Analysis
- max time kernel
153s - max time network
158s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
02/12/2021, 13:24
General
- Target REQUEST FOR SPECIFICATION.exe
- Size 477KB
- Sample211202-qndsmacaa9
- SHA256 9e4e02725cde43b4da85cdf054b11ad0e4a622bb54f4a967b1634ebcaea9666a
Malware Config
Extracted
-
xloader
-
2.5
-
xgmi
-
http://www.mxnorge.com/xgmi/
-
inemilia.com
-
zeuss.info
-
znzv666.com
-
wearablehealthsensor.com
-
24hservice.online
-
paisabazar.online
-
dqhuanbao.com
-
atalyk.com
-
tzxlkj.com
-
surprisebra.com
-
oometea.com
-
northvisiondigital.com
-
goldenbayexpert.com
-
ricottagomlvr.xyz
-
vjuror.com
-
dudacruz.online
-
mypasscodekeycard.com
-
cameraip.digital
-
rapidtraderfx.com
-
merittanning.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR SPECIFICATION.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\REQUEST FOR SPECIFICATION.exe"C:\Users\Admin\AppData\Local\Temp\REQUEST FOR SPECIFICATION.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\REQUEST FOR SPECIFICATION.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2532-137-0x00000000046B0000-0x0000000004740000-memory.dmp
memory/2532-136-0x00000000048F0000-0x0000000004C10000-memory.dmp
memory/2532-134-0x0000000000F80000-0x0000000000F9F000-memory.dmp
memory/2532-135-0x0000000000870000-0x0000000000899000-memory.dmp
memory/3024-131-0x0000000005D00000-0x0000000005EA2000-memory.dmp
memory/3024-138-0x0000000005BB0000-0x0000000005CB6000-memory.dmp
memory/3384-123-0x0000000005830000-0x0000000005831000-memory.dmp
memory/3384-125-0x0000000006030000-0x0000000006031000-memory.dmp
memory/3384-124-0x0000000005AD0000-0x0000000005B29000-memory.dmp
memory/3384-118-0x00000000006A0000-0x00000000006A1000-memory.dmp
memory/3384-122-0x0000000005180000-0x0000000005186000-memory.dmp
memory/3384-121-0x0000000005240000-0x0000000005241000-memory.dmp
memory/3384-120-0x0000000005010000-0x0000000005011000-memory.dmp
memory/3840-130-0x00000000017A0000-0x00000000017B1000-memory.dmp
memory/3840-129-0x00000000012B0000-0x00000000015D0000-memory.dmp
memory/3840-126-0x0000000000400000-0x0000000000429000-memory.dmp