Analysis
- max time kernel
149s - max time network
141s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
13/01/2022, 14:21
General
- Target IMG_9786.exe
- Size 505KB
- Sample220113-rn3mesage7
- SHA256 5568c3fed11b0714b4cf891d08bd645cdee9ba3801bcb4c31a16a510f23c6898
Malware Config
Extracted
-
xloader
-
2.5
-
eqhv
-
subdlt.com
-
gituri.com
-
ewjwler.com
-
tenlog023.xyz
-
duppercaptat.quest
-
realitybox.info
-
license-taxi.online
-
riyiflower.com
-
ff2941.com
-
glmarketplace.net
-
researchlearningspirit.xyz
-
eau-directory.xyz
-
federstuhl.com
-
tzchanghe.com
-
yournaturespa.com
-
earthsidesoulalchemist.com
-
2021exactdaytosell.com
-
vienuongsuaongchua.net
-
strongnotskinnyboomer.com
-
47chadburncrescent.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 4 IoCs
- Blocklisted process makes network request 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_9786.exe"C:\Users\Admin\AppData\Local\Temp\IMG_9786.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_9786.exe"C:\Users\Admin\AppData\Local\Temp\IMG_9786.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IMG_9786.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2720-140-0x00000000056F0000-0x0000000005784000-memory.dmp
memory/2720-133-0x0000000003160000-0x000000000323E000-memory.dmp
memory/2720-130-0x0000000002FE0000-0x00000000030D8000-memory.dmp
memory/3212-125-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3212-132-0x0000000001A10000-0x0000000001A21000-memory.dmp
memory/3212-131-0x0000000000400000-0x0000000000429000-memory.dmp
memory/3212-128-0x0000000001A50000-0x0000000001D70000-memory.dmp
memory/3212-129-0x00000000015B0000-0x00000000015C1000-memory.dmp
memory/3844-121-0x0000000005C60000-0x0000000005C6A000-memory.dmp
memory/3844-118-0x0000000005770000-0x0000000005802000-memory.dmp
memory/3844-123-0x0000000009200000-0x000000000929C000-memory.dmp
memory/3844-122-0x0000000009110000-0x000000000915B000-memory.dmp
memory/3844-115-0x0000000000E00000-0x0000000000E84000-memory.dmp
memory/3844-120-0x0000000005820000-0x000000000582A000-memory.dmp
memory/3844-119-0x0000000005770000-0x0000000005C6E000-memory.dmp
memory/3844-124-0x00000000092A0000-0x0000000009300000-memory.dmp
memory/3844-117-0x0000000005C70000-0x000000000616E000-memory.dmp
memory/3844-116-0x0000000000E00000-0x0000000000E84000-memory.dmp
memory/4016-136-0x00000000008C0000-0x00000000008E9000-memory.dmp
memory/4016-135-0x0000000001190000-0x00000000011A3000-memory.dmp
memory/4016-138-0x00000000048F0000-0x0000000004C10000-memory.dmp
memory/4016-139-0x0000000004640000-0x00000000046D0000-memory.dmp