Analysis
- max time kernel
118s - max time network
120s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
13/01/2022, 15:56
General
- Target 918947e35d3442dc73fcc228dbf7cf43.exe
- Size 421KB
- Sample220113-tdf2sabdbk
- SHA256 6846492babd6809fcbf6d1a30ebd47db29061bc23237069ff85a86b406b1abb0
Score
10/10
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
pnug
Decoy
-
natureate.com
-
ita-pots.website
-
sucohansmushroom.com
-
produrielrosen.com
-
gosystemupdatenow.online
-
jiskra.art
-
janwiench.com
-
norfolkfoodhall.com
-
iloveaddictss.com
-
pogozip.com
-
buyinstapva.com
-
teardirectionfreedom.xyz
-
0205168.com
-
apaixonadosporpugs.online
-
jawscoinc.com
-
crafter.quest
-
wikipedianow.com
-
radiopuls.net
-
kendama-co.com
-
goodstudycanada.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Loads dropped DLL 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\918947e35d3442dc73fcc228dbf7cf43.exe"C:\Users\Admin\AppData\Local\Temp\918947e35d3442dc73fcc228dbf7cf43.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\918947e35d3442dc73fcc228dbf7cf43.exe"C:\Users\Admin\AppData\Local\Temp\918947e35d3442dc73fcc228dbf7cf43.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/576-57-0x0000000000400000-0x0000000000429000-memory.dmp
memory/576-59-0x00000000008B0000-0x0000000000BB3000-memory.dmp
memory/1596-55-0x0000000076731000-0x0000000076733000-memory.dmp