Analysis
- max time kernel
4265100s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
16/01/2022, 08:08
General
- Target IMG_9785.exe
- Size 393KB
- Sample220116-j1j2vaffdm
- SHA256 31fcaa22e49398fe59bfdbd11e8b341c700c8dab0165b67caf3982f7e7164643
Malware Config
Extracted
-
xloader
-
2.5
-
eqhv
-
subdlt.com
-
gituri.com
-
ewjwler.com
-
tenlog023.xyz
-
duppercaptat.quest
-
realitybox.info
-
license-taxi.online
-
riyiflower.com
-
ff2941.com
-
glmarketplace.net
-
researchlearningspirit.xyz
-
eau-directory.xyz
-
federstuhl.com
-
tzchanghe.com
-
yournaturespa.com
-
earthsidesoulalchemist.com
-
2021exactdaytosell.com
-
vienuongsuaongchua.net
-
strongnotskinnyboomer.com
-
47chadburncrescent.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 2 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_9785.exe"C:\Users\Admin\AppData\Local\Temp\IMG_9785.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IMG_9785.exe"C:\Users\Admin\AppData\Local\Temp\IMG_9785.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\IMG_9785.exe"3⤵
-
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2484-152-0x00000000028A0000-0x0000000002939000-memory.dmp
memory/2484-145-0x0000000008610000-0x00000000087B5000-memory.dmp
memory/2640-144-0x00000000012E0000-0x00000000012F1000-memory.dmp
memory/2640-143-0x0000000001330000-0x000000000167A000-memory.dmp
memory/2640-141-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2912-147-0x0000000000E40000-0x0000000000E47000-memory.dmp
memory/2912-148-0x0000000000780000-0x00000000007A9000-memory.dmp
memory/2912-149-0x00000000031B0000-0x00000000034FA000-memory.dmp
memory/2912-151-0x0000000002F10000-0x0000000002FA0000-memory.dmp
memory/3712-139-0x0000000009580000-0x000000000961C000-memory.dmp
memory/3712-138-0x00000000057A0000-0x00000000057AA000-memory.dmp
memory/3712-137-0x0000000005720000-0x0000000005CC4000-memory.dmp
memory/3712-136-0x00000000057C0000-0x0000000005852000-memory.dmp
memory/3712-133-0x0000000000D80000-0x0000000000DE8000-memory.dmp
memory/3712-135-0x0000000005CD0000-0x0000000006274000-memory.dmp
memory/3712-134-0x0000000000D80000-0x0000000000DE8000-memory.dmp