Analysis
- max time kernel
149s - max time network
152s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
09/12/2021, 12:32
General
- Target TELEX BI FOR SHIPMENT.exe
- Size 1.2MB
- Sample211209-pql2cadcdj
- SHA256 570739eb4eabb01d3d7c22c895a5a86153ceef2b54d32a651a12869b33b78015
Malware Config
Extracted
-
xloader
-
2.5
-
posg
-
http://www.bennshop.com/posg/
-
thisisplace.info
-
redbudg.com
-
yusufgolet.com
-
madden-maritime.com
-
kimasaad.xyz
-
playlovely.com
-
babydiaper.xyz
-
servicios-royale.com
-
moalsaidy.com
-
nextchamba.com
-
ifoot.online
-
patcheffect.com
-
tablesaw.tools
-
gamingtrendy.com
-
0er.biz
-
realitydrift.art
-
anshulmehandi.online
-
druvajtteet.quest
-
powdersllc.com
-
1004crimsonclover.info
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TELEX BI FOR SHIPMENT.exe"C:\Users\Admin\AppData\Local\Temp\TELEX BI FOR SHIPMENT.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TELEX BI FOR SHIPMENT.exe"C:\Users\Admin\AppData\Local\Temp\TELEX BI FOR SHIPMENT.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TELEX BI FOR SHIPMENT.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2260-128-0x00000000016A0000-0x00000000019C0000-memory.dmp
memory/2260-129-0x0000000001600000-0x0000000001611000-memory.dmp
memory/2260-125-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2420-137-0x00000000053E0000-0x000000000552A000-memory.dmp
memory/2420-130-0x0000000000E60000-0x0000000000F2D000-memory.dmp
memory/2592-121-0x0000000008EF0000-0x0000000008EF7000-memory.dmp
memory/2592-118-0x0000000005A30000-0x0000000005A31000-memory.dmp
memory/2592-124-0x0000000009310000-0x0000000009426000-memory.dmp
memory/2592-122-0x0000000008F00000-0x0000000008F01000-memory.dmp
memory/2592-115-0x0000000000F00000-0x0000000000F01000-memory.dmp
memory/2592-120-0x0000000005990000-0x0000000005991000-memory.dmp
memory/2592-119-0x00000000059A0000-0x00000000059A1000-memory.dmp
memory/2592-123-0x0000000009270000-0x0000000009271000-memory.dmp
memory/2592-117-0x0000000005F30000-0x0000000005F31000-memory.dmp
memory/3376-133-0x0000000000B90000-0x0000000000BB9000-memory.dmp
memory/3376-132-0x0000000001090000-0x00000000010A9000-memory.dmp
memory/3376-135-0x0000000004D50000-0x0000000005070000-memory.dmp
memory/3376-136-0x0000000005070000-0x0000000005100000-memory.dmp