Analysis
- max time kernel
119s - max time network
122s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
15/12/2021, 12:03
General
- Target 14e865f28f1a02890383d2ec6638e6f9.exe
- Size 1017KB
- Sample211215-n7116aadem
- SHA256 6fafca0825dbdedf739d4f57ea1b09563eed9834a54f2998b712891baeef4839
Malware Config
Extracted
-
xloader
-
2.5
-
b62n
-
http://www.multidetoxhepatico.com/b62n/
-
childzplanet.com
-
nine8culture.com
-
yourfoodmenu.com
-
nxhxyzjy.com
-
nobelies.com
-
baetsupreme.net
-
indiadiscountedfares.com
-
iconnect-design.com
-
durston.store
-
sweetcreationsbyjp.com
-
ktieman.com
-
getvirtualaddress.com
-
cryptopoly-figures.com
-
minismi2.com
-
ricemoment.com
-
regionalhomescommercial.com
-
onelike.biz
-
d22.group
-
kwissleapp.com
-
cindyrandband.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14e865f28f1a02890383d2ec6638e6f9.exe"C:\Users\Admin\AppData\Local\Temp\14e865f28f1a02890383d2ec6638e6f9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\14e865f28f1a02890383d2ec6638e6f9.exe"C:\Users\Admin\AppData\Local\Temp\14e865f28f1a02890383d2ec6638e6f9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1476-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1476-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1476-63-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1476-65-0x00000000008F0000-0x0000000000BF3000-memory.dmp
memory/1632-55-0x0000000001340000-0x0000000001341000-memory.dmp
memory/1632-57-0x0000000076141000-0x0000000076143000-memory.dmp
memory/1632-58-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
memory/1632-59-0x00000000003D0000-0x00000000003D8000-memory.dmp
memory/1632-60-0x00000000058D0000-0x00000000059E6000-memory.dmp