Analysis
- max time kernel
151s - max time network
148s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
12/01/2022, 04:21
General
- Target TT Transmitted Copy TRVTT2200390.exe
- Size 706KB
- Sample220112-eynj2abag9
- SHA256 071d14c83f00ed98e9c00926273cc741b6de2c4d74b7c02b63dce652ae5b8735
Malware Config
Extracted
-
xloader
-
2.5
-
n8bs
-
monese-bank.com
-
silkypumps.xyz
-
tashabouvier.com
-
eduardoleonsilva.com
-
pinnaclecorporaterentals.com
-
megafluids.com
-
worldwidecarfans.com
-
benjamlnesq.com
-
unitedraxiapp.com
-
thetanheroes.com
-
jypmore.quest
-
indianasheriffs.biz
-
saintinstead.com
-
alldansmx.com
-
trulyproofreading.com
-
indotogel369.com
-
mermadekusse.store
-
radosenterprisellc.com
-
gseequalservices.com
-
techride.xyz
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\TT Transmitted Copy TRVTT2200390.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/812-125-0x0000000008170000-0x00000000081CE000-memory.dmp
memory/812-123-0x0000000005550000-0x0000000005A4E000-memory.dmp
memory/812-117-0x0000000005A50000-0x0000000005F4E000-memory.dmp
memory/812-118-0x00000000055F0000-0x0000000005682000-memory.dmp
memory/812-119-0x00000000055A0000-0x00000000055AA000-memory.dmp
memory/812-120-0x00000000079B0000-0x0000000007A50000-memory.dmp
memory/812-121-0x0000000005820000-0x000000000582E000-memory.dmp
memory/812-122-0x0000000007C60000-0x0000000007CAB000-memory.dmp
memory/812-115-0x0000000000CB0000-0x0000000000D68000-memory.dmp
memory/812-124-0x0000000007FD0000-0x000000000806C000-memory.dmp
memory/812-116-0x0000000000CB0000-0x0000000000D68000-memory.dmp
memory/1784-134-0x0000000000280000-0x000000000028B000-memory.dmp
memory/1784-135-0x0000000002380000-0x00000000023A9000-memory.dmp
memory/1784-136-0x0000000002D30000-0x0000000003050000-memory.dmp
memory/1784-137-0x0000000002BB0000-0x0000000002C40000-memory.dmp
memory/2472-131-0x00000000064B0000-0x00000000065F5000-memory.dmp
memory/2472-138-0x0000000002C50000-0x0000000002D05000-memory.dmp
memory/2764-126-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2764-128-0x0000000001840000-0x0000000001B60000-memory.dmp
memory/2764-130-0x0000000001730000-0x0000000001741000-memory.dmp