58-0x0000000000290000-0x0000000000296000-memory.dmp
memory/1704-57-0x0000000004810000-0x0000000004811000-memory.dmp