Analysis
- max time kernel
110s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
03/01/2022, 03:59
General
- Target Statement01202202_000000000000001020010201021020010.pdf.exe
- Size 426KB
- Sample220103-ej316sbaa5
- SHA256 f80dd0bf7402bebd03d303c97c8dd3f921d3e923a2521f4a2af2e4bf3c288aa1
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
b556
Decoy
-
infinitephoenix.space
-
karo-tasty.com
-
suddennnnnnnnnnnn25.xyz
-
casamentorafaissa.com
-
gstfranchisecenter.com
-
privateerspace.space
-
mersuapuku.quest
-
advancebits.club
-
naturevaidh.com
-
thegiftingtree.online
-
reeronsales.com
-
paustral.com
-
diemondistro.com
-
sportytimefitness.com
-
kixevent.com
-
0686n.com
-
okokav3.xyz
-
vitaymuhendislik.com
-
howisyourday807.rest
-
japanroofing.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Statement01202202_000000000000001020010201021020010.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Statement01202202_000000000000001020010201021020010.pdf.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Statement01202202_000000000000001020010201021020010.pdf.exe"C:\Users\Admin\AppData\Local\Temp\Statement01202202_000000000000001020010201021020010.pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3540-116-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3540-118-0x0000000000A10000-0x0000000000D30000-memory.dmp