Analysis
- max time kernel
122s - max time network
127s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
15/12/2021, 12:03
General
- Target 14e865f28f1a02890383d2ec6638e6f9.exe
- Size 1017KB
- Sample211215-n7116aadem
- SHA256 6fafca0825dbdedf739d4f57ea1b09563eed9834a54f2998b712891baeef4839
Malware Config
Extracted
-
xloader
-
2.5
-
b62n
-
http://www.multidetoxhepatico.com/b62n/
-
childzplanet.com
-
nine8culture.com
-
yourfoodmenu.com
-
nxhxyzjy.com
-
nobelies.com
-
baetsupreme.net
-
indiadiscountedfares.com
-
iconnect-design.com
-
durston.store
-
sweetcreationsbyjp.com
-
ktieman.com
-
getvirtualaddress.com
-
cryptopoly-figures.com
-
minismi2.com
-
ricemoment.com
-
regionalhomescommercial.com
-
onelike.biz
-
d22.group
-
kwissleapp.com
-
cindyrandband.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\14e865f28f1a02890383d2ec6638e6f9.exe"C:\Users\Admin\AppData\Local\Temp\14e865f28f1a02890383d2ec6638e6f9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\14e865f28f1a02890383d2ec6638e6f9.exe"C:\Users\Admin\AppData\Local\Temp\14e865f28f1a02890383d2ec6638e6f9.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1724-127-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1724-129-0x0000000001A70000-0x0000000001D90000-memory.dmp
memory/4092-117-0x0000000000480000-0x0000000000481000-memory.dmp
memory/4092-119-0x0000000005290000-0x0000000005291000-memory.dmp
memory/4092-120-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/4092-121-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/4092-122-0x0000000005040000-0x0000000005041000-memory.dmp
memory/4092-123-0x0000000004D90000-0x000000000528E000-memory.dmp
memory/4092-124-0x0000000005280000-0x0000000005288000-memory.dmp
memory/4092-125-0x00000000075E0000-0x00000000075E1000-memory.dmp
memory/4092-126-0x00000000078C0000-0x00000000079D6000-memory.dmp