Analysis
- max time kernel
122s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
16/12/2021, 10:17
General
- Target 4264cf96c4354a225036078ac1b06473.exe
- Size 426KB
- Sample211216-mbcs1sbgd3
- SHA256 bc83ad76bf99cf257e381272a7db0e07e7faac33aad6de6f2d12460e9022ff4a
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
h0id
Decoy
-
monteiromt.com
-
biyell.com
-
fofdirect.com
-
savethatpost.com
-
goccedaynight.com
-
cryptopsales.com
-
aw-mall.com
-
ffmagic.com
-
luiscarloslopes.website
-
infiniteinfinites.com
-
getercnow.com
-
oudet-mall.com
-
bright-tailor.com
-
3-h0.online
-
outerverse.space
-
apexpowerwashingservices.com
-
kyrstensinema2024.com
-
equalblog.com
-
deadbeatingheart.com
-
soundtilt.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4264cf96c4354a225036078ac1b06473.exe"C:\Users\Admin\AppData\Local\Temp\4264cf96c4354a225036078ac1b06473.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4264cf96c4354a225036078ac1b06473.exe"C:\Users\Admin\AppData\Local\Temp\4264cf96c4354a225036078ac1b06473.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2732-116-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2732-118-0x00000000009E0000-0x0000000000D00000-memory.dmp