Analysis
- max time kernel
148s - max time network
147s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
13/01/2022, 14:21
General
- Target IMG_9786.exe
- Size 505KB
- Sample220113-rn3mesage7
- SHA256 5568c3fed11b0714b4cf891d08bd645cdee9ba3801bcb4c31a16a510f23c6898
Malware Config
Extracted
-
xloader
-
2.5
-
eqhv
-
subdlt.com
-
gituri.com
-
ewjwler.com
-
tenlog023.xyz
-
duppercaptat.quest
-
realitybox.info
-
license-taxi.online
-
riyiflower.com
-
ff2941.com
-
glmarketplace.net
-
researchlearningspirit.xyz
-
eau-directory.xyz
-
federstuhl.com
-
tzchanghe.com
-
yournaturespa.com
-
earthsidesoulalchemist.com
-
2021exactdaytosell.com
-
vienuongsuaongchua.net
-
strongnotskinnyboomer.com
-
47chadburncrescent.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_9786.exe"C:\Users\Admin\AppData\Local\Temp\IMG_9786.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_9786.exe"C:\Users\Admin\AppData\Local\Temp\IMG_9786.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IMG_9786.exe"3⤵
- Deletes itself
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/616-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/616-66-0x0000000000170000-0x0000000000181000-memory.dmp
memory/616-65-0x0000000000770000-0x0000000000A73000-memory.dmp
memory/616-60-0x0000000000400000-0x0000000000429000-memory.dmp
memory/616-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1200-75-0x0000000007490000-0x00000000075D0000-memory.dmp
memory/1200-67-0x0000000006000000-0x000000000616C000-memory.dmp
memory/1240-59-0x0000000005E20000-0x0000000005E80000-memory.dmp
memory/1240-54-0x0000000000EC0000-0x0000000000F44000-memory.dmp
memory/1240-58-0x0000000000490000-0x000000000049A000-memory.dmp
memory/1240-57-0x0000000000750000-0x0000000000751000-memory.dmp
memory/1240-56-0x0000000075321000-0x0000000075323000-memory.dmp
memory/1240-55-0x0000000000EC0000-0x0000000000F44000-memory.dmp
memory/1492-70-0x0000000000630000-0x0000000000644000-memory.dmp
memory/1492-71-0x0000000000090000-0x00000000000B9000-memory.dmp
memory/1492-73-0x00000000021C0000-0x00000000024C3000-memory.dmp
memory/1492-74-0x0000000001FF0000-0x0000000002080000-memory.dmp