Analysis
- max time kernel
150s - max time network
153s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
13/01/2022, 11:25
General
- Target SOA-1236-1132220.exe
- Size 511KB
- Sample220113-njajashfg9
- SHA256 459c86bf11535b9d62c895a6677a5eb40d8f0cf3136477e5da746045bf3fb6a3
Malware Config
Extracted
-
xloader
-
2.5
-
eb4c
-
rasmkv.com
-
klhb1000.com
-
usales.agency
-
x4g7ae8.com
-
englishtutors.store
-
coffeegirlstuff.com
-
vpb-haiphong.com
-
noonesown.com
-
totallyglamplans.com
-
hlthtec.com
-
sculpturehairandfashion.com
-
jewelsjoule.com
-
ref-30001-p.com
-
brairazur.xyz
-
lilithsag.com
-
degengains.com
-
5d-crypto.com
-
sanfeca.com
-
wonderfulsunny.com
-
syntheticloot.net
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 4 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\SOA-1236-1132220.exe"C:\Users\Admin\AppData\Local\Temp\SOA-1236-1132220.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SOA-1236-1132220.exe"C:\Users\Admin\AppData\Local\Temp\SOA-1236-1132220.exe"3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SOA-1236-1132220.exe"C:\Users\Admin\AppData\Local\Temp\SOA-1236-1132220.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\SOA-1236-1132220.exe"5⤵
-
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1656-138-0x0000000004EF0000-0x0000000004F80000-memory.dmp
memory/1656-137-0x0000000005190000-0x00000000054B0000-memory.dmp
memory/1656-134-0x0000000001140000-0x00000000012B3000-memory.dmp
memory/1656-135-0x0000000000D10000-0x0000000000D39000-memory.dmp
memory/2928-129-0x0000000005F40000-0x0000000006090000-memory.dmp
memory/2928-139-0x0000000004B60000-0x0000000004C93000-memory.dmp
memory/2928-132-0x0000000000670000-0x000000000071E000-memory.dmp
memory/2936-120-0x0000000008D30000-0x0000000008D3A000-memory.dmp
memory/2936-114-0x0000000000B40000-0x0000000000BC6000-memory.dmp
memory/2936-115-0x0000000000B40000-0x0000000000BC6000-memory.dmp
memory/2936-116-0x00000000059E0000-0x0000000005EDE000-memory.dmp
memory/2936-117-0x0000000005430000-0x00000000054C2000-memory.dmp
memory/2936-123-0x0000000007120000-0x000000000717E000-memory.dmp
memory/2936-118-0x00000000054E0000-0x00000000059DE000-memory.dmp
memory/2936-119-0x00000000053F0000-0x00000000053FA000-memory.dmp
memory/2936-122-0x0000000006F80000-0x000000000701C000-memory.dmp
memory/2936-121-0x0000000008D50000-0x0000000008D9B000-memory.dmp
memory/3608-127-0x0000000000F30000-0x0000000001250000-memory.dmp
memory/3608-131-0x0000000001270000-0x0000000001281000-memory.dmp
memory/3608-130-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3608-124-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3608-128-0x0000000000EF0000-0x0000000000F01000-memory.dmp