Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
28/12/2021, 12:45
General
- Target PO-28122021.exe
- Size 506KB
- Sample211228-py3ztscddl
- SHA256 278ca7471b97ea8a649958dce92862dbb71659d1c89fa67a600cabb2e36daaff
Malware Config
Extracted
-
xloader
-
2.5
-
pt0e
-
hautegirlmarket.com
-
theapcenter.com
-
mikesarcona.com
-
mixandcogroup.com
-
laomaody.com
-
prime-spot.store
-
fyzbb.com
-
robocats.xyz
-
newairdrops.com
-
mjnets.com
-
ceplat.com
-
beeleave.store
-
sarcassem.com
-
nfldog.club
-
scptrc.com
-
lasjaras.online
-
eve-media.store
-
vinyetgriera.online
-
ermnofbads.website
-
technetprotocol.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO-28122021.exe"C:\Users\Admin\AppData\Local\Temp\PO-28122021.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PO-28122021.exe"C:\Users\Admin\AppData\Local\Temp\PO-28122021.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\PO-28122021.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/756-134-0x0000000002E10000-0x0000000002EA0000-memory.dmp
memory/756-131-0x0000000000D60000-0x0000000000D77000-memory.dmp
memory/756-133-0x00000000030B0000-0x00000000033D0000-memory.dmp
memory/756-132-0x0000000000890000-0x00000000008B9000-memory.dmp
memory/1876-128-0x0000000005B50000-0x0000000005C70000-memory.dmp
memory/1876-135-0x0000000003270000-0x000000000334E000-memory.dmp
memory/3592-119-0x0000000004910000-0x00000000049A2000-memory.dmp
memory/3592-122-0x0000000006710000-0x0000000006770000-memory.dmp
memory/3592-121-0x0000000006DC0000-0x0000000006E5C000-memory.dmp
memory/3592-120-0x0000000004BE0000-0x0000000004BF0000-memory.dmp
memory/3592-114-0x00000000000B0000-0x0000000000134000-memory.dmp
memory/3592-118-0x0000000004960000-0x000000000496A000-memory.dmp
memory/3592-117-0x0000000004A30000-0x0000000004AC2000-memory.dmp
memory/3592-116-0x0000000004F30000-0x000000000542E000-memory.dmp
memory/3592-115-0x00000000000B0000-0x0000000000134000-memory.dmp
memory/4316-123-0x0000000000400000-0x0000000000429000-memory.dmp
memory/4316-127-0x00000000013F0000-0x0000000001401000-memory.dmp
memory/4316-126-0x0000000001720000-0x0000000001A40000-memory.dmp