Analysis
- max time kernel
151s - max time network
151s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
23/12/2021, 02:53
General
- Target Payment Advice.exe
- Size 410KB
- Sample211223-dda8jaheen
- SHA256 6d722da095632d50aa49b4749a4e7db323889aee6fad1ecc2c5dd999e63c645e
Malware Config
Extracted
-
xloader
-
2.5
-
ic0e
-
cyber365solution.com
-
nftfinancecoin.com
-
originalkodsukses.icu
-
liyiworld.com
-
malcolms.tech
-
rushabhexports.com
-
growerinvestment.com
-
carjabber.com
-
thatsnotmydriveway.com
-
ytlog66.com
-
schreitereadymix.com
-
giannellifirenze.com
-
mumtasarim.com
-
reviewdetails.info
-
kerpsake.com
-
sophiefrancesleeds.com
-
freenessforum.com
-
swpfo.com
-
goldenboys.website
-
d1ac.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 4 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\Payment Advice.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2464-130-0x0000000002C30000-0x0000000002CC0000-memory.dmp
memory/2464-129-0x0000000004500000-0x0000000004820000-memory.dmp
memory/2464-126-0x00000000008F0000-0x0000000000903000-memory.dmp
memory/2464-127-0x0000000000340000-0x0000000000369000-memory.dmp
memory/2656-120-0x00000000005C0000-0x00000000005D1000-memory.dmp
memory/2656-123-0x0000000000A20000-0x0000000000A31000-memory.dmp
memory/2656-122-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2656-119-0x0000000000B40000-0x0000000000E60000-memory.dmp
memory/2656-116-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2760-124-0x0000000006FB0000-0x00000000070E0000-memory.dmp
memory/2760-121-0x00000000068A0000-0x00000000069D4000-memory.dmp
memory/2760-131-0x00000000074C0000-0x00000000075C6000-memory.dmp